Re: [Security400] How paranoid do you get?

["John Earl" <johnearl@xxxxxxxxxxxxxxxxxx>]

How paranoid should you be?  Only you (and/or your company) can answer that,
but here are some decision criteria that may help...

1) What is the cost to your company if this data falls into the wrong hands
(say, the local newspaper, or your most vociferous competitor, etc.  the
worst case scenario)
2) What is the cost of securing the data.
3) What is the cost to your "the worst case scenario" to acquire the data.
This includes technological and non-technological (bribes for example)
costs.

If item 1 is extraordinarily high, you may have to secure the data no matter
what.
If item 1 is extraordinarily low, then just let the data flow.
If item 2 is extraordinarily high, your choices may be reduced to A) Gamble,
or B) Don't transmit the data.
If item 2 is extraordinarily low, you should choose to secure the data just
on principle.
If item 3 is extraordinarily high, the right choice may be to simply "chance
it".
If item 3 is extraordinarily low, you'll want to lean heavily towards
securing the data.

If you remove the word "extraordinarily" from the sentences above, then your
choices would be more driven by the ratio's between items 1,2, and 3.   For
example, if the cost of securing the data approaches or exceeds the value of
the data to a competitor (regardless of how expensive it is for the
competitor to acquire the data) then just let it flow. If the value of the
data is medium, the cost to acquire is low, and the cost to secure is
medium, well that's when you ask a business manager to make a decision on
how much (if any they want to spend).   You get the picture.



jte


--
John Earl
www.powertechgroup.com  john.earl@powertechgroup.com
The Powertech Group Inc. Seattle, Washington
Where the Security Experts Live!

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--