Getting a ROI from security investments

Security purchases should be based on business principals that focus on return on investment, said Jaco Voigt, director, managed network services at network integrator and first-tier Internet service provider (ISP), DataPro.

Said Voigt: "An old axiom comes to mind: never buy a R100 fence to protect a R10 horse. While this might sound eminently locally, how do businesses place a rand value on their information-based assets - and what technologies and tools should your business buy to protect those assets?"

Voigt said that while determining the return on investment (ROI) on any IT expenditure is tricky, qualifying the money spent on security is even more difficult, if not impossible. "To understand the importance of investing in security, you must first understand the risk involved in an Internet-connected business. While the level and degree of risk involved varies greatly, all companies involved in Internet-business are at risk."

But how do you determine the risk involved? Risk is the multiple of three factors: threat (the rate and frequency of potential security breaches), vulnerability (likelihood of a successful treat against your organisation) and event costs.

Where event costs refer to the "hard" costs of a security breach, such as computers systems, data resources and applications) but more complex is the "soft" costs. Soft costs include productivity losses, downtime and lost man hours spent fixing the problem. Zero multiplied by zero equals zero. This fundamentally means that when your business can reduce any one of these multiples to zero, there is no risk.

But, realistically, most companies won`t be able to do this.

"A starting point is to acknowledge that there is a risk and secondly, companies need to change their mindsets - they must seriously understand, and believe, that security should be a major priority. There are a host of threats in a digital economy - and these threats are ever-changing. This notwithstanding, the rewards of good security are difficult to see and quantify - and associated costs are high."

Voigt said DataPro`s family of security products offer best-of-breed solutions tailored to meet the security needs of clients, as well as being able to adapt to changing needs.

"Our products allow you to safeguard your entire business. While your business grows and you maximise new opportunities, we will help you minimise your risk," said Voigt.