Vereskun M. V. The effectiveness of investments in information security: problems and solutions

Abstract

The article made a comparative analysis of the main advantages and disadvantages of three methods for determining cost effectiveness of information security of industrial enterprises. Two methods based on the use of aggregate indicators: ROI (Return on Investment - return on investment) for a certain period of time, TCO (Total Cost of Ownership - total cost of ownership of assets. Also used the method developed by Gartner Group. The main advantages of ROI is: the ability to predict results and complexity of IP-used indicators. The main disadvantage is the lack of opportunities to determine the value of the confidential information. The main advantages of the indicator of TCO are: better opportunities to account for all possible costs and the ability to justify the expenditure at different levels of readiness of the protection systems. The main disadvantages of the indicator TCO: problem-lichnosti selection of two projects that both reduce costs and the lack of accounting for the impact of risks. The main advantages of the methodology Gartner Group: accounting for the impact of risks and the ability to determine the effectiveness of system security for all levels of the company. The main disadvantage of this method is that it is based only on the analysis of possible risks.
It is proved that the use of any one technique does not give a complete picture of the effectiveness of spending on information security. The conclusion about the necessity of improvement of existing methodologies for assessing efficiency, the main focus of which is their joint use. To do this, the paper proposed an improved methodological approach to assessing the effectiveness of investments in information security, which is based on the procedures of the optimal choice of the protection system, the risk assessment during implementation of the selected alternative and evaluation capabilities of the enterprise regarding making a certain Fig-cov. To facilitate practical implementation of the developed approach in the article the algorithm of its realization.