Understanding the Economics of Cyber Defense

Knowing when, where, and how much to invest in cyber defense is a challenge. This tool was created by Juniper Networks and interprets some of the principles of a framework, developed by The RAND Corporation, which aims to provide a new way to think about the various levers organizations should consider across the major areas that they can control in order to reduce the potential costs associated with cybersecurity. The RAND model analyzes a vast array of variables that impact the return on managing risk to investment, in a way that suggests how an organization might balance the four major spend areas: tools, workforce training, BYOD and IoT policy, and network isolation techniques.

Let’s get started.

How many people work at your company/enterprise?

The following questions will help us determine the value of your enterprise’s information:

Do you have customers that will pull their business from you if you are hacked?

Yes

Do you require insurance to manage the risk of a cyber-attack?

Yes

Is the data within your organization so valuable that a data breach could push you into bankruptcy?

Yes

Have you ever calculated what a cyber-attack might cost you in terms of lost profits?

Yes

Help us understand the diligence of your security organization.

How many security specialists do you have in your IT organization?

Roughly, how many times per year does your security technology need to be reconfigured or require service calls with vendors to work properly?

What is the annual revenue for your enterprise?

.00

Help us understand how accessible your enterprise’s information is inside and outside of your organization. Would you consider the critical information (e.g. customer records, financial records) within your organization to be:

Very accessible: the critical information within my organization is distributed across many departments and all have to be connected to the Internet.

Somewhat accessible: the critical information within my organization is distributed across a few departments and connection to the Internet is important but not essential for all operations.

Not accessible: the critical information within my organization is centralized and can be (or is already) isolated from the Internet.

Please fill in all required information.

Results

The percentages below represent possible investment levels for your organization in each of these four areas as a percentage of your overall revenue, by the year 2025. Because these are percentages of your annual revenue, the sum of them will not add up to 100%.

It is plausible that your results may produce some or all zeroes. If this is true for your results, it indicates that baseline efforts are sufficient for the dynamics of your organization.

Training: Increased training for employees may reduce the risk of incidents and breaches.

Tools: Security-related tools and technology can help prevent an attacker from gaining access to your network.

BYOD Policies and IoT: Restricting device connection policies and increasing access control can help reduce risk.

Air-gapping: Network isolation (air-gapping) can go a long way from preventing a network compromise.

Email my results

Success

Opt in to receive additional information from Juniper Networks.

Juniper Networks protects your personal data in accordance with our Privacy Policy.