Identity Security protects systems, data and processes. But which measure reduces which risk – and what economic benefit does it bring? Simulation models combine potential damage costs with probabilities of occurrence and the costs of specific measures. This creates a traceable basis for investment decisions.
Organisations are investing in automation, new technologies and AI-supported processes. At the same time, they need to secure their systems and digital identities. Security budgets therefore compete with other investments.
The benefit of Identity Security often shows in events that do not happen: an orphaned account is closed, unauthorised access is prevented or the misuse of privileged rights is made more difficult. For senior management, the question is therefore how this effect can be assessed in economic terms.
Why compliance alone is not enough
Regulatory requirements determine which rules organisations must comply with and which controls they must establish. To prioritise investments, a view of the expected effect is also needed.
What financial consequences could a security incident have? How does a measure change this risk? And are its costs proportionate to the expected benefit? Answers to these questions help the C-level to deploy budgets on a sound basis.
How risks can be assessed in economic terms
Individual cyberattacks cannot be reliably predicted. For defined scenarios, however, probabilities of occurrence and potential damage costs can be estimated. These include, for example, business interruption, recovery, legal advice and possible fines.
A simulation model links these variables and examines how security measures change the expected financial risk. The potential reduction in damage costs and resulting contractual penalties can then be weighed against the investment and operating costs.
The approach builds on established risk modelling: this method has already been applied successfully to the assessment of assets in distribution networks (electricity, water and gas networks)1. The simulation method applied to assets is known as Asset Strategy Planning (ASP) and is used, for example, to assess the follow-up costs of strategic decisions in investment or operations. The results of these simulations are used as a basis for decisions up to board level. A comparable principle can be applied to cyber risks. Transparent assumptions and the quality of the available data remain decisive.
What matters is how much a measure reduces the expected financial risk – and what it costs.
Why targeted measures are decisive
Privileged Access Management makes it harder to misuse far-reaching rights. Role management supports consistent assignment of permissions. Closing orphaned accounts reduces uncontrolled access.
How great the benefit of these measures is depends on the respective system landscape and its interaction with Identity Governance. More budget therefore does not automatically lead to more security.
Simulation models can make different measures and combinations comparable. This makes it possible to justify which investment should come first and where additional funds can be expected to have the greatest effect.
How we support decisions
This assessment is the second stage of our Identity Security Process. We look at the entire system and identity landscape in order to classify access, permissions, existing controls and risks in context.
Building on this, we are developing a simulation approach for the economic assessment of Identity Security measures. Expected damage costs, their potential reduction and the costs of implementation are intended to give the C-level traceable points of comparison.
Incorporating specific customer data as the basis for the simulation is a further development step. Our goal is a sound basis for decisions about which measures should be implemented and when which investment is advisable.
Conclusion
Simulation models make the economic impact of Identity Security traceable. They help to consider potential damage, the costs of measures and the expected risk reduction together.
Anyone who understands these relationships can prioritise security investments in a targeted way and justify their business benefit on a sound basis.
- Steffen, A.; Wemhoff, C.; Hübner, S.; Spitzer, H.: Integration of Strategic and Operational Asset Management. In: Proceedings of the 22nd International Conference and Exhibition on Electricity Distribution (CIRED 2013), Stockholm, Sweden, 10-13 June 2013. Paper 0501.
