Information security is a growing concern for today's businesses though it does not always get enough attention. One problem is justifying the budget necessary to properly protect information systems. This paper explores why information security should be a priority for businesses and deals with how a security expert can model potential losses for their organization. There is no silver bullet for modeling security risks so this paper discusses various methods that can be used as guidelines for professionals to make well informed decisions. Not all losses are able to be modeled correctly and for this reason they may be overlooked or improperly understood by an organization. Non-financial losses such as the potential for stock devaluation due to damaged reputations are also explored.
展开▼
