A longstanding problem with anybody selling security products is that they don’t have an ROI like normal products. Does it bring in sales or increase efficiency? Or by another formulation of the old rule of thumb, does it make money or save money? Either way, if the purchasing executives take the rule of thumb too seriously, then security looks like a cost with no benefit.

So we came up with Value Protection,” Larson says. “You spend time and capital on security so that you don’t allow the erosion of existing growth or prevent new growth from taking root. The number-one challenge for us is not the ability to deploy the next, greatest technology. That’s there. What we need to do now is quantify the value to the business of deploying those technologies.”

Value Made Visible How American Water’s Bruce Larson uses a simple metric to build bridges with business partners and justify security spending at the same time, By Scott Berinato CSOonline.com, April 2006

That seems like a pretty good elevator pitch to sceptical executives.

Personally, I always thought security was about protection; what else would it be? (Well, several things else, but I’ll come to that.) Continue reading →