Interesting question - and lots of opinions, I bet. Just read this interesting article on Network World where EMC's CSO, Roland Cloutier, argues for the proposition. To quote Roland...
“I challenge the theory that [security] is a necessary evil and I believe that if you do security well as part of your business processes that you will become a more competitive company..”
Notice the emphasis on business processes - this is where the real benefits come in. Security in itself can make you feel safer doing business, but the combined investment in security, infrastructure, business processes etc are what will make you stand out from the competition. Patrick had discussed how this applies in the context of PCI and comparing it to the benefits realized by companies who invested in Y2K.
At the end of the day I think well implmented security reduces transaction costs in business, reduces disruptions and therefore will be beneficial to the bottom line.
Now, all we have to do is quantify it! Hmm.. that might be a much harder challenge..
“I challenge the theory that [security] is a necessary evil and I believe that if you do security well as part of your business processes that you will become a more competitive company..”
Notice the emphasis on business processes - this is where the real benefits come in. Security in itself can make you feel safer doing business, but the combined investment in security, infrastructure, business processes etc are what will make you stand out from the competition. Patrick had discussed how this applies in the context of PCI and comparing it to the benefits realized by companies who invested in Y2K.
At the end of the day I think well implmented security reduces transaction costs in business, reduces disruptions and therefore will be beneficial to the bottom line.
Now, all we have to do is quantify it! Hmm.. that might be a much harder challenge..
