[EMAIL PROTECTED] wrote: > Allen writes: > -+----------- > | > "More than $1 billion is spent annually by the private sector on cyber > | > security," said Link, who is the United States representative on the > | > United Nations Economic Commission for Europe where he evaluates > | > innovation and competiveness policies for the European Union. "That > | > translates to $1,500 per employee. Many companies have no idea how to > | > employ the usefulness of cyber security tools. There are no benchmarks > | > for companies." > | > | Even being generous and say it is $1.5 billion. That means there > | are only 100,000 employees in the private sector! > | > | I'd say the math is a bit whacked, wouldn't you? > | > > > Yeah, I saw that, too. I'll bet/guess it is a British > "billion" (10^12) and not an American "billion" (10^9). > > Not that I believe the number in any case. My own figures > say it is more like $200 and, thus, Gene Spafford remains > correct that we spend more per capita on coffee than infosec.
Since Link went to University of Richmond for his BS in math and his Ph.D. in economics from Tulane University, I would think he is American most likely and using American terminology. In any case, the lack of proper qualifiers makes it suspect. To do a bit of math, the approximate number of workers in the US private sector is 1.35*10^8. At ~$200/head that is $2.7*10^9. I have no idea whether my anecdotal experience is accurate or not, and I'm not sure what all is included when Link says, "...cyber security," but based on my experience at on rather large HMO with 160,000 employees, I would guess ~$2000 per employee per year is closer to the mark, and is probably low given the figures I have seen for encryption, FSSO, VM, IdM, IAM, and measures taken around secure backup and storage of data. But two factors must be considered, one is that it is health care so the requirements may well be higher than the median; and the other, offsetting this somewhat, is the notorious slowness to act and parsimony of the health care industry. Clearly the common plumbing company is not likely to have all that great a burn rate for cyber security. Added to this is that most business in the US is "small" (if I recall correctly over 85% of people work for small businesses - can't find a quick reference on this) so that your figure of ~$200 may be a more accurate reflection of money spent; however, given the large number of companies attempting to create and sell products that relate to cyber security I suspect it is too low. In any case the figures given don't jibe and may be off by one or more orders of magnitude. Best, Allen _______________________________________________ FDE mailing list [email protected] http://www.xml-dev.com/mailman/listinfo/fde
