Paul, >> Thanks for your comments. >> >>> Unless you can demonstrate concrete revenue generationg directly >>> attributable to security, I don't think you can overcome that perception >>> (and loss avoidance through trust building does not generate revenue.) >> >> I believe the purpose of the paper is to move away from the loss avoidance >> model and describe information security in fashion that demonstrates how >> security mechanisms have a direct role to play in the creation of assets >> and business relationships. >> >I understand that, but I think your trust model is merely a euphemism for >loss avoidance. And I don't see how you can avoid being seen as loss >avoidance - unless you can show the ability to generate revenue.
I understand your concern and it is perfectly valid. I would be skeptical too initially. But I do not think it is a euphemism. It seems to me there are real world examples of revenue generating assets based on information security mechanisms. iTunes, Unbox, Speedpass/Easypass/Paypass. Do these not create cash flows? Could they create cash flows (or even exist) if the security mechanisms (DRM/authentication) were not present? The information security mechanisms are a necessary but not sufficient condition to create these new assets. The loss prevention model shows how this necessary condition breaks down and what we can do to stop the breakdown. The virtual trust model says that once we have this necessary condition, here are the things we may do with it. The focus is different. I am very well aware of the loss prevention model. It seems to me there is an addition way to describe how security mechanisms function other than loss prevention. The virtual trust perspective is coherent, logical and accurately describes the world. It does not exclude the loss prevention model but can incorporate loss prevention into it. Thanks for your continued feedback on the paper: http://www.ftusecurity.com/pub/VT-belva-dekay-final.pdf Sincerely, Ken _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
