Internet security: you don't get what you pay for.

Hackers, spies, worms and viruses get plenty of press, but what do you get when you invest in protecting yourself against them? Not much, it seems. Even security consultants have a hard time trying to make a business case for investing in security.

No one has really measured what's at risk, how big the risk is and what it is really worth to get rid of the risk. "Security is probably the last domain of business administration that has not agreed to submit itself to serious quantitative scrutiny," says Andrew Jaquith, program director at the security consulting firm @stake. Jacquith and his co-authors noted in a recent article that the average firm spends 0.047 percent of its revenue on security. But the scarcity of data and reluctance of firms to share information about security makes it hard to say where, exactly, that security investment goes, and what precisely it is accomplishing.

When they put on their marketing hats, security consultants and vendors understandably tend to say that firms are not spending enough, and to point to the increasing number and frequency of attacks, especially from the Internet. Yet a 2003 survey by the Computer Security Institute indicates that it's wise to take these warnings with a grain of salt.

The Institute polled 530 firms and found that while Internet attacks had increased, overall financial losses from both internal and external attacks had plunged by more than half from last year's level. Financial fraud losses were down even more, from over $100 million to less than $10 million. The only area of loss that seemed to have increased was from so-called "denial of service" attacks, estimated to have cost the 530 firms around $65 million, or an average of $122,642 apiece.

A consultant in the security practice of a Big Four audit firm, who asked not to be identified, says, "Security is still more folk art than science. We have no strong security measurements, no historical data, we can't perform actuarial calculations and we're in the dark in terms of measuring the impact on business."

Any loss is a bad loss, and one would prefer to prevent every one, but probably not at any price. The rub is--what price makes business sense?

Ross Anderson, a reader in security engineering at Cambridge University in Britain and an authority in the economics of security, bluntly declares, "The level of the threat is widely overestimated. The best information we have suggests that the return on security investments, while not zero, tends to be lower than some other investments you might have made."

Anderson presents a convincing case that some of the most popular security consulting techniques, such as penetration testing, may be, if not quite a total waste of time and money, close to it. One popular security defense is to test systems repeatedly for weaknesses and repair them in order to prevent hackers from getting in that way. But the odds are strong that the hackers and the security testers will discover different bugs.

Anderson compares the task of the security tester with that of the marshals of the old West who had to defend a vast, sparsely populated region from bandits who could strike anywhere. "Even a moderately resourced attacker can break anything that's at all large and complex," he has written. "There is nothing that can be done to stop this, as long as there are enough different security vulnerabilities to do statistics; different testers find different bugs."

It's costly and dubious for systems users to try to discover and patch bugs, according to this thinking. On the other hand, it would be relatively inexpensive for software and systems developers to debug their systems before releasing them to market. So far, first-mover advantage and network economies have made it foolish for developers to do so. The classic illustration of network economies is the fax machine: When there was only one fax machine, a fax machine wasn't worth much to anyone. But when more and more people started to use them, they became indispensable office equipment. The technology was only valuable because many people used it, and the more people in the user network, the greater the economic value of the technology.

Being First Is Critical

Of course, the first product to the market has the best chance at establishing those network economies. That's one reason why early releases of Microsoft Corp. products, for example, have been notoriously buggy. Microsoft still relies on its users to find and report bugs; then, the company issues patches, which users can download to fix the bugs. The economic advantages of being first to market are so powerful that Microsoft has had no rational economic incentive to make the software bug-proof the first time.

That may be changing, though, as developers find a powerful economic advantage in creating more secure systems. Unfortunately for users, the cure may be more costly than the disease. Anderson singles out the so-called "trusted computing" initiative, which initially brought together Microsoft, Intel Corp., IBM Corp. and Hewlett-Packard Corp. in the Trusted Computing Platform Alliance. This initiative aims to ensure, among other things, that computer users will be able to communicate securely and know that a machine they're communicating with isn't using a program that's been hacked.

But the technology that goes into trusted computing will also make it very difficult and expensive for users to switch to other operating systems or software suites. "Trusted computing" thus guarantees security by locking the user into a particular vendor's products--and pricing. The costs of insecure computing are apt to be negligible by comparison to those of "trusted computing," he suggests. "It masquerades as a security play, but actually it's an anti-competitive play. It's at the right level of cleverness, because it's simple enough to work but complex enough to be difficult to explain to a congressman," he says.

Increasingly, security consultants are recommending that companies look at Internet security not through the lens of technology but rather through the lens of risk management. @stake's Jaquith suggests that companies might begin to get an idea of security risk with a few simple metrics, such as whether and how recently the system has installed patches.

"Since these viruses thrive on systems that aren't patched, that's the biggest Achilles heel, and understanding how up-to-date [your systems are] is a good metric." Jaquith also recommends keeping track of how people use the system, and calculating a ratio of benign users and attackers, in order to keep a watch on trends.

Until security vendors show evidence to the contrary, experts suggest there's no point in pouring huge sums into an activity with no demonstrable return. "The great majority of sensible IT investment in mature companies that understand the threat is good, old-fashioned dependability investment, such as backup data centers, multiple networks and teams of auditors who understand the systems and have continuity, so they remember what went wrong 10 years ago," says Anderson. "At big banks, you find that, at blue chips you find it, but the average company at the bottom end of the Fortune 500 and the average middle-size company doesn't have that strength and depth, and is more likely to fall victim to the scare-mongering."

The bottom line in security is, after all, the bottom line. Know where you stand, know what you stand to lose, and make your decision based on the cost of risk and the price of effective protection.

Gregory J. Millman (gj.millman@earth link.net) is a freelance business writer in New Jersey and a frequent contributor to Financial Executive.