Schneier on Security

David Baron • April 30, 2007 11:36 PM

What you describe (about 33 minutes in) as "annualized loss expectancy" seems to me to be a bad way of determining how much to spend on security. The goal should be spending on security to maximize expected benefit minus cost, not spending to make the total cost equal the total expected benefit (which makes the net benefit zero). Benefit minus cost (which I also called net benefit) is maximized when marginal expected benefit equals marginal cost. (Perhaps "expected benefit" is an odd way to describe "expected loss prevented", it makes the description apply to more than just security.)