Three Case Studies in Quantitative Information Risk Analysis

In this paper, we build on existing literature and on a dialog with several decision-making partners (e.g., CISOs) to propose a simple methodology to quantitatively assess the value of security. We use this methodology to provide quantitative data gathered from three case studies of real organizations. The vastly different results we obtain across the three organizations considered emphasize the dependence between the security investments and the nature of the organization implementing them.