🔐 Simply Cyber Course Materials - Community Access Welcome! This content is shared with enrolled students as part of our commitment to inclusion and value delivery in cybersecurity education. We believe in supporting each other's learning journey through ethical collaboration. Please help us maintain this open educational environment by keeping this URL within our course community. Sharing this link publicly undermines our ability to freely provide these materials. Questions? Reach out to your instructor—we're here to support your success!

Table of Contents

13.20 (Step 1) Considerations: Cybersecurity Org Size and Design

🏗️ Cybersecurity Org Size and Design

Company Size Categories (IANS Framework):

  • Midsize Companies ($50M - $400M revenue)

    • Small, focused security teams

    • Multi-hat roles common

    • Limited specialization

  • Large Companies ($400M - $6B revenue)

    • More dedicated teams

    • Broader security function coverage

    • Some role specialization

  • Fortune Companies ($6B+ revenue)

    • Large specialized workforces

    • Comprehensive security measures

    • Highly specialized roles

    • Teams can range from 50+ to 200+ (e.g., Salesforce GRC team: 200 people)

2023SecurityOrganizationandCompensationSummaryReport.pdf

2023SecurityOrganizationandCompensationSummaryReport.pdf

10.15 MB File

www.iansresearch.com/resources/all-blogs/post/security-blog/2023/11/15/2023-infosec-org-guidance

🚚 In-House Versus Outsourced Tasks

Companies With Cybersecurity Job Postings in Seattle

Find Cybersecurity jobs in Seattle, WA | Indeed.com.pdf

Find Cybersecurity jobs in Seattle, WA | Indeed.com.pdf

153.48 KB File

Company

Annual Revenue (Billion USD)

Amazon

513.9

Apple

394.3

Google

282.8

AT&T

120.7

Meta

116.6

Salesforce

34.9

IANS “Fortune”

6.0+

IANS “Large"

0.4-6.0

IANS “Midsize"

0.05-0.4

Key Challenges for Smaller Organizations:

  • Competing for talent with tech giants

  • High compensation demands

  • Frequent talent poaching

  • Need for creative solutions:

    • Opening offices in other cities/countries

    • Strategic outsourcing decisions

Strategic Framework: Three Categories of Tasks

1. Core Tasks (Keep In-House)

Outsource what makes sense

Core tasks

  • Help the business take smart cyber risks

  • Deliver higher quality cybersecurity decisions than outsiders would be able to

  • Establish and maintain critical business relationships with people across the company, so the cybersecurity agenda gets the attention it deserves

Core Task Examples:

  • Cybersecurity Governance: Developing and implementing policies and frameworks that guide the security posture of the organization. This includes compliance with regulatory requirements and aligning cybersecurity strategies with business objectives.

  • Incident Response and Management: Establishing and maintaining an incident response team and plan that can quickly and effectively handle security breaches. This is crucial for minimizing damage and restoring operations, and requires intimate knowledge of the company's IT infrastructure and business operations.

  • Risk Assessment and Management: Continually assessing and managing cyber risks associated with business operations. This involves identifying, evaluating, and prioritizing risks based on their potential impact on the business and devising strategies to mitigate them.

2. Strategic Outsourcing Tasks (60-80% External)

  • Employees are directly assisted by outside experts who do the majority (60–80%) of the detailed work

Strategic Outsourcing Examples:

  • Development of First Cyber Risk Management Action Plan: Bringing NIST CSF and Cyber Resilience Practitioner expertise.

  • Penetration Testing and Vulnerability Assessments: Specialized skills needed for certain assessments.

  • Security Operations Center (SOC) Services: Outsourcing the monitoring and analysis of security alerts to a third-party provider. While the strategic oversight remains in-house, the day-to-day operations and initial incident handling can be managed by external experts.

3. Commodity Outsourcing Tasks (100% External)

  • Third party (outsourced) workers perform 100% of the work under the direct oversight of your employee

Commodity Outsourcing Examples:

  • Quarterly PCI-DSS assessment vulnerability scans: Routine scans by a certified provider for assurance that new vulnerabilities introduced by system changes or newly discovered threats are identified and remediated in a timely manner.

  • Managed Firewall Services: Outsourcing the routine maintenance, monitoring, and management of firewall infrastructure to a third-party provider. This includes regular updates, rule configuration, and log analysis, which are standard across many organizations.

  • Patch Management: Utilizing external services to ensure that software patches and updates are applied timely across the organization’s systems and applications. This task is highly standardized and crucial for securing systems from known vulnerabilities.

  • Email Security Services: Outsourcing email filtering and scanning to detect and block spam, phishing attempts, and other malicious messages. This service is a common necessity and can be standardized for different organizations.

13.21 🧾 Cost of Implementation

Business Language Framework

Key Principles from Jason Dion:

  • Stop talking tech, start talking business

  • Use language of money and risk

  • Frame as business need, not "cyber guys" need

  • Show tangible value, not just theory

3TCO

3TCO = (Implementation Cost) + (Annual Operating Cost x 3)

6 Example Summary

Example 1: Quarterly PCI-DSS assessment vulnerability scans

Assumptions
  1. Acquisition Cost: This may include any initial costs for tools or services needed for scanning, such as software licenses or third-party service providers. This can range from $1,000 to $5,000 initially, depending on the scope and scale of the operations.

  2. Implementation Hours: The setup time can vary, but might include integration with existing systems, configuring the scans, and initial run-throughs. Estimate about 10 to 40 hours for a mid-sized environment.

  3. Labor Cost: Assuming a labor cost of $50 to $100 per hour, consistent with technical cybersecurity expertise.

  4. Annual Renewal Cost: This includes ongoing costs for software updates, license renewals, or continued service provider fees, which might range from $2,000 to $10,000 annually.

  5. Operating Hours per Year: Since PCI-DSS scans are conducted quarterly, additional hours will be required for reviewing scan results, addressing vulnerabilities, and ensuring compliance. Estimate about 50 to 200 hours annually, depending on the complexity and findings of the scans.

Let’s use mid-range values for these parameters:

  • Acquisition Cost: $3,000

  • Implementation Hours: 25 hours

  • Labor Cost: $75/hour

  • Annual Renewal Cost: $6,000

  • Operating Hours per Year: 125 hours

Step 1: Calculate Implementation Cost
Step 2: Calculate Annual Operating Cost
Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

=$4,875+(3×$15,375)

=$4,875+$46,125

=$51,000

Example 2: Patch Management Services

Assumptions

For patch management services, which typically involve software tools and services to ensure systems are up-to-date with the latest security patches and updates, the cost estimation involves a few different components compared to hardware-centric solutions. Here’s an estimation breakdown using industry-standard assumptions:

  1. Acquisition Cost: This may include the cost of the software license and any initial setup or integration fees. This can range from $2,000 to $10,000, depending on the complexity and scale.

  2. Implementation Hours: Depending on the size of the environment and the complexity of integration with existing systems, implementation hours could be between 20 to 100 hours.

  3. Labor Cost: Assuming a labor cost of $50 to $100 per hour.

  4. Annual Renewal Cost: This generally includes ongoing software licenses and support services, which might range from $1,000 to $5,000 annually.

  5. Operating Hours per Year: Since this service is largely automated, the annual operating hours for manual tasks (like review and adjustments to policies) might be lower, around 10 to 50 hours.

Let’s use mid-range values for these parameters:

  • Acquisition Cost: $6,000

  • Implementation Hours: 60 hours

  • Labor Cost: $75/hour

  • Annual Renewal Cost: $3,000

  • Operating Hours per Year: 30 hours

Step 1: Calculate Implementation Cost
Step 2: Calculate Annual Operating Cost
Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

=$10,500+(3×$5,250)

=$10,500+$15,750

=$26,250

Example 3: Managed Firewall Services Example

Assumptions
  1. Acquisition Cost: Generally, this includes the cost of the firewall hardware and any initial setup fees by the service provider. This can vary widely, but for a mid-sized business, this might range from $3,000 to $15,000.

  2. Implementation Hours: Managed services might require less customer-side implementation effort since the provider handles much of the setup. Estimate around 20 to 50 hours.

  3. Labor Cost: For the client's side of implementation, using a similar labor cost as before, $50 to $100 per hour.

  4. Annual Renewal Cost: This includes ongoing management fees, updates, and monitoring services. Typically, this would be a more substantial cost than just renewal of licenses and might range from $10,000 to $30,000 annually.

  5. Operating Hours per Year: With managed services, the operating hours (from the client's perspective) are significantly reduced. We'll estimate about 10 to 30 hours annually, focusing on oversight and coordination rather than direct management.

Choosing mid-range values for these parameters:

  • Acquisition Cost: $9,000

  • Implementation Hours: 35 hours

  • Labor Cost: $75/hour

  • Annual Renewal Cost: $20,000

  • Operating Hours per Year: 20 hours

Step 1: Calculate Implementation Cost
Step 2: Calculate Annual Operating Cost
Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

=$11,625+(3×$21,500)

=$11,625+$64,500=$76,125

Example 4: Email Gateway

Assumptions
  • Acquisition Cost: $5,000 to $20,000 depending on the capacity, features, and vendor.

  • Implementation Hours: 40 to 100 hours, considering setup, configuration, and testing.

  • Labor Cost: Approximately $50 to $100 per hour, based on the expertise required.

  • Annual Renewal Cost: Typically 10-20% of the acquisition cost.

  • Operating Hours per Year: 50 to 200 hours for maintenance, updates, and troubleshooting.

Choosing mid-range values for these parameters:

  • Acquisition Cost: $12,500

  • Implementation Hours: 70 hours

  • Labor Cost: $75/hour

  • Annual Renewal Cost: $2,000 (assuming 16% of the acquisition cost)

  • Operating Hours per Year: 125 hours

Step 1: Calculate Implementation Cost

Implementation Cost

=$12,500+(70 hours×$75/hour)

=$12,500+$5,250

=$17,750

Step 2: Calculate Annual Operating Cost

Annual Operating Cost

=$2,000+(125 hours×$75/hour)

=$2,000+$9,375

=$11,375

Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

=$17,750+(3×$11,375)

=$17,750+$34,125

=$51,875

Example 5: Penetration Testing and Vulnerability Assessments

Assumptions
  • Acquisition Cost: Not applicable - pay per assessment

  • Annual Assessments: 1 major penetration test and 2 vulnerability assessments per year

  • Labor Cost: $100/hour (internal staff managing and coordinating the tests)

  • Annual Renewal Cost: Not applicable as each assessment is contracted separately

  • Operating Hours per Year: 30 hours * 3 assessments = 90 hours

Step 1: Calculate Total Annual Assessment Cost
Step 2: Calculate Annual Operating Cost
Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

= $0 + (3 x $9,000)

= $27,000

Example 6: Security Operations Center (SOC) Services

Assumptions
  1. Acquisition Cost: This could include the cost of setting up the SOC, which may involve physical infrastructure and software tools. The costs can range significantly depending on whether it's an in-house setup or outsourced. For a mid-sized business, this might range from $100,000 to $500,000.

  2. Implementation Hours: If the SOC is being built from scratch, the implementation can be extensive, involving hundreds of hours. For simplicity, I’ll consider outsourced services where the setup time is lower, around 100 to 300 hours.

  3. Labor Cost: This typically includes salaries for skilled cybersecurity personnel. The hourly cost could be high, but for outsourced services, this would be part of the service fee. We will include this in the annual operating costs instead.

  4. Annual Renewal Cost: This would encompass the ongoing service fees for the SOC, including tools, personnel, and incident response services. Annually, this might range from $200,000 to $1,000,000 for a comprehensive service.

  5. Operating Hours per Year: For outsourced SOC services, direct operating hours from the client’s side are significantly reduced, mainly involving periodic reviews and strategic oversight, perhaps 50 to 100 hours per year.

Let’s select typical values for outsourced SOC services for a mid-sized company:

  • Acquisition Cost: $150,000 (this might include initial setup fees for an outsourced service)

  • Implementation Hours: 200 hours

  • Labor Cost: $100/hour (estimated oversight and coordination cost)

  • Annual Renewal Cost: $400,000 (a typical mid-range annual fee)

  • Operating Hours per Year: 75 hours

Step 1: Calculate Implementation Cost
Step 2: Calculate Annual Operating Cost
Step 3: Calculate 3-Year Total Cost of Ownership (3TCO)

3TCO

=$170,000+(3×$407,500)

=$170,000+$1,222,500

=$1,392,500

⚖️ 3TCO for Our 8 Gap Closing Actions

Key Takeaways:

  • Cybersecurity is a business risk, not just an IT issue

  • Success requires speaking the language of business

  • 3TCO analysis enables better decision-making

  • Business value must be clearly articulated

  • Trust is central to all security value propositions

  • Balance in-house expertise with strategic outsourcing

  • Responsible disclosure builds trust and saves money

  • Internal and external marketing are crucial for buy-in

  • Documentation and metrics support long-term success

Keep Reading