Re: Worms, Air Gaps and Responsibility

["Paul D. Robertson" <paul () compuwar net>]

On Fri, 7 May 2004, Devdas Bhagat wrote:

> Which brings up the original question, how do you educate this type of
> management?

Risk analysis, event analysis, cost analysis, regulatory stuff, competitor
stuff...

> > [snip]
> > > Note that having one cheap administrator dedicated to cleaning up viruses
> > > often works out cheaper than having an antivirus everywhere and kept up
> > > to date.
> > [snip]
> >
> > My work domain isn't all that big, but even *I* can't agree with that.
> Said company currently spends about 800 USD to 1000 USD on maintaining a
> team of 5 people in three round the clock shifts for running a 400+ node
> Windows LAN. Dedicating /one/ of these administrators to cleaning up
> viruses is cheaper than having antivirus everywhere.

800 to 1000 per what?

> Flip the people/system costs and you will see what I mean. Bodies are
> cheap, systems are not.

Bodies are salary + 50% for benefits, etc.  AV can't be more than what,
$60/node/year (Really, it's less than half that, but at retail box,
single copy prices, we'll use that number.)

That's $2400/year for licenses, add in $1200 for a gateway, and another
$1000 for 400 mailboxes of gateway AV- we've got $4600/year for 400 nodes
of protection, desktop and main e-mail gateway.  If you're getting someone
who's competent enough to clean out tricky viral programs for a
loaded cost of $4600/year (so, ~75% of that,) then you're in a unique
spot.  If that single person can keep up with the infection rates when you
get a mass infection, they're not likely to be around for long.

I think you could get that cost down to ~$2200 a year, now that admittedly
doesn't cover labor for gateway upgrades, and whatever care and feeding is
necessary, but with auto-updates, that's enough pretty good protection
for most places.  Now, take the average number of infections/year and the
cost of those infections in productivity, IT staff who could have been
doing things to further the business, lost files, etc. and I'd be amazed
if you couldn't cover the delta quite easily.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
paul () compuwar net       which may have no basis whatsoever in fact."
probertson () trusecure com Director of Risk Assessment TruSecure Corporation
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards