The cost of getting it wrong
Jan 23rd, 2022 by Jesper Kråkhede
In my previous post I wrote about verifying both the user and the device. This one is about money, more specifically what it costs when we get access wrong.
Getting it wrong can happen in two directions. Too open, and an attacker walks in with a stolen password. Too closed, and the business can´t work, people find workarounds and the security team becomes the department of no.
The first one is the one that makes the news. A single account takeover can lead to ransomware, stolen data, fines and weeks of downtime. In the incidents I have worked on, the cost often reaches a large share of the yearly IT budget, sometimes more.
The second one is quieter but costs money every day. Lost productivity, frustrated users, shadow IT and security rules that everyone tries to get around.
What I like about verifying both user and device is that it reduces both costs at once. Users on a healthy, managed device get a smooth experience with fewer prompts. Everybody else gets checked harder. Security goes up where the risk is and friction goes down where it isn´t.
So for management: When you evaluate security investments, ask both questions. How much risk does it remove, and how much friction does it add?
Good security is invisible to the right people.