Analyzing the Risks of Information Security Investments with Monte-Carlo Simulations

— This report describes the process and benefits of a Monte-Carlo approach for analyzing uncertainty in an information security investment. The Monte-Carlo approach captures uncertainty in security modeling parameters (vulnerabilities, frequency of intrusion, damage estimates, etc) and expresses its impact on the model's forecast (e.g. projected benefit). The forecast is presented as a chart understandable by controllers and middle-level managers responsible for resource allocation decisions. This approach is especially valuable for visualizing a potentially large return on an investment that defends against an unlikely but catastrophic attack.