A Spherical Horse in a Vacuum
That’s the punchline to an old physics joke about horse racing – it reflects the often-times unrealistic expectations we make when creating academic models for real-world performance.
I got thinking about this after Ken emailed me about his blog post after reading my previous post on ROI. I think that his post definitely ends the ROI debate with some very smart (and diplomatic) comments from Larry Gordon.
More importantly, I spent some time with the Gordon-Loeb model for cyber-security investment after reading Ken’s post, and it reminded me of the afforementioned joke. While it’s an interesting paper from the perspective of provoking thought, I think there’s a lot more to security investment than the model suggests. For example:
“The parameter λ represents the monetary loss to the firm caused by a breach of security of the information set…. Even though we initially assume that this loss is a fixed value, we will investigate how changes in the value of the