Chapter 41 — Information security: system optimization
Lesson map
Lesson 41 published. Map, example, EX121.
flowchart TD
N0["Learning outcomes"]
N1["41.1 Finding waste"]
N2["41.2 Consolidation"]
N3["41.3 Risk per pound"]
N4["41.4 Measuring after change"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX121"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["41.1 Finding waste"]
N2["41.2 Consolidation"]
N3["41.3 Risk per pound"]
N4["41.4 Measuring after change"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX121"]
[Learning outcomes]
|
v
[41.1 Finding waste]
|
v
[41.2 Consolidation]
|
v
[41.3 Risk per pound]
|
v
[41.4 Measuring after change]
|
v
[Worked example] --> [Exercise EX121]
Learning outcomes
You will (1) reduce security cost without reducing protection; (2) remove redundant controls; (3) prioritise investment by risk reduction.
41.1 Finding waste
In her final year, Lindiwe reviews Saltmarsh's security spending and effort. She finds overlapping tools: two products scanning laptops for vulnerabilities and three separate places where account lists are maintained by hand. Each overlap costs licences and staff time, and inconsistent lists create gaps. Prof. Hale asks her to show which controls each tool supports before recommending removal, because a tool that looks redundant may cover a case the other misses. She lists every security tool with its licence cost, owner and the controls it supports in one shared table.
41.2 Consolidation
Lindiwe maps both laptop scanners against the assets they cover. One covers all laptops including warehouse terminals; the other misses terminals but offers reports managers like. She recommends keeping the first and recreating the useful reports from its data. For account lists, she proposes generating all three from the single identity source set up earlier. The changes save licence costs and remove manual updates that had caused errors in past access reviews. The security lead approves both changes, and the licence for the second scanner is not renewed.
41.3 Risk per pound
Lindiwe ranks proposed investments by estimated risk reduction per unit of cost. Immutable backups and multi-factor authentication for remaining supplier accounts rank highest, because they address the most damaging threats cheaply. A proposed advanced analytics product ranks low, since Saltmarsh's current detection gaps are basic. She notes that her estimates are rough, but ranking them openly makes assumptions visible and helps managers question them rather than accept vendor claims. She presents the ranking to the finance director with the assumptions listed beside each estimate, inviting challenge.
41.4 Measuring after change
After consolidation, Lindiwe checks that nothing was lost: the remaining scanner still covers every asset in the reconciled model, and access reviews based on the single identity source find no missing accounts. She records these checks as evidence. Prof. Hale notes that optimisation must prove protection was preserved, otherwise savings may simply move cost into a future incident. She repeats the coverage check one month later and again finds every asset covered. The finance director receives a short note confirming that the savings did not reduce protection, with the evidence attached for audit.
Worked example
Lindiwe removes a redundant laptop scanner after checking coverage, generates account lists from one source, ranks investments by risk reduction per cost and verifies coverage after changes.
Synthetic case. Costs and tools are synthetic.
Errors and limits
Removing a tool without checking coverage can open unnoticed gaps.
Exercises
- EX121 — Kept scanner. Which laptop scanner is kept? Rubric: 3 = the one covering warehouse terminals;; 2 = partly correct;; 1 = other;; 0 = none.
- EX122 — Account lists. How are the three account lists produced after change? Rubric: 3 = from the single identity source;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX123 — Low-ranked purchase. Which investment ranks low? Rubric: 3 = an advanced analytics product;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 41 (chapter 41 of 50)
← Chapter 40 · Course chapter index · Chapter 42 →
Continue to the next authored lesson.