Computer security should be first and foremost which of the following: 

Answer options:

A. Cover all identified risks
B. Be cost-effective.
C. Be examined in both monetary and non-monetary terms.
D. Be proportionate to the value of IT systems.

B

Computer security should be first and foremost cost-effective. Asforanyorganization,there is a needtomeasuretheircost-effectiveness,tojustifybudgetusageandprovidesupportiveargumentsfortheirnext budgetclaim.Butorganizations often have difficulties to accurately measure the effectiveness and the cost oftheirinformationsecurityactivities. TheclassicalfinancialapproachforROIcalculationisnotparticularlyappropriatefor measuringsecurity-related initiatives:Security is notgenerallyan investment thatresults in a profit. Security is more about loss prevention. In other terms, when you invest in security, you dontexpectbenefits;youexpectto reducetherisksthreateningyourassets. The concept of theROIcalculationappliesto every investment. Security is no exception.Executive decision-makers want to know the impact securityis havingonthebottomline.Inordertoknowhowmuchtheyshouldspendon security, they need to knowhow much is the lack of security costing to the business and what are the most cost-effective solutions. Appliedtosecurity,aReturnOnSecurityInvestment(ROSI)calculationcanprovide quantitative answers to essential financial questions: Is an organization paying too much for its security? What financial impact on productivity could have lack of security? When is the security investment enough? Is this security product/organisation beneficial? The following are other concerns about computer security but not the first and foremost: The costs and benefits of security should be carefully examined in both monetary and non-monetary terms to ensure that the cost of controls does not exceed expected benefits. Security should be appropriate and proportionate to the value of and degree of reliance on the IT systems and to the severity, probability, and extent of potential harm. Requirements for security vary, depending upon the particular IT system. Therefore it does not make sense for computer security to cover all identified risks when the cost of the measures exceeds the value of the systems they are protecting. Reference(s) used for this question: SWANSON, Marianne & GUTTMAN, Barbara, National Institute of Standards and Technology (NIST), NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (page 6). and http://www.enisa.europa.eu/activities/cert/other-work/introduction-to-return-on-security-investment