tag:blogger.com,1999:blog-4088979.post4312102886088335072..comments2023-10-16T06:06:25.012-04:00Comments on TaoSecurity Blog: Justifying Digital Security via 10-K Risk FactorsRichard Bejtlichhttp://www.blogger.com/profile/13512184196416665417noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-4088979.post-23915001306513961672008-03-27T09:57:00.000-04:002008-03-27T09:57:00.000-04:00One of you posted the following: MARRIOTT INTERNAT...One of you posted the following: <A HREF="http://www.sec.gov/Archives/edgar/data/1048286/000119312508032582/d10k.htm#tx42955_3" REL="nofollow">MARRIOTT INTERNATIONAL, INC.</A>:<BR/><BR/><I>Technology, Information Protection, and Privacy Risks</I><BR/><BR/>That is great!Richard Bejtlichhttps://www.blogger.com/profile/13512184196416665417noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-87573018010168861282008-03-26T14:23:00.000-04:002008-03-26T14:23:00.000-04:00ntokb3, that is a good comment!ntokb3, that is a good comment!Richard Bejtlichhttps://www.blogger.com/profile/13512184196416665417noreply@blogger.comtag:blogger.com,1999:blog-4088979.post-22428416899983810982008-03-26T10:43:00.000-04:002008-03-26T10:43:00.000-04:00Richard,I think you may have missed one of the mos...Richard,<BR/><BR/>I think you may have missed one of the most important arguments for a digital security program. Risk #15 talks about "goodwill" which in the context of a 10K refers to the premium paid above book value (material assets value) for an acquisition. Included in goodwill is intellectual capital, reputation, etc. Its the reason that a consulting firm (for instance) is worth more than the value of its laptops.<BR/> In industry, its almost impossible to protect certain trade secrets legally. If Ball buys ABC Corp. and pays a 10 million when the value of the physical assets is only $1 million, then $9 million in goodwill is recorded as an asset, thus increasing Ball's value by $10 million. Now say that the secret to the cutting edge manufacturing process that came to Ball through the purchase is leaked to the public domain through a publicized breach. Well, assuming that a large part of the justification given to investors for buying ABC Corp was to acquire that intellectual capital, Ball may be required to write down (record as an expense)a potion of the goodwill paid for ABC Corp. This would have a negative material (financially significant)impact on the company's valuation (net earnings and net worth from #15)and therefore its stock price because it will then look like it overpaid for ABC Corp.<BR/>The payments made during mergers and acquisitions put a dollar value on the data assets and reputations that we protect. When presenting cases to management, information security practitioners need to be familiar enough with financial terms and accounting rules to justify their proposals in terms that management understands.Anonymousnoreply@blogger.com