Wednesday 31 January 2018

RE: The Security Function

For some context read this article

My brother wrote in August 2017 about how a One Plus 3T got stolen from his office and derived an equation that justified whether securing an object was worth the effort. I've been meaning to give a response for quite sometime now, a day before my exam seems like the best time to do it :P

Now, I disagree with his equation at multiple places but first I'll put this statement forth, "Security is justified only if it creates value", it seems pretty obvious, but a problem arises when you try to quantify what one means by "creating value". We obviously have costs associated with the purchase of the product and the security, but we also have implicit ‘costs’, those being the value produced by the object and the value missed by having the product stolen you from you prematurely. Using this as a basis I derived a new equation.

 (Securing Justified) = 
 Value(precious_object) 
 - Price(things_bought_to_keep_it_safe)
+ Value(value_by_object)  
 - [ Value (daily_time_spent_to_keep_it_safe) x
(days_used) ] 


The justified value then remains the same, i.e.:

If (Securing Justified) >> 0 then securing the object is definitely worth the time and effort

If (Securing Justified) ~ 0 Maybe worth the effort? Depends on how optimistic/pessimistic you are.

If (Securing Justified) < 0 Forget it, let it be. You might as well ask someone to steal it from you.

Now to define the terms:

Value(precious_object):  This is distinctly different from the equation offered in the article because here I simply consider the value of the object left, meaning that since every object has a limited life span you should only consider the value left of the object either through depreciation or more simply a linear curve till when you expect the object to go kaput, when the value goes to 0. As an analogy would you spend more on securing a packet of biscuits or one biscuit.
Mathematically –
Value(precious object) = Price(product) - [Price(product)/lifetime]*(Time till stolen)
Price(things_bought_to_keep_it_safe): This remains the same as what my brother gave. “This could be a lockable drawer, a lock and key, maybe even the initial charge of finding a security guard to protect the valuable.   
Value(value_by_object): Here is an important variable he didn’t consider, each object you own creates value (or so I hope) and that’s why you own it. The cycle made the commute time shorter and saves you money you otherwise would’ve spent on a cab ride.  Or in the case of the mobile how it would benefit the company by the software developed using the mobile; though a bit less tangible, it is easy to calculate in retrospect. Let’s just assume we know it ex ante.

The next variable remains the same, that being:
Value (daily time spent to perform security operation): Convert the amount of time you spend on locking into a more measurable form like money. If you charge $30 per hour of work, locking might be worth a minute's value a day = $0.50. This could also be the running expense of daily wage of the security guard.

Days_used:  Days till theft could also be interpreted as days of useful life, whichever comes first will be take as the value of the variable. To maintain consistency with my brother’s article I shall assume it to be T/2.

Another variable that might be worth considering is the cost of the replacement but I don’t see how we could place that in the equation, if you do please do help me out.

To the examples!

Days used = I'll be using this bicycle for 3 years, so let's say it gets stolen after 1.5 years.
Value (Bicycle) = Rs 21,000 – {[21,000/(3*365)] *( Days_Used)}
Price(Bicycle) = Rs 21,000
Useful life ~       3 Years
Hence, Value left with bike = 21,000 – (21,000/(3*365)) *(365*3/2)
                                        = 10,500
Price(Things bought to keep it safe) = Rs 1,000
Value(Value_by_Object) = ((20 mins/day)*(Daily wage) + Money_saved_on_commute)*(Days_Usage_left)
          Rs. [(10 + 30)/day] * (3*365/2) = Rs 21,900
Value(daily time spent to keep it safe) = 2 minutes (to lock and unlock) = Rs 1 [Indians work at $30 a day]


 Security Justified = 10,500 - 1,000 + 21,900  - 1 * 548 = 31,752.

You SHOULD lock it.

Price(OnePlus3T) = Rs 30,000

Price(Things bought to keep it safe) = Rs 1,000

Value(daily time spent to keep it safe) = Rs 500 [Security guard paid that much per day] {Assuming that’s all he was protecting}
# days from purchase till theft = We assumed we'll use the phone for 2-3 years, but we lost it 3 months from purchase.
Value(Value_by_object) ~ It’s safe to assume that if a company has invested 30,000 on a device, it expects at least twice the return.
Hence Value(Value_by_object) = 60,000(3*365 – 90)/(3*365) = 55068.49
 Security Justified = 30,000 - 1,000 - 500 * 90 + 60,000 = 39068.49.

I’d say that the effort put into security is justified.

I'm dead tired right now, I'll write a post script later. Later. 


PS. Formatting is screwing me over. I'll look into it later. Later. 




No comments:

Post a Comment