The IT Security Value Equation

How much is your IT security worth? No, seriously, have you actually given the question any long-trousered thought? I am not altogether surprised with this obsession in somehow ascribing a value to information security, be it as part of a large enterprise technology budget or simply a consumer wanting to get the best security solution for their buck. What does surprise me, though, is how quick people are to apply Heath-Robinson value equations to the data security problem. At one end of the scale I have known big business bean counter consultants to be brought in to perform a 'risk assessment' with regard to security spending and conclude that the cost of any data breach is likely to be less than the cost of the best practise security solution being proposed and therefore a waste of money. While at the other I've seen people who refuse to invest in the time to source and install security software because during some 10 years of being a computer user they "have never been infected, have no data of any worth to anyone else, ergo have no need for your so-called protection mate."