On Tue, 29 Jul 2003 10:52:19 EDT, Jason <[EMAIL PROTECTED]> said: > $15,600 * 83 = $1.3 million in lost time patching > > Compared to the very conservative 4 million lost otherwise? > > Add another million to the 1.3 mil to hire contractors and you still > save almost 2 million.
$1.3M to patch MS03-023. $1.3M to patch MS03-026. $1.3M to patch MS03-030. Now you're up to $3.9M, and only saving $100K. *MAYBE*. And if there's another advisory, there goes another $1.3M. If there's 4 advisories a year, it actually makes financial *SENSE* to just say "screw it" and accept the fact that there will be a yearly worm-and-patch-everything party. Maybe there's a *REASON* that IT security is underfunded - the cost/benefit doesn't work out for the business....
pgp00000.pgp
Description: PGP signature
