<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG)</title>
	<atom:link href="http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/feed/" rel="self" type="application/rss+xml" />
	<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/</link>
	<description>The Blog Inspired By The Book</description>
	<lastBuildDate>Wed, 08 Feb 2012 09:21:02 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: Kevin</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-9493</link>
		<dc:creator>Kevin</dc:creator>
		<pubDate>Fri, 23 Sep 2011 13:56:28 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-9493</guid>
		<description>This seems like a good approach to prioritising issues that need a fix- however I would be wary of trusting too much the figures users give for the amount of time they have lost.  These could be swayed dramatically by a particuarly demanding user.

@Chandler, I agree - in many cases it is quicker to find a fix yourself if you are familar with the software.  When you compare the time this can take with to that needed to document the issue and explain exacty how the program should function it seems the &quot;quicker&quot; option. However this could result in a large number of users still experiencing problems which they don&#039;t know how to fix.</description>
		<content:encoded><![CDATA[<p>This seems like a good approach to prioritising issues that need a fix- however I would be wary of trusting too much the figures users give for the amount of time they have lost.  These could be swayed dramatically by a particuarly demanding user.</p>
<p>@Chandler, I agree &#8211; in many cases it is quicker to find a fix yourself if you are familar with the software.  When you compare the time this can take with to that needed to document the issue and explain exacty how the program should function it seems the &#8220;quicker&#8221; option. However this could result in a large number of users still experiencing problems which they don&#8217;t know how to fix.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Incorporating &#8220;User Frustration&#8221; into Calculations of Return on Security Investment (ROSI) &#171; Trust Economics</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-272</link>
		<dc:creator>Incorporating &#8220;User Frustration&#8221; into Calculations of Return on Security Investment (ROSI) &#171; Trust Economics</dc:creator>
		<pubDate>Sat, 22 Aug 2009 16:46:44 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-272</guid>
		<description>[...] Return on Security Investment&#160;(ROSI) August 22, 2009 Posted by separkin in Blog.  trackback  A recent post by Alex Hutton on the New School of Information Security blog discusses the notion of &#8220;User [...]</description>
		<content:encoded><![CDATA[<p>[...] Return on Security Investment&nbsp;(ROSI) August 22, 2009 Posted by separkin in Blog.  trackback  A recent post by Alex Hutton on the New School of Information Security blog discusses the notion of &#8220;User [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chandler</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-247</link>
		<dc:creator>Chandler</dc:creator>
		<pubDate>Mon, 10 Aug 2009 13:56:37 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-247</guid>
		<description>I&#039;m definitely an example of the behavior that Alex refers to--I consider opening a ticket to the Helpless Desk to be the support of last resort, and usually only do so for hardware issues.

I spend a non-trivial amount of time most weeks dealing with broken apps--as a user, not as a risk &amp; security person--and from what I can tell, I&#039;m better at working around broken tools than most.</description>
		<content:encoded><![CDATA[<p>I&#8217;m definitely an example of the behavior that Alex refers to&#8211;I consider opening a ticket to the Helpless Desk to be the support of last resort, and usually only do so for hardware issues.</p>
<p>I spend a non-trivial amount of time most weeks dealing with broken apps&#8211;as a user, not as a risk &amp; security person&#8211;and from what I can tell, I&#8217;m better at working around broken tools than most.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Interesting Information Security Bits for 08/05/2009 &#124; Infosec Ramblings</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-243</link>
		<dc:creator>Interesting Information Security Bits for 08/05/2009 &#124; Infosec Ramblings</dc:creator>
		<pubDate>Wed, 05 Aug 2009 23:13:52 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-243</guid>
		<description>[...] avoidance based on UFH from an information security perspective definitely deserves some thought. Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG) &lt;&lt; The New Sch... Tags: ( general [...]</description>
		<content:encoded><![CDATA[<p>[...] avoidance based on UFH from an information security perspective definitely deserves some thought. Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG) &lt;&lt; The New Sch&#8230; Tags: ( general [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: alex</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-242</link>
		<dc:creator>alex</dc:creator>
		<pubDate>Wed, 05 Aug 2009 14:51:02 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-242</guid>
		<description>Chris,

I&#039;m trying to be minimalist here. Simplifying the development of IT Help Desks to only what is too important to jettison.  And that is &quot;how much do we suck&quot;?

In other words, while Verizon IT does a good job relative to the industry (*you* try serving 250k users), there&#039;s no way I&#039;m going to call the helpdesk and say &quot;Hey, my phone sucks&quot;.  Because they&#039;ll ask &quot;why&quot; and I&#039;ll tell them, and then we&#039;ll spend 3 hours figuring out that it&#039;s just a crappy phone that is operating to specifications.  Or my travel app?  It&#039;s probably operating to functional and technical requirements.  That doesn&#039;t mean it doesn&#039;t unnecessarily cost the company  money.

If you follow what I suggest, the user gets to hit an internal website and tell them that my phone sucked again today, or that it took me 30 minutes to enter in 4 receipts.  Not only is that &quot;easy&quot; but it&#039;s measuring something that I wouldn&#039;t normally call in about, and something that tangibly costs the company money.

Another example, if you have a Mac and have gone through the learning curve to learn Pages, you might feel, like me, that it&#039;s a much nicer application than other Mac Office Apps.  But I would never call into a help desk just to say &quot;Your standard build of Open Office crashed on me again today and wasted 20 minutes of my time&quot;.  The help desk would be like &quot;uh, thanks&quot;, or they would take 50 minutes of my life running through a script of &quot;fixes&quot; to my problem.

If you just measure UFH - you might see that while there are few HD calls, this application costs the average user 40 minutes a week in &quot;frustration&quot;.  If you want, you can multiply that by a standard &quot;average user cost per hour&quot; and # of users metric.</description>
		<content:encoded><![CDATA[<p>Chris,</p>
<p>I&#8217;m trying to be minimalist here. Simplifying the development of IT Help Desks to only what is too important to jettison.  And that is &#8220;how much do we suck&#8221;?</p>
<p>In other words, while Verizon IT does a good job relative to the industry (*you* try serving 250k users), there&#8217;s no way I&#8217;m going to call the helpdesk and say &#8220;Hey, my phone sucks&#8221;.  Because they&#8217;ll ask &#8220;why&#8221; and I&#8217;ll tell them, and then we&#8217;ll spend 3 hours figuring out that it&#8217;s just a crappy phone that is operating to specifications.  Or my travel app?  It&#8217;s probably operating to functional and technical requirements.  That doesn&#8217;t mean it doesn&#8217;t unnecessarily cost the company  money.</p>
<p>If you follow what I suggest, the user gets to hit an internal website and tell them that my phone sucked again today, or that it took me 30 minutes to enter in 4 receipts.  Not only is that &#8220;easy&#8221; but it&#8217;s measuring something that I wouldn&#8217;t normally call in about, and something that tangibly costs the company money.</p>
<p>Another example, if you have a Mac and have gone through the learning curve to learn Pages, you might feel, like me, that it&#8217;s a much nicer application than other Mac Office Apps.  But I would never call into a help desk just to say &#8220;Your standard build of Open Office crashed on me again today and wasted 20 minutes of my time&#8221;.  The help desk would be like &#8220;uh, thanks&#8221;, or they would take 50 minutes of my life running through a script of &#8220;fixes&#8221; to my problem.</p>
<p>If you just measure UFH &#8211; you might see that while there are few HD calls, this application costs the average user 40 minutes a week in &#8220;frustration&#8221;.  If you want, you can multiply that by a standard &#8220;average user cost per hour&#8221; and # of users metric.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chris Walsh</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-241</link>
		<dc:creator>Chris Walsh</dc:creator>
		<pubDate>Wed, 05 Aug 2009 14:27:44 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-241</guid>
		<description>Doesn&#039;t Verizon have an IT service desk?  Don&#039;t they track calls?  Looks to me like this frustration metric is a big part of (what should be...) relatively standard IT service management.

Maybe I drank too much ITIL Kool-Aid...</description>
		<content:encoded><![CDATA[<p>Doesn&#8217;t Verizon have an IT service desk?  Don&#8217;t they track calls?  Looks to me like this frustration metric is a big part of (what should be&#8230;) relatively standard IT service management.</p>
<p>Maybe I drank too much ITIL Kool-Aid&#8230;</p>
]]></content:encoded>
	</item>
</channel>
</rss>

