<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG)</title>
	<atom:link href="http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/feed/" rel="self" type="application/rss+xml" />
	<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/</link>
	<description>The Blog Inspired By The Book</description>
	<lastBuildDate>Thu, 11 Mar 2010 18:24:24 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Incorporating &#8220;User Frustration&#8221; into Calculations of Return on Security Investment (ROSI) &#171; Trust Economics</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-272</link>
		<dc:creator>Incorporating &#8220;User Frustration&#8221; into Calculations of Return on Security Investment (ROSI) &#171; Trust Economics</dc:creator>
		<pubDate>Sat, 22 Aug 2009 16:46:44 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-272</guid>
		<description>[...] Return on Security Investment&#160;(ROSI) August 22, 2009 Posted by separkin in Blog.  trackback  A recent post by Alex Hutton on the New School of Information Security blog discusses the notion of &#8220;User [...]</description>
		<content:encoded><![CDATA[<p>[...] Return on Security Investment&nbsp;(ROSI) August 22, 2009 Posted by separkin in Blog.  trackback  A recent post by Alex Hutton on the New School of Information Security blog discusses the notion of &#8220;User [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chandler</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-247</link>
		<dc:creator>Chandler</dc:creator>
		<pubDate>Mon, 10 Aug 2009 13:56:37 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-247</guid>
		<description>I&#039;m definitely an example of the behavior that Alex refers to--I consider opening a ticket to the Helpless Desk to be the support of last resort, and usually only do so for hardware issues.

I spend a non-trivial amount of time most weeks dealing with broken apps--as a user, not as a risk &amp; security person--and from what I can tell, I&#039;m better at working around broken tools than most.</description>
		<content:encoded><![CDATA[<p>I&#8217;m definitely an example of the behavior that Alex refers to&#8211;I consider opening a ticket to the Helpless Desk to be the support of last resort, and usually only do so for hardware issues.</p>
<p>I spend a non-trivial amount of time most weeks dealing with broken apps&#8211;as a user, not as a risk &amp; security person&#8211;and from what I can tell, I&#8217;m better at working around broken tools than most.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Interesting Information Security Bits for 08/05/2009 &#124; Infosec Ramblings</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-243</link>
		<dc:creator>Interesting Information Security Bits for 08/05/2009 &#124; Infosec Ramblings</dc:creator>
		<pubDate>Wed, 05 Aug 2009 23:13:52 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-243</guid>
		<description>[...] avoidance based on UFH from an information security perspective definitely deserves some thought. Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG) &lt;&lt; The New Sch... Tags: ( general [...]</description>
		<content:encoded><![CDATA[<p>[...] avoidance based on UFH from an information security perspective definitely deserves some thought. Quantitative Analysis of Web Application Usefulness (Or Why Your ROSI is wRONG) &lt;&lt; The New Sch&#8230; Tags: ( general [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: alex</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-242</link>
		<dc:creator>alex</dc:creator>
		<pubDate>Wed, 05 Aug 2009 14:51:02 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-242</guid>
		<description>Chris,

I&#039;m trying to be minimalist here. Simplifying the development of IT Help Desks to only what is too important to jettison.  And that is &quot;how much do we suck&quot;?

In other words, while Verizon IT does a good job relative to the industry (*you* try serving 250k users), there&#039;s no way I&#039;m going to call the helpdesk and say &quot;Hey, my phone sucks&quot;.  Because they&#039;ll ask &quot;why&quot; and I&#039;ll tell them, and then we&#039;ll spend 3 hours figuring out that it&#039;s just a crappy phone that is operating to specifications.  Or my travel app?  It&#039;s probably operating to functional and technical requirements.  That doesn&#039;t mean it doesn&#039;t unnecessarily cost the company  money.

If you follow what I suggest, the user gets to hit an internal website and tell them that my phone sucked again today, or that it took me 30 minutes to enter in 4 receipts.  Not only is that &quot;easy&quot; but it&#039;s measuring something that I wouldn&#039;t normally call in about, and something that tangibly costs the company money.

Another example, if you have a Mac and have gone through the learning curve to learn Pages, you might feel, like me, that it&#039;s a much nicer application than other Mac Office Apps.  But I would never call into a help desk just to say &quot;Your standard build of Open Office crashed on me again today and wasted 20 minutes of my time&quot;.  The help desk would be like &quot;uh, thanks&quot;, or they would take 50 minutes of my life running through a script of &quot;fixes&quot; to my problem.

If you just measure UFH - you might see that while there are few HD calls, this application costs the average user 40 minutes a week in &quot;frustration&quot;.  If you want, you can multiply that by a standard &quot;average user cost per hour&quot; and # of users metric.</description>
		<content:encoded><![CDATA[<p>Chris,</p>
<p>I&#8217;m trying to be minimalist here. Simplifying the development of IT Help Desks to only what is too important to jettison.  And that is &#8220;how much do we suck&#8221;?</p>
<p>In other words, while Verizon IT does a good job relative to the industry (*you* try serving 250k users), there&#8217;s no way I&#8217;m going to call the helpdesk and say &#8220;Hey, my phone sucks&#8221;.  Because they&#8217;ll ask &#8220;why&#8221; and I&#8217;ll tell them, and then we&#8217;ll spend 3 hours figuring out that it&#8217;s just a crappy phone that is operating to specifications.  Or my travel app?  It&#8217;s probably operating to functional and technical requirements.  That doesn&#8217;t mean it doesn&#8217;t unnecessarily cost the company  money.</p>
<p>If you follow what I suggest, the user gets to hit an internal website and tell them that my phone sucked again today, or that it took me 30 minutes to enter in 4 receipts.  Not only is that &#8220;easy&#8221; but it&#8217;s measuring something that I wouldn&#8217;t normally call in about, and something that tangibly costs the company money.</p>
<p>Another example, if you have a Mac and have gone through the learning curve to learn Pages, you might feel, like me, that it&#8217;s a much nicer application than other Mac Office Apps.  But I would never call into a help desk just to say &#8220;Your standard build of Open Office crashed on me again today and wasted 20 minutes of my time&#8221;.  The help desk would be like &#8220;uh, thanks&#8221;, or they would take 50 minutes of my life running through a script of &#8220;fixes&#8221; to my problem.</p>
<p>If you just measure UFH &#8211; you might see that while there are few HD calls, this application costs the average user 40 minutes a week in &#8220;frustration&#8221;.  If you want, you can multiply that by a standard &#8220;average user cost per hour&#8221; and # of users metric.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Chris Walsh</title>
		<link>http://newschoolsecurity.com/2009/08/quantitative-analysis-of-web-application-usefulness-or-why-your-rosi-is-wrong/#comment-241</link>
		<dc:creator>Chris Walsh</dc:creator>
		<pubDate>Wed, 05 Aug 2009 14:27:44 +0000</pubDate>
		<guid isPermaLink="false">http://newschoolsecurity.com/?p=388#comment-241</guid>
		<description>Doesn&#039;t Verizon have an IT service desk?  Don&#039;t they track calls?  Looks to me like this frustration metric is a big part of (what should be...) relatively standard IT service management.

Maybe I drank too much ITIL Kool-Aid...</description>
		<content:encoded><![CDATA[<p>Doesn&#8217;t Verizon have an IT service desk?  Don&#8217;t they track calls?  Looks to me like this frustration metric is a big part of (what should be&#8230;) relatively standard IT service management.</p>
<p>Maybe I drank too much ITIL Kool-Aid&#8230;</p>
]]></content:encoded>
	</item>
</channel>
</rss>
