[cap-talk] Decisions about risk

[David Hopwood]

David Hopwood wrote:
> Jonathan S. Shapiro wrote:
> 
>>This type of problem is why the notion of TCO (Total Cost of Ownership)
>>was introduced. We need to introduce a similar concept.
>>
>>And because of the arbitrage factor, we *may* find that the TCO of the
>>administrator install actually *is* cheaper on average -- simply because
>>many vulnerable machines will not get hit. Maybe talk about TCS (Total
>>Cost of Security) vs. TCO.
> 
> This argument might have been used to justify continued use ..., when the
> proportion of ... was less than a ... Currently, the proportion
> of Windows PCs with malware installed is just over 60%, if you believe the ...
> (it isn't entirely clear what constitutes "malware" here, but this survey
> is by Microsoft, who have no incentive to exaggerate the problem).

Oops, that paragraph got out before it was finished. It should say:

This argument might have been used to justify continued use of Windows,
for example, when the proportion of PCs infected with malware was much
lower a few years ago. Currently, the proportion of Windows PCs with
a "backdoor Trojan" installed is just over 60%, if you believe the survey
(by Microsoft, who have no incentive to exaggerate the problem) at:

http://download.microsoft.com/download/3/d/e/3de2470b-ab9a-4a7f-b760-ee2421df294a/WindowsRemovalToolWP.doc

(This survey was widely reported in the technical press, e.g. at
<http://blog.washingtonpost.com/securityfix/2006/06/microsoft_releases_malware_sta.html>,
if you don't feel like executing some random Word document.)

-- 
David Hopwood <david.nospam.hopwood at blueyonder.co.uk>