Using CBA and risk assessment, I was able to answer the question:
Is there an optimal level of security investment for small businesses to protect themselves from cyber-threats?
As it turns out, the solution lies in identifying, and then mitigating, the risk-level of the business. I was able to create five questions, when answered, would allow a small business owner to determine which solutions work best for him. Then using those solutions, I can estimate monthly expenses that allow the benefits of protection to be equal to (or less than) the cost to maintain the solution.
The post has been published at lguelch.blogspot.com. The Excel spreadsheet used to define risk levels and compute the cost-benefit analysis can be accessed from: leslie.guelcher/files/cost_benefit_template.xlsx.
Feel free to post any questions or comments about the template or conclusions here or at lguelch.