A firm is considering two options for improving the security of its employee accounts from remote compromise. The firm calculates that the probability of compromise without enacting any additional security measures is 0.5, and that successful attacks cost the company $20K. Option 1 is to adopt a stricter password policy (e.g., a minimum of 8 characters, including at least one special character and upper-case letter). Option 2 would manually disable browser plug-ins from Adobe.

Option 1 is cheap, costing $500 initially and $1K annually due to added overhead from dealing with more password reset requests. It is not especially effective, reducing the probability of attack to 0.4. Option 2 is much more effective, reducing the probability of successful attack to 0.1. However, it imposes high indirect costs on workers, estimated at $5,000 initially due to training and $5,000 each year.
Include any R code used in the calculation as part of your homework.

a. Calculate ROSI for each method, based on the initial costs only. Based on this metric, which approach is preferred?

b. Calculate the NPV for each method assuming a 6% discount rate. Assume that any savings beyond eight years are ignored. Based on this metric, which approach is preferred?

c. Having calculated ROSI and NPV for both options, which option would you recommend investing in and why?

d. Plot the NPV for both methods as a function of the discount rate (for discount rates up to 60%). Include the code and a printout of the graph with your assignment. Your graph should look similar to this graph, which is calculated for the example from the lecture notes:Include your R code that created the graph.

e. Which option mitigates more risk? Which option accepts more risk, and how much risk is accepted annually by that option?