The Total Economic Impact of Network Security Intrusion Prevention

In May 2009, McAfee, Inc., commissioned Forrester Research to examine the financial impact and potential return on investment (ROI) that an organization might realize from implementing McAfee's Network Security Platform's Intrusion Prevention System (formerly known as IntruShield) including its Network Security Central Manager. To determine the impact, Forrester examined the specific costs, benefits, flexibility, and risk elements that a McAfee customer, Adena Health System, experienced when it implemented the McAfee Network Security Platform. Adena Health System is an independent, not-for-profit, and locally controlled organization, serving the needs of 10 counties in south central Ohio and employing more than 2,000 people. Adena's vision is to be the best healthcare system in the nation through innovation and a customer-centered philosophy. The company's IT group is responsible for providing 99.99% uptime on all pieces of equipment for Adena's health system including 200 servers, 2,000 workstations, public and private wireless access points, as well as machines that run highly specialized medical applications for surgical and other procedures. From interviews conducted by Forrester, it was determined that Adena's use of McAfee's Network Security Platform's Intrusion Prevention System identified and blocked numerous major and minor threats, such as address resolution protocol (ARP) spoofing, malware, denial-of-service attacks, phishing, and peer-to-peer file sharing. The proactive nature of this attack blocking protected Adena's network with the additional benefit of allowing Adena to reclaim precious network bandwidth. Based on our interviews, Forrester projects a three-year, risk-adjusted total net present value (NPV) of $348,617, representing the net costs and benefits attributed to using the McAfee Network Security Platform's Intrusion Prevention System versus Adena Health's previous security solutions. (See details below in Costs, Benefits, Flexibility, and Risks sections). In addition, the risk-adjusted ROI was a very favorable 142%, and the payback period was within five months. Purpose The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of implementing the McAfee Network Security Platform. Forrester's aim is to show the calculations and assumptions that go into the analysis. This study should be seen as a guide to better understand and evaluate the McAfee Network Security Platform. Methodology McAfee selected Forrester for this project because of our expertise in network security and Forrester's Total Economic ImpactT (TEIT) analysis methodology. TEI not only measures costs and benefits (areas that are typically accounted for within IT) but also weighs the enabling value of a technology in increasing the effectiveness of overall business processes. Forrester's TEI methodology serves an extremely useful purpose by providing a complete picture of the total economic impact of purchase decisions (see Appendix A for additional information on the TEI methodology).