(a) Why is it a problem if benefits and costs both occur over several years?
(b) Why should the total cost of an incident (TCI) be used in place of exposure factors and asset values?
(c) Why is it not possible to use classic risk analysis calculations for firewalls?
(d) What is the worst problem with the classic approach?
(e) Why is hard-headed thinking about security ROI dangerous?