I confess that I think "brand value" is about the most over-used, least understood notion in the security profession. We often use it as a catch-all for the ambiguity we perceive in calculating losses. Our reasoning usually involves being on the "front page of the Wall Street Journal." But that isn't enough to affect brand, is it?

Negative coverage on the front page of the Wall Street Journal is more likely a vehicle for embarrassment than it is brand devaluation. One of the easy ways to tell whether we are misinterpreting brand value is if we are really focused on phone calls from senior executives rather than impact to income statement.

Brand value can be measured – in fact, it IS measured by a company called Interbrands. It is properly understood as a measure of an organization's long-term viability that drives future revenue. This value also happens to be reflected in the market capitalization of an organization (along with other more tangible factors).

We can and should get better about clarifying what it means to lose brand value. It is too often used as a kind of scapegoat when discussing the significance of information security