It is a fairly common refrain in information security to suggest that we are "protecting the brand" when asked what value we return to an enterprise. In most cases, I am skeptical, primarily because it is such a vague and ambiguous notion. And secondarily, because I think it is b.s. We operate in a much more specific space, one usually consumed by viruses, worms, spam and other malware that require janitors to clean up.

Of course, there are those cases when brand DOES matter. Here are a few of those circumstances:

1. When someone other than the security pro says that security "protects the brand."
2. When the brand is recognizable to its customers.
3. When the compromise of the brand has a direct impact on revenue, as in the case of ecommerce companies.
4. When there are many similar alternatives, i.e. the differentiation is minimal and competition is heavy.
5. When the CISO holds a senior organizational position within the organization.

Another way to illustrate the question and challenge of brand value is to go through the thought exercise of trying to name the last half-dozen or so public compromises. It can be a very difficult task.

Lately, there have been compromises against Wells Fargo, T-Mobile, the FBI, and SAIC, as well as a number of others. So in order to be protecting the brand, these compromises should have affected brand value. I tend to believe the degradation of brand value is probably short-lived at best and perhaps non-existent.

One other way to tell whether brand matters: If you are at a company where brand really does matter – say at one of the "Top 100 brand" companies that BusinessWeek identifies each year – you just know it. Justification is not required. (Alternatively, if you find yourself screaming to anyone who will listen how important brand is and feel like it falls upon deaf ears, you are the wrong person to be doing that job, and brand doesn’t matter to that organization).