Assume we don't protect the data at all, and one laptop is lost every 10 years, so the probability of one loss in one particular year is about one-tenth. The risk: $200,000. In other words, without using disk encryption or some other protection, you can expect data loss to cost about $200,000 a year on average.

Now, let's assume you did use encryption. We start with the same assumptions, and guess that one time out of a hundred a laptop is lost to a skillful thief; instead of taking the laptop to a pawnshop in the seedy part of town, the thief is actually going to try to extract data from it. Let's say further that about half the time the computer is actually stolen with the power on, because for convenience it was simply put into sleep mode. So now, about one time in 200, our skillful thief gets a computer full of recoverable data. The probability of loss is now one two-hundredth of one-tenth, or about 0.0005, and the risk is now about $100 per year. So the answer to the CEO's question is this: With disk encryption we can expect data losses to cost us around $100 a year on average; without it, we can expect data loss to cost $200,000 a year, again on average.

Of course, the easiest protection is to use a disk-encryption program and simply make sure you turn the laptop off when you're not using it; then this technique won't work at all, because there won't be any recoverable keys left in memory.

This technique of risk analysis can be applied to almost any decision about any security measure: It's worthwhile only if it costs less than the reduction in your expected loss per year. For example, there are a number of special disks available now that have specialized on-disk encryption hardware. How much of a premium is it worth to buy one of these disks, compared to using encryption software? Simply extend the reasoning: If the special hardware makes it 100 times harder to get data off the disk, the expected loss per year is around $1. If the special hardware costs significantly more than $199, it doesn't actually pay off.

So the next time the CEO asks you one of these questions, you can make a back-of-the-envelope estimate in just a few seconds' thought. Won't that make you look good?

Charlie Martin is a Colorado-based security architect, researcher and consultant, currently working on key management for a major computer manufacturer.