The Economics of Information Security Investment

Abstract:

Information security is a continuously changing discipline that requires continuous adaptation to new and ever-changing information security threats, countermeasures and the global business landscape. This calls for decision makers to become vigilant in their spending and move towards an optimised information security investment. This paper gives a brief overview on the economics of information security and discusses related work on information security investment. The main aim of this paper is to provide decision makers with a set of requirements to be considered when implementing a cost-effective and optimal information security budget; in a manner that preserve organisations’ information security posture and compliance status.

• Periodical: Advanced Materials Research (Volumes 219-220)
• Pages: 1550-1553
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.219-220.1550
• Online since: March 2011
• Authors: Heng Wang
• Keywords: Information Security, Information Security Budget, Information Security Economics, Information Security Investment

References

[1] B.Kiviat, How to Fix the Housing Market, Times Magazine (2009). Available on: http://www.time.com/time/magazine/article/0,9171,1879184-2,00.html.

[2] Research and markets，IT Security Market Report 2007 （2007）, UK. Available on: http://www.bharatbook.com/productdetail.asp?id=11035.

[3] Symantec, Symantec Report on the Underground Economy (2008), Whitepaper. Available on: eval.symantec.com/mktginfo/enterprise/white_papers/bwhitepaper_ underground_economy_report_11-2008-14525717.

[4] R. Anderson and T. Moore, The Economics of Information Security, Science 314(5799), (2006) pp.610-613.

DOI: 10.1126/science.1130992

[5] C. Ioannidis, D. Pym, and J. Williams, Investments trade-offs in the Economics of Information Security, the thirteenth Proceedings of the conference of Financial Cryptography and Data Security, Barbados, USA. (2009).

DOI: 10.1007/978-3-642-03549-4_9

[6] G. Chapman, Cybercrime losses top $US1 trillion (2009). Available on: http://www.australianit.news.com.au/story/0,24897,24997483- 24169,00.html.

[7] E.Goetz, and M.E. Johnson, Embedding Information Security Risk Management into the Extended Enterprise: An Executive Workshop (2006), MacNamee Center for Digital Strategies, Tuck School of Business at Dartmouth University, USA.

[8] R. Anderson, Why Information Security is Hard-An Economic Perspective, the 17th Annual Computer Security Applications Conference, New Orleans, Louisiana, USA. (2001).

DOI: 10.1109/acsac.2001.991552

[9] C.D. Huang, Q. Hu, and R.S. Behara, Economics of Information Security Investment in the Case of Simultaneous Attacks, The Fifth Workshop on the Economics of Information Security, Robinson College, University of Cambridge, England. (2006).

[10] Z.Wang, and H.Song, Towards an optimal information security investment strategy, IEEE Conference on Networking, Sensing and Control, (2008) pp.756-761.

DOI: 10.1109/icnsc.2008.4525317

[11] B.Srinidhi, J.Yan, and G.K. Tayi, Firm-level Resource Allocation to Information Security in the Presence of Financial Distress, Working paper Series 2008-17, School of Economic Sciences, Washington State University, USA. (2008).

[12] J. Willemson, On the Gordon and Loeb Model for Information Security Investment, presented at The Fifth Workshop on the Economics of Information Security, University of Cambridge, UK. (2006).

[13] M.T. Dlamini, M.M. Eloff, J.H.P. Eloff and K.Hone, BC3I-Towards Requirements Specification For Preparing an Information Security Budget, Proceedings of the ISSA 2009 Conference, Johannesburg, South Africa, (2009).

[14] A.Rolfsdotter Karlsson, Managing Performance Measurement: A study of how to select and implement performance measures on a strategic, tactical and operational level, Master's Thesis, University of Gävle, Sweden. (2008).

[15] S.A. Butler, Security Attribute Evaluation Method, PhD Thesis, School of Computer Science, Carnegie Mellon University, Pittsburgh, PA 15213, USA. (2003).