The economics of information security investment
Top Cited Papers
- 1 November 2002
- journal article
- Published by Association for Computing Machinery (ACM) in ACM Transactions on Information and System Security
- Vol. 5 (4) , 438-457
- https://doi.org/10.1145/581271.581274
Abstract
This article presents an economic model that determines the optimal amount to invest to protect a given set of information. The model takes into account the vulnerability of the information to a security breach and the potential loss should such a breach occur. It is shown that for a given potential loss, a firm should not necessarily focus its investments on information sets with the highest vulnerability. Since extremely vulnerable information sets may be inordinately expensive to protect, a firm may be better off concentrating its efforts on information sets with midrange vulnerabilities. The analysis further suggests that to maximize the expected benefit from investment to protect information, a firm should spend only a small fraction of the expected loss due to a security breach.Keywords
This publication has 20 references indexed in Scilit:
- The base-rate fallacy and the difficulty of intrusion detectionACM Transactions on Information and System Security, 2000
- Configuring role-based access control to enforce mandatory and discretionary access control policiesACM Transactions on Information and System Security, 2000
- Balancing cooperation and risk in intrusion detectionACM Transactions on Information and System Security, 2000
- The ARBAC97 model for role-based administration of rolesACM Transactions on Information and System Security, 1999
- A conceptual framework for information security managementComputers & Security, 1998
- Coping with Systems Risk: Security Planning Models for Management Decision MakingMIS Quarterly, 1998
- A taxonomy for key escrow encryption systemsCommunications of the ACM, 1996
- Role-based access control modelsComputer, 1996
- Cryptanalysis and protocol failuresCommunications of the ACM, 1994
- Threats to Information Systems: Today's Reality, Yesterday's UnderstandingMIS Quarterly, 1992