The economics of information security investment

ABSTRACT

This article presents an economic model that determines the optimal amount to invest to protect a given set of information. The model takes into account the vulnerability of the information to a security breach and the potential loss should such a breach occur. It is shown that for a given potential loss, a firm should not necessarily focus its investments on information sets with the highest vulnerability. Since extremely vulnerable information sets may be inordinately expensive to protect, a firm may be better off concentrating its efforts on information sets with midrange vulnerabilities. The analysis further suggests that to maximize the expected benefit from investment to protect information, a firm should spend only a small fraction of the expected loss due to a security breach.

REFERENCES

• 1: Anderson, J. 1972. Computer security technology planning study. U.S. Air Force Electronic Systems Division Tech. Rep. (Oct.), 73--51.
• 2: R. Anderson, Why Information Security is Hard-An Economic Perspective, Proceedings of the 17th Annual Computer Security Applications Conference, p.358, December 10-14, 2001
• 3: Stefan Axelsson, The base-rate fallacy and the difficulty of intrusion detection, ACM Transactions on Information and System Security (TISSEC), v.3 n.3, p.186-205, Aug. 2000 [doi>10.1145/357830.357849]
• 4: Buzzard, K. 1999. Computer security---What should you spend your money on. Comput. Sec. 18, 4, 322--334.
• 5: Thomas E. Daniels , Eugene H. Spafford, Identification of host audit data to detect attacks on low-level IP vulnerabilities, Journal of Computer Security, v.7 n.1, p.3-35, Sept. 1999
• 6: Dorothy E. Denning, An intrusion-detection model, IEEE Transactions on Software Engineering, v.13 n.2, p.222-232, Feb. 1987 [doi>10.1109/TSE.1987.232894]
• 7: Dorothy E. Denning , Dennis K. Branstad, A taxonomy for key escrow encryption systems, Communications of the ACM, v.39 n.3, p.34-40, March 1996 [doi>10.1145/227234.227239]
• 8: Finne, T. 1998. A conceptual framework for information security management. Comput. Sec. 17, 4, 303--307.
• 9: Deborah Frincke, Balancing cooperation and risk in intrusion detection, ACM Transactions on Information and System Security (TISSEC), v.3 n.1, p.1-29, Feb. 2000 [doi>10.1145/353323.353324]
• 10: Lawrence A. Gordon , Martin P. Loeb, Using information security as a response to competitor analysis systems, Communications of the ACM, v.44 n.9, p.70-75, Sept. 2001 [doi>10.1145/383694.383709]
• 11: Jim Hann , Ron Weber, Information systems planning: a model and empirical tests, Management Science, v.42 n.7, p.1043-1064, July 1996 [doi>10.1287/mnsc.42.7.1043]
• 12: Hoo, K. 2000. How much is enough? A risk-management approach to computer security. Consortium for Research on Information Security Policy (CRISP) Working Paper. Stanford University, Stanford, Calif., June.
• 13: Jajodia, S. and Millen, J.. 1993. Editors' preface. J. Comput. Sec. 2, 2/3, 85.
• 14: Jones, A. 1997. Penetration testing and system audit. Comput. Sec. 16, 595--602.
• 15: KPMG. 2000. Information Security Survey 2000. http://www.kpmg.co.uk/services/audit/pubs/ISS (Apr.), 1--4
• 16: Larsen, A. 1999. Global security survey: Virus attack. InformationWeek.Com. http://www.informationweek.com/743/security.htm.
• 17: Littlewood, B., Broclehurst, S., Fenton, N., Mellor, P., Page, S., Wright, D., Dobson, J., Mcdermid, J., and Gollman, D. 1993. Towards operational measures of security. J. Comput. Sec. 2, 2, 211--229.
• 18: Loch, K. D., Carr, H. H., and Warkentin, M. E. 1992. Threats to information systems: Today's reality, yesterday's understanding. MIS Quart. 17, 2, 173--186.
• 19: Luotonen, O. 1993. Risk management and insurances. Painatuskeskus Oy. Helsinki, Finland.
• 20: Lee McKnight , Richard Solomon , Joseph Reagle , David Carver , Clark Johnson , Branko Gerovac , David Gingold, Information security for Internet commerce, Internet economics, MIT Press, Cambridge, MA, 1997
• 21: Catherine Meadows, A cost-based framework for analysis of denial of service in networks, Journal of Computer Security, v.9 n.1-2, p.143-164, Jan. 1,2001
• 22: Millen, J. 1992. A resource allocation model for denial of service. In Proceedings of the 1992 IEEE Symposium on Security and Privacy. IEEE Computer Society Press, Los Alamitos, Calif., pp. 137--147.
• 23: Krishnamurty Muralidhar , Dinesh Batra , Peeter J. Kirs, Accessibility, security, and accuracy in statistical databases: the case for the multiplicative fixed data perturbation approach, Management Science, v.41 n.9, p.1549-1564, Sept. 1995 [doi>10.1287/mnsc.41.9.1549]
• 24: NIST (National Institute of Standards and Technology). 1995. An Introduction to Computer Security: The NIST Handbook. (Special Publication 800-12).
• 25: Sylvia Osborn , Ravi Sandhu , Qamar Munawer, Configuring role-based access control to enforce mandatory and discretionary access control policies, ACM Transactions on Information and System Security (TISSEC), v.3 n.2, p.85-106, May 2000 [doi>10.1145/354876.354878]
• 26: Peyravian, M., Roginsky, A., and Zunic, N. 1999. Hash-based encryption. Comput. Sec. 18, 4, 345--350.
• 27: Charles P. Pfleeger, Security in computing, Prentice-Hall, Inc., Upper Saddle River, NJ, 1996
• 28: Power, R. 2001. 2001 CSI/FBI computer crime and security survey. Comput. Sec. J. 17, 2 (Spring), 29--51.
• 29: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• 30: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 31: Schneier, B. 1996. Applied Cryptography (2nd ed.), Wiley. New York.
• 32: Gustavus J. Simmons, Cryptanalysis and protocol failures, Communications of the ACM, v.37 n.11, p.56-65, Nov. 1994 [doi>10.1145/188280.188298]
• 33: Straub, D. W. 1990. Effective IS security: An empirical study. Inf. Syst. Res. 1, 3, 255--276.
• 34: Detmar W. Straub , Richard J. Welke, Coping with systems risk: security planning models for management decision making, MIS Quarterly, v.22 n.4, p.441-469, Dec. 1998 [doi>10.2307/249551]
• 35: Varian, H. R. 1997. How to build an economic model in your spare time. Part of a collection titled Passion and Craft: Economists at Work, ed. Michael Szenberg, University of Michigan Press, available at http://www.sims.berkeley.edu/∼hal/Papers/how.pdf.
• 36: Giovanni Vigna , Richard A. Kemmerer, NetSTAT: a network-based intrusion detection system, Journal of Computer Security, v.7 n.1, p.37-71, Sept. 1999
• 37: Wiseman, S. 1986. A secure capability computer system. In Proceedings of the IEEE Symposium on Security and Privacy. IEEE Computer Society Press, Los Alamitos, Calif, pp. 86--94.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.1 Systems and Information Theory
          Subjects: Value of information

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.0 General
          Subjects: Economics
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Economics, Security

Keywords:
Optimal security investment