Mis-spending on information security measures: Theory and experimental evidence

Roozmehr Safi, Glenn J. Browne and Azadeh Jalali Naini

International Journal of Information Management, 2021, vol. 57, issue C

Abstract: Information resources are becoming increasingly important to individuals and organizations, and ensuring their security is a major concern. While research in information security has adopted primarily a quantitative method to determine how and how much to invest in security, most decision makers rely on non-quantitative methods for this purpose, thereby introducing a considerable amount of as yet unexplained subjective judgment to the problem. We use a behavioral decision making approach to investigate factors causing possible inefficiencies of security spending decisions. Decision makers in our experiment performed a series of economic games featuring the key characteristics of a typical security problem. We found several biases in investment decisions. For budgeting their investment between major classes of security measures, decision makers demonstrated a strong bias toward investing in preventive measures rather than in detection and response measures, even though the task was designed to yield the same return on investment for both classes of measures. We term this phenomenon the “Prevention Bias.” Decision makers also reacted to security threats when the risk was so small that no investment was economically justified. For higher levels of risk that warranted some security investment, decision makers showed a strong tendency to overinvest. Theoretical and practical implications of the findings are discussed.

Keywords: Information security investment; Prevention; Detection and response; Decision biases; Prevention bias; Experiment (search for similar items in EconPapers)
Date: 2021
References: Add references at CitEc
Citations:

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S0268401220314900
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:ininma:v:57:y:2021:i:c:s0268401220314900

DOI: 10.1016/j.ijinfomgt.2020.102291

Access Statistics for this article

International Journal of Information Management is currently edited by Yogesh K. Dwivedi

More articles in International Journal of Information Management from Elsevier
Bibliographic data for series maintained by Catherine Liu ().