 An economic model to evaluate information security investment of risk-taking small and medium enterprisesSanjaya Mayadunne and Sungjune Park International Journal of Production Economics, 2016, vol. 182, issue C, 519-530 Abstract: This paper analyzes information security investment decisions made by risk taking small and medium enterprises (SMEs) using the expected utility approach. It then compares these decisions to ones made by a risk neutral firm. We find that risk takers are inclined to prioritize an information set's vulnerability over its value when making investment decisions. We also find that a risk taking firm may invest a larger amount in protecting a set than the risk neutral firm when the effectiveness of the investment in lowering breach probability is low. Finally, we show that for a group of information sets of equal value and varying vulnerabilities, the risk neutral decision maker will diversify security investment to a greater extent than the risk taker. As a result, the risk taker will invest a larger amount than the risk neutral firm would when protecting the high risk sets in the group. The results provide guidance to information security vendors when tailoring products to suit small businesses. Keywords: Information security; Risk preference; Expected utility (search for similar items in EconPapers) Downloads: (external link) Related works: Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text Persistent link: https://EconPapers.repec.org/RePEc:eee:proeco:v:182:y:2016:i:c:p:519-530 DOI: 10.1016/j.ijpe.2016.09.018 Access Statistics for this article International Journal of Production Economics is currently edited by Stefan Minner More articles in International Journal of Production Economics from Elsevier |
Is your work missing from RePEc? Here is how to contribute.
Questions or problems? Check the EconPapers FAQ or send mail to .
EconPapers is hosted by the
School of Business at Örebro University.