Research Note ---A Value-at-Risk Approach to Information Security Investment

Jingguo Wang (), Aby Chaudhury () and H. Raghav Rao ()
Additional contact information
Jingguo Wang: College of Business Administration, University of Texas at Arlington, Arlington, Texas 76019
Aby Chaudhury: Bryant University, Smithfield, Rhode Island 02917
H. Raghav Rao: School of Management, State University of New York at Buffalo, Buffalo, New York 14260

Information Systems Research, 2008, vol. 19, issue 1, 106-120

Abstract: Information security investment has been getting increasing attention in recent years. Various methods have been proposed to determine the effective level of security investment. However, traditional expected value methods (such as annual loss expectancy) cannot fully characterize the information security risk confronted by organizations, considering some extremal yet perhaps relatively rare cases in which a security failure may be critical and cause high losses. In this research note we introduce the concept of value-at-risk to measure the risk of daily losses an organization faces due to security exploits and use extreme value analysis to quantitatively estimate the value at risk. We collect a set of internal daily activity data from a large financial institution in the northeast United States and then simulate its daily losses with information based on data snapshots and interviews with security managers at the institution. We illustrate our methods using these simulated daily losses. With this approach, decision makers can make a proper investment choice based on their own risk preference instead of pursuing a solution that minimizes only the expected cost.

Keywords: information assurance; security investment; value-at-risk (VaR); extreme value analysis (search for similar items in EconPapers)
Date: 2008
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (10)

Downloads: (external link)
http://dx.doi.org/10.1287/isre.1070.0143 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:orisre:v:19:y:2008:i:1:p:106-120

Access Statistics for this article

More articles in Information Systems Research from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().