Enterprise security investment through time when facing different types of vulnerabilities

Yosra Miaoui () and Noureddine Boudriga ()
Additional contact information
Yosra Miaoui: University of Carthage
Noureddine Boudriga: University of Carthage

Information Systems Frontiers, 2019, vol. 21, issue 2, No 3, 300 pages

Abstract: Abstract We propose in this work to use the utility theory to compute the optimal security investment over an investment horizon, considering the typologies and dynamic aspects of vulnerabilities related to the assets of a firm. A regression over a 17-year statistics available in the National Vulnerability Database is performed to predict and forecast the evolution of vulnerabilities’ rates over the investment horizon. Techniques and methodologies are proposed to compute and plan investment tranches over the whole time-horizon, while coping with budget constraints. An analysis is conducted to assess the variation of the optimal investments and the residual risk, taking into account the attitude of decision-makers towards risk. The obtained results show that : a) the optimal amount of investment in information security necessary to counter located attacks increases with the investment horizon for all types of vulnerabilities, but such an increase highly depends on the type of vulnerabilities affecting the firm; b) differently to located attacks, the optimal amount of investment in information security necessary to counter distributed attacks does not always increase with the investment horizon; and c) the optimal amount to invest in security, and the optimum value of the residual risk depend on the decision-maker attitude towards security risk.

Keywords: Optimal investment; Information security; Utility theory; Economics of security; Security threats and vulnerabilities (search for similar items in EconPapers)
Date: 2019
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (5)

Downloads: (external link)
http://link.springer.com/10.1007/s10796-017-9745-3 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:infosf:v:21:y:2019:i:2:d:10.1007_s10796-017-9745-3

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10796

DOI: 10.1007/s10796-017-9745-3

Access Statistics for this article

Information Systems Frontiers is currently edited by Ram Ramesh and Raghav Rao

More articles in Information Systems Frontiers from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().