Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability

Kjell Hausken

Information Systems Frontiers, 2006, vol. 8, issue 5, No 2, 338-349

Abstract: Abstract Four kinds of marginal returns to security investment to protect an information set are decrease, first increase and then decrease (logistic function), increase, and constancy. Gordon, L. A. and Loeb, M. (ACM Trans. Inf. Syst. Secur., 5:438–457, 2002). find for decreasing marginal returns that a firm invests maximum 37% (1 / e) of the expected loss from a security breach, and that protecting moderately rather than extremely vulnerable information sets may be optimal. This article presents classes of all four kinds where the optimal investment is no longer capped at 1 / e. First, investment in information security activities for the logistic function is zero for low vulnerabilities, jumps in a limited “bang-bang” manner to a positive level for intermediate vulnerabilities, and thereafter increases concavely in absolute terms. Second, we present an alternative class with decreasing marginal returns where the investment increases convexly in the vulnerability until a bound is reached, investing most heavily to protect the extremely vulnerable information sets. For the third and fourth kinds the optimal investment is of an all-out “bang-bang” nature, that is, zero for low vulnerabilities, and jumping to maximum investment for intermediate vulnerabilities.

Keywords: Security investment; Information protection; Returns assumptions; Information security breach; Vulnerability; Logistic function; Convexity; Concavity; Linearity (search for similar items in EconPapers)
Date: 2006
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (51)

Downloads: (external link)
http://link.springer.com/10.1007/s10796-006-9011-6 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:infosf:v:8:y:2006:i:5:d:10.1007_s10796-006-9011-6

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10796

DOI: 10.1007/s10796-006-9011-6

Access Statistics for this article

Information Systems Frontiers is currently edited by Ram Ramesh and Raghav Rao

More articles in Information Systems Frontiers from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().