Investments in Information Security: A Real Options Perspective with Bayesian Postaudit

2008 | Journal of Management Information Systems | Citations: 32

Authors: Herath, Hemantha S. B.; Herath, Tejaswini C.

Abstract: The application of real options techniques to information security is significan ... Expand

Abstract: The application of real options techniques to information security is significantly different than in the case of general information technology investments due to characteristics unique to information security. Emerging research in the economics of information security has suggested real options analysis (ROA) as a potential technique for assessing the value of information security assets, but has focused primarily on the most effective level of investment and the configuration of intrusion prevention/detection systems. In this paper, we attempt to address significant gaps in the literature by developing an integrated real options model for information security investments using Bayesian statistics that incorporates learning and postauditing in the analysis. By using the proposed model with actual data on e-mail and spam, we demonstrate that ROA with Bayesian postauditing offers a systematic valuation and risk management framework for evaluating information security spending by firms. We also discuss the managerial implications. Collapse

Topics: real option data security electronic mail IT security threat email spam

Methods: machine learning Bayesian analysis simulation Monte Carlo simulation descriptive statistic

Theories: capital asset pricing model decision theory

Understanding the Value of Countermeasure Portfolios in Information Systems Security

2008 | Journal of Management Information Systems | Citations: 38

Authors: Kumar, Ram L.; Park, Sungjune; Subramaniam, Chandrasekar

Abstract: Organizations are faced with a variety of information security threats and imple ... Expand

Abstract: Organizations are faced with a variety of information security threats and implement several information system security countermeasures (ISSCs) to mitigate possible damage due to security attacks. These security countermeasures vary in their ability to deal with different types of security attacks and, hence, are implemented as a portfolio of ISSCs. A key challenge for organizations is to understand the economic consequences of security attacks relative to the ISSC portfolio implemented. This paper combines the risk analysis and disaster recovery perspectives to build an integrated simulation model of ISSC portfolio value. The model incorporates the characteristics of an ISSC portfolio relative to the threat and business environments and includes the type of attack, frequency of attacks, possible damage, and the extent and time of recovery from damage. The simulation experiments provide interesting insights into the interactions between ISSC portfolio components and characteristics of business and threat environments in determining portfolio value. Collapse

Topics: firewall data encryption disaster recovery information technology infrastructure computer virus protection

Methods: experiment simulation descriptive statistic literature study parametric test

Intrusion Prevention in Information Systems: Reactive and Proactive Responses

2007 | Journal of Management Information Systems | Citations: 19

Authors: Yue, Wei T.; Cakanyildirim, Metin

Abstract: Intrusion prevention requires effective identification of and response to malici ... Expand

Abstract: Intrusion prevention requires effective identification of and response to malicious events. In this paper, we model two important managerial decisions involved in the intrusion prevention process: the configuration of the detection component, and the response by the reaction component. The configuration decision affects the number of alarms the firm has to investigate. It is well known that the traditional intrusion detection system generates too many false alarms. The response decision determines whether alarms are going to be investigated or rejected outright. By jointly optimizing these two decision variables, a firm may apply different strategies in protecting its informational assets: slow but accurate, rapid but inaccurate, or a mixture of the two strategies. We use the optimal control approach to study the problem. Unlike previous literature, which studied the problem with a static model, in our model, the decision on balancing the desire to detect all malicious events with the opportunity costs required to do so is time dependent. Furthermore, we show how the choice of an optimal mixture of reactive and proactive responses depends on the values of cost parameters and investigation rate parameters. We find that in our model, a high damage cost does not immediately translate to a preference of proactive response, or a high false rejection cost does not translate to a preference of reactive response. The dynamics of the problem, such as how fast alarms accumulate and how fast they can be cleared, also affect the decisions. Collapse

Topics: intrusion prevention system decision support system intrusion detection system data security computer crime

Methods: machine learning sensitivity analysis