APPLICATION OF ECONOMIC-COST MODEL OF INFORMATION RISKS FOR EVALUATION LIMITЕВ VOLUME OF INVESTMENT IN INFORMATION SECURITY

Abstract

The article analyzes the problem of determination of themaximum amount of investment in information security. Itis studied the approach of Gordon-Loeb, which justifiedthe limit investment in information security. It is analyzedthe publications containing materials related to the exposureand the development of this approach. It is shownthat this approach does not ensure univocal answer. Thereason for this is a subjective formal-approximation way ofdefining of a model, which is basis for the solution. Thisway gives multiplicity of possible models and, as the resulting,multiplicity of solutions. It is offered an approach tosolving the problem of determining the amount of investmentin the system of protection of information, which isbased on study of the model of information risks. Formationof its structure and parameters are based on the useof information about the actual mechanisms of the developmentand implementation of information threats. It isapplied economic-cost model, which is used to estimate theprobability of successful implementation of the attack ofinformation system vulnerability. The paper proposes theestimation of the maximum amount of investment in informationsecurity. This investment amounts to 25% of thevalue of the protected information resource (or losses arising from the implementation of the threat to this resource).It is noted that the in the case of application of highperformancetechnology/decisions in the system of informationsecurity level of investment may be reduced to 11-13%. It is considered the prospects of application of modelsbased on motivational and resource relations which arecharacteristic to of the situation "attack-defense" in theinformation sphere.