Information Security Investment Research Articles

Decisions Making in Information Security Investments: Impact of System Vulnerability and Investment Timing on Resource-Sharing Platforms

This study distinguishes enterprises into high- and low-type categories based on enterprise value and cost efficiency, examining their strategic behaviors in three investment timing games: move simultaneously, the high-type enterprise moves first, and the low-type enterprise moves first. By comparing the three games, we find that both types of enterprises would always exert more effort in the sequential game than in the simultaneous game, and the later-move advantage makes both types of enterprises prefer to become the follower in the game. We also find that the enhanced cost efficiency advantage or enterprise value gap possessed by the high-type enterprise would widen the effort gap between the two types of enterprises, and enhance the low-type enterprise’s incentive to be the follower. Moreover, the existence of system vulnerability not only causes both types of enterprises to reduce their security effort that generates free-riding behaviors but also can first discourage and then encourage enterprises from moving in advance. We further propose a liability-based mechanism to tackle the free-riding problem. We reveal an exact optimal liability coefficient, whether in the simultaneous or sequential game and find that the high-type enterprise should undertake more compensation when its dominant position becomes more obvious and the low-type enterprise could therefore undertake decreased liability. Last, we extend the model to multiple enterprises and show that the results are robust. Funding: This work was supported by the Shanghai Science and Technology Development Foundation [Grant 24692107700]; the Humanities and Social Science Fund of Ministry of Education of China [Grant 23YJA630100]; Fundamental Research Funds for the Central Universities; DHU Distinguished Young Professor Program; and the Shanghai Social Science Foundation [Grant 2022ZGL009]. Supplemental Material: The online appendix is available at https://doi.org/10.1287/deca.2024.0190 .

A Simulation-based Education Platform for Security Investments Through Culture and Knowledge Convergence

Cybersecurity is one of the most critical sectors of information systems and is considered a strategic priority for many Organizations. Information security investments are a crucial aspect of cybersecurity. However, it often happens that the economic decisions, which aim to improve information security, have poor efficiency. One reason is the lack of background on economics of the Chief Information Security Officers who are often not familiar with the evaluation of the non-technical aspects of security, e.g. economics. The other reason is the cultural gap between the different persons related to business management and administration. In this paper we present an interactive - simulation software designed to familiarize the aforementioned persons with information security investments. The software is actually a game that aims to boost learning for all the stakeholders who are involved in the investment process. Α better understanding of the processes, the technical, economic and human factors, along with the cultural convergence of the stakeholders will help boost the efficiency of investments. Design Science is used as the research method. The creative method, a brainstorming technique, is combined with the five steps of Design Science, i.e. explicate the problem, define the requirements, design and develop the artefact, demonstrate the artefact, and evaluate the artefact, to develop a process framework that will be able to cope with this problem. The artefact is an interactive-simulation platform in which a person could take the decision maker role and (a) deal with events that happen and (b) investigate different aspects of information security investment complexity. The evaluation of the artefact is made with a case study in the Industry, where real world data are used to feed the simulation and real-world decision makers play the game in order to better understand the different aspects of the problem and help us trim and enhance the functioning of the platform. Finally, limitations are elaborated and future work is also discussed.

Analyzing Consumer Engagement in Electronic Waste Products Reverse Logistics: Extending the Planned Behavior Theory

Purpose - This study extends the theory of planned behavior from a consumer perspective to investigate consumer willingness and behavior in electronic waste products reverse logistics, along with the underlying influencing factors.
 Design/Methodology/Approach - Based on existing research, this paper has developed a model and hypotheses regarding consumer intentions to participate in electronic waste products reverse logistics and the influencing factors. Subsequently, this study conducted a survey of 355 Chinese consumers aged 20-50 years and used SmartPLS to analyze the relevant data for hypothesis validation.
 Findings - Results show that consumers’ green attitudes and green subjective norms have a positive impact on their willingness to participate in electronic waste products reverse logistics. And perceived behavioral control only exerts a positive influence on their participatory behavior. On the other hand, concerns about privacy breaches often hinder their willingness and behavior to participate. Moreover, the findings also indicate that consumers’ willingness to participate positively influences their actual participation behavior.
 Research Implications - This study predominantly examines the positive and negative subjective factors influencing consumers’ intentions and behaviors in participating in reverse logistics for electronic waste products. Based on the findings, we suggest fostering consumer awareness of electronic waste through various channels, including social media, and maintaining ongoing promotional campaigns to enhance environmental awareness and consumer engagement. Additionally, relevant firms should bolster consumer privacy protection, while the government should enhance regulatory oversight and introduce incentive policies to encourage businesses to increase investments in information security, thereby boosting consumer confidence in participation.

Information security investment for complementary and substitutable firms: The role of technology similarity

Information security investment for complementary and substitutable firms: The role of technology similarity

Information security investment prioritization using best-worst method for small and medium enterprises

In recent years, cyber security has become an increasingly important aspect of the decision-making process of corporations. It is essential to make investments in cybersecurity at this point to guard against the frequent disruption of business operations posed by cyberattacks. In the context of small and medium-sized organizations, this study recommends using a multicriteria decision-making technique to evaluate information security aspects. The information security index is derived as the foundation for every one of these features. The best-worst method is carried out to establish the best and worst possible security investments. In order to validate these findings, a survey was distributed to a variety of professionals and business decisionmakers. The criteria for selection are laid forth in the form of categories labeled technology and organization, respectively. The findings are presented in a rating system with three tiers, with the highest level representing the absolute best of the results. In the final section of the study, we will examine potential future possibilities for research and policy.

Information sharing and deferral option in cybersecurity investment.

This study investigates the effect of information sharing and deferral option on a firm's information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm's security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm's deferral decision increases for low-benefit information (SL) but decreases for high-benefit information (SH). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of SL; when information sharing accuracy is high, the firm defers its decisions in all SL and a fraction of SH. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm's uncertainty on cybersecurity investment and decreases deferment options associated with investment.

Influence of Technology on the Performance of Microfinance Institutions in Kitui County

The purpose of the study was to investigate the influence of technology in strategic planning on the performance of microfinance institutions in Kitui County. The study applied a correctional research design. The population for the study was 175 middle-level managers working for seven (7) microfinance institutions in Kitui County. Through stratified sampling techniques, the study obtained a sample of 122 participants for the study. The study applied questionnaires with five-point Likert questions to collect data through physical administration and electronic ways. The study also collected secondary data from the microfinance institutions, financial statements, magazines, and published and audited accounts of the company. Data gathered was analyzed by descriptive analysis using mean and standard deviation, whereas the inferential analysis was conducted by regression analysis. The study found a β of 0.610 which was associated with a t-value of 5.960 and a p-value of 0.001 between technology and performance of microfinance institutions in Kitui county. The study concluded that technology had a positive and significant influence on the performance of microfinance institutions in Kitui County. The study recommends continued investment in information security by regularly updating security protocols and staying ahead of the evolving threats to protect sensitive information. The study also recommends for organizations to leverage decision support systems in decision-making. The microfinance institutions in Kitui County should train and provide resources to their staff to maximize the benefits of these systems.

Competitive information security investment under hacker knowledge dissemination

<p style='text-indent:20px;'>This paper discusses how two competitive firms invest in information security by constructing a differential game in which hacker knowledge dissemination and the law enforcement are considered. Feedback Nash equilibrium solution of information security investment rates and the resulting firm profits are derived, showing that inconsistent with common sense, firm profits may increase with hackers' evaluation rates of information assets and decrease with the law enforcement rate. Interestingly enough, I find that a higher growth rate of hacker knowledge dissemination sometimes increases firm profits. Meanwhile, I counter-intuitively demonstrate under certain circumstances that a higher efficiency of information security investment of inhibiting hacker knowledge dissemination may decrease firm profits and that a larger damage of hacker knowledge dissemination may increase firm profits.</p>

A competitive analysis of information security investment: The role of hacker attacks

The role of hacker attacks on information security investment and firm profits is fundamental in information security economics, which, however, has not been fully examined yet. This paper builds a duopolistic horizontal differentiation model to study this issue and yields a series of interesting findings. First, we find that each firm may benefit from an increase of the probability of hacker attacks when it gains more from security differentiation and suffers less from investment competition. Second, when market competition becomes fiercer, each firm invests less in information security to maintain security differentiation. Third, each firm may benefit from an increase of consumer security loss because the resulting security investment can lead to a more desirable security differentiation. Finally, an increase of cost coefficient of security investment may be profitable to each firm in spite of an increase of security expenditure. This is because an increase of cost coefficient may facilitate security differentiation through discouraging security investment. Additionally, the model is extended to analytically and numerically check the robustness of the main results.

An Extended Security Measurement Framework for Open-Source Enterprise Resource Planning Software Security

Modern organizations are adopting new ways of measuring their level of security for compliance and justification of security investments. The highly interconnected environment has seen organizations generate lots of personal information and sensitive organizational data. Easiness in automation provided by open-source enterprise resource planning (ERP) software has accelerated its acceptability. The study aimed at developing a security measurement framework for open-source ERP software. The motivation was twofold: paradigm shift towards open-source ERP software and the need for justified investment on information security. Product quality evaluation method based on ISO 25010 framework guided the selection of attributes and factors. A security measurement framework with security posture at the highest level, attributes and factors was developed presenting a mechanism for assessing organization’s level of security. Security posture promotes customers’ confidence and gives management means to leverage resources for information security investment. The future work includes definition of metrics based on the framework.

Relationship Structure Analysis on Determinants of Enterprise Information Security Investment Decision Based on ISM

Information security is one of the biggest threats to enterprises; how to identify the determinants of enterprise information security investment (EISI) and put forward corresponding countermeasures is related to the continuity of enterprise operation, which is an urgent problem to be solved at present. This article identifies the index system of factors that affect the EISI by using the Delphi method. The interpretive structural model (ISM) of the influence factors of EISI is constructed. The result shows that the ISM of EISI determinants is a multilevel hierarchical structure with five levels. According to the logical structure of the model, the most direct reasons affecting EISI are the level of enterprise information security technology and enterprise information security behavior; information security laws and regulations and national policies are the deep-seated reasons for EISI. It is of theoretical value and reference to understand the formation, model establishment, and evolution mechanism of EISI decision making.

Information security and value creation: The performance implications of ISO/IEC 27001

Although protecting information is the key challenge in a business environment characterized by increasing digitalization and connectivity, the impact of firms’ investments in information security on their financial performance is unclear. In this paper, we focus on ISO/IEC 27001 (i.e., the most renowned norm in the field and the fourth most widespread ISO standard) and analyze the relationship between the attainment of the certification and firms’ financial performance. We developed a set of theory-grounded hypotheses and tested them through a long-term event study complemented by an ordinary least squares regression on a dataset of 143 US-listed companies. The results indicate that the ISO/IEC 27001 certification is associated with improvements in profitability, labor productivity, and (partially) sales performance. The impact appears affected by the level of internationalization of the certified firm. The study contributes to the scientific debate on information security and certifications by developing the first large-scale empirical investigation based on secondary data on the financial implications of ISO/IEC 27001. Moreover, we further deepen the current knowledge on the effects of international management standards on firms’ performance thus enabling comparisons with other major management system standards.

Information security investment with budget constraint and security information sharing in resource-sharing environments

Nowadays, business connection between firms becomes rather common so that one firm stores not only its information asset but also some of other firms’ information asset. The management of information security is vital for these resource-sharing firms. This paper constructs a game-theoretic model between two resource-sharing firms and one hacker to examine their strategic interaction when the firms face budget constraint on security investment. We consider security information sharing between the firms, which can improve their overall security effort but meantime facilitate the hacker’s learning to reduce attack costs. We find that although a tight budget constraint can help save investment cost, the firms always suffer from a poorly secure environment. It shows that although security information sharing is usually encouraged, the firms may be hurt when security information sharing is excessive so that fierce cyber-attacks are induced. We finally design an optimal compensation mechanism, in which the compensation fund is shown to increase with the degree of resource sharing.

Comparison of the Most Important Models of Investments in Cyber and Information Security

Purpose of the article: Cyber security has become a key factor in determining the success or failure of companies that rely on information systems. However, this entails considerable investment. Typical investments in information technology aim to create value, while investments in cyber security aim to minimise losses caused by cyber-attacks. In the case of investment in cyber and information security, therefore, we must evaluate the amount of loss that will never actually occur. This is a complicated problem, and several approaches have been proposed over the years to estimate the cost-benefit balance of security investments.Methodology/methods: This paper is based on previous research (Podešva et al., 2021), where two most used methods of the ROI / ROSI (Bojanc, 2008) and Gordon-Loe model (Gordon, Loeb, 2002) were identified in the field of investments in cyber and information security. Both methods are described and the advantages and limitations for further research are identified.Scientific aim: The main goal is to select the most suitable method for further research in the field of investment in cyber and information security.Findings: ROI / ROSI does not seem suitable for further research because it only tells us what percentage of return on in-vestment will be provided during a given period. The separate use of this method (ROI / ROSI) provides us with very limited results and it is necessary to combine it with other methods. On the other hand, the Gordon-Loeb model is much more complex despite several limitations, especially for coefficients ʎ and t. Further research will therefore focus on the constant t (probability of attack on a given information set) and its value will be modelled based on the SIR epidemic model on network with standard incidents (Podešva, Koch 2019).Conclusions: At present, there is no standardised approach to decision-making and the size of investments in cyber and in-formation security. This is a very complex issue, and it is very difficult to find one universal model. Nevertheless, there are several models that help in this decision-making process, and as the most appropriate method for further research is Gordon Loe model

Employees' intentions toward complying with information security controls in Saudi Arabia's public organisations

Ensuring employees' compliance with information security controls is a major challenge experienced by the management of information security in organisations. While the investment in information security has been increased recently, many organisations around the world have failed to avoid security threats and data breaches because of noncompliant employees. This study proposes a model to explore employees' differences and identifies the factors that can shape their perceptions and intentions toward compliance. The model was examined and validated in a Saudi Arabian government organisation using partial least square structural equation modelling. The results of this study support the validity of the research model and disclose the factors that have a significant influence on employees' intentions toward compliance, particularly in Saudi Arabia's public organisations. To the best of our knowledge, this is the first study to investigate employees' perceptions and intentions toward complying with information security controls in public organisations across all regions of Saudi Arabia. The study contributes to the information security management domain in terms of the model's validity, which can be used to explore the influence of the identified factors on employees' perceptions and intentions toward complying with information security controls in different cultural and environmental contexts.

A process framework for information security management

Securing sensitive organizational data has become increasingly vital to organizations. An Information Security Management System (ISMS) is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security. Key elements of the operation of an ISMS are ISMS processes. However, and in spite of its importance, an ISMS process framework with a description of ISMS processes and their interaction as well as the interaction with other management processes is not available in the literature. Cost benefit analysis of information security investments regarding single measures protecting information and ISMS processes are not in the focus of current research, mostly focused on economics. This article aims to fill this research gap by proposing such an ISMS process framework as the main contribution. It is based on a set of agreed upon ISMS processes in existing standards like ISO 27000 series, COBIT and ITIL. Within the framework, identified processes are described and their interaction and interfaces are specified. This framework helps to focus on the operation of the ISMS, instead of focusing on measures and controls. By this, as a main finding, the systemic character of the ISMS consisting of processes and the perception of relevant roles of the ISMS is strengthened.

Information security investment and purchase decision for personalized products

Considering information security and personalization paradoxes, this paper investigates the optimal information security investments of a firm and purchasing decisions of consumers with different privacy concerns in online personalization. It is found that consumers and firm tend to fall into a prisoner's dilemma in Nash equilibrium. To improve security investment efficiency and boost personalization consumption, firm‐led Stackelberg game and firm‐led Stackelberg game with punishment mechanism are proposed and analyzed. The results indicate that the security information measures firm take in advance can effectively increase the waverers' willingness to purchase personalized products. Government punishment helps to facilitate a win‐win situation but does not work when proportion of wavers in the market is very small. Furthermore, the responses of equilibrium strategies and payoffs to related characteristics are discussed numerically. Finally, some managerial insights are recommended to firms who provide personalized products for making proper security investment and to government departments for formulating security punishment policies.

Expanding the Gordon-Loeb model to cyber-insurance

We present an economic model for decisions on competing cyber-security and cyber-insurance investment based on the Gordon-Loeb model for investment in information security. We consider a one-period scenario in which a firm may invest in information security measures to reduce the probability of a breach, in cyber-insurance or in a combination of both. The optimal combination of investment and insurance under the assumptions of the Gordon-Loeb model is investigated via consideration of the costs and benefits of investment in security alongside purchasing insurance at an independent premium rate. Under both exponential (constant absolute risk aversion) and logarithmic (constant relative risk aversion) utility functions it is found that when the insurance premium is below a certain value, utility is maximised with insurance and security investment. These results suggest that cyber-insurance is a worthwhile undertaking provided it is not overly costly. We believe this model to be the first attempt to integrate the Gordon-Loeb model into a classical microeconomic analysis of insurance, particularly using the Gordon-Loeb security breach functions to determine the probability of an insurance claim. The model follows the tradition of the Gordon-Loeb model in being accessible to practitioners and decision makers in information security.

An evolutionary game‐theoretic analysis of enterprise information security investment based on information sharing platform

The threat to enterprise information security is growing through advancing in information and communications technology; in order to enhance the efficiency of information security sharing platform, it is necessary to analyze the process about information security sharing between enterprises that take part in the sharing platform. In this paper, the evolutionary game theory (EGT) is applied to form a better understanding of information security investment based on information sharing platform. The evolution of information sharing and its influencing factors in information security sharing platforms are analyzed. The paper provides some suggestions for promoting the efficiency of platform information sharing.

EFFICIENCY OF THE INDICATORS INVESTMENT CALCULATION METHOD IN THE INFORMATION SECURITY SYSTEM OF INFORMATION OBJECTS

The article analyzes publications on the evaluation of investments in information security (IS) of objects of informatization (OBI). The possibility and necessity of obtaining the necessary data have been substantiated, contributing to a reliable assessment of the effectiveness of measures aimed at increasing the company’s IS. In the study process, the modelling methods have been used. A methodology is proposed for calculating indicators from investment activities in the context of increasing IS metrics of OBI. A specific example of such simulation is described. The proposed methodology provides an assessment of the damage prevention from a cyber-attack. The amount of the damage prevention from a cyber-attack is taken as a basic indicator for calculating the economic effect of investing in information security tools (IST). The performed simulation modelling allowed taking into account the relative uncertainty of the real situation with IS of OBI. The conducted study will help practitioners in the field of IS to obtain informed decisions to increase the efficiency of investment projects in the field of IS for OBI, using the approach outlined in the study. Unlike the existing ones, the proposed methodology takes into account both direct and indirect factors of investment projects in the field of IS of OBI