Information Security Investment Research Articles

Analyzing Consumer Engagement in Electronic Waste Products Reverse Logistics: Extending the Planned Behavior Theory

Purpose - This study extends the theory of planned behavior from a consumer perspective to investigate consumer willingness and behavior in electronic waste products reverse logistics, along with the underlying influencing factors.
 Design/Methodology/Approach - Based on existing research, this paper has developed a model and hypotheses regarding consumer intentions to participate in electronic waste products reverse logistics and the influencing factors. Subsequently, this study conducted a survey of 355 Chinese consumers aged 20-50 years and used SmartPLS to analyze the relevant data for hypothesis validation.
 Findings - Results show that consumers’ green attitudes and green subjective norms have a positive impact on their willingness to participate in electronic waste products reverse logistics. And perceived behavioral control only exerts a positive influence on their participatory behavior. On the other hand, concerns about privacy breaches often hinder their willingness and behavior to participate. Moreover, the findings also indicate that consumers’ willingness to participate positively influences their actual participation behavior.
 Research Implications - This study predominantly examines the positive and negative subjective factors influencing consumers’ intentions and behaviors in participating in reverse logistics for electronic waste products. Based on the findings, we suggest fostering consumer awareness of electronic waste through various channels, including social media, and maintaining ongoing promotional campaigns to enhance environmental awareness and consumer engagement. Additionally, relevant firms should bolster consumer privacy protection, while the government should enhance regulatory oversight and introduce incentive policies to encourage businesses to increase investments in information security, thereby boosting consumer confidence in participation.

Information security investment for complementary and substitutable firms: The role of technology similarity

Information security investment for complementary and substitutable firms: The role of technology similarity

Information security investment prioritization using best-worst method for small and medium enterprises

In recent years, cyber security has become an increasingly important aspect of the decision-making process of corporations. It is essential to make investments in cybersecurity at this point to guard against the frequent disruption of business operations posed by cyberattacks. In the context of small and medium-sized organizations, this study recommends using a multicriteria decision-making technique to evaluate information security aspects. The information security index is derived as the foundation for every one of these features. The best-worst method is carried out to establish the best and worst possible security investments. In order to validate these findings, a survey was distributed to a variety of professionals and business decisionmakers. The criteria for selection are laid forth in the form of categories labeled technology and organization, respectively. The findings are presented in a rating system with three tiers, with the highest level representing the absolute best of the results. In the final section of the study, we will examine potential future possibilities for research and policy.

Information sharing and deferral option in cybersecurity investment.

This study investigates the effect of information sharing and deferral option on a firm's information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm's security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm's deferral decision increases for low-benefit information (SL) but decreases for high-benefit information (SH). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of SL; when information sharing accuracy is high, the firm defers its decisions in all SL and a fraction of SH. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm's uncertainty on cybersecurity investment and decreases deferment options associated with investment.

Influence of Technology on the Performance of Microfinance Institutions in Kitui County

The purpose of the study was to investigate the influence of technology in strategic planning on the performance of microfinance institutions in Kitui County. The study applied a correctional research design. The population for the study was 175 middle-level managers working for seven (7) microfinance institutions in Kitui County. Through stratified sampling techniques, the study obtained a sample of 122 participants for the study. The study applied questionnaires with five-point Likert questions to collect data through physical administration and electronic ways. The study also collected secondary data from the microfinance institutions, financial statements, magazines, and published and audited accounts of the company. Data gathered was analyzed by descriptive analysis using mean and standard deviation, whereas the inferential analysis was conducted by regression analysis. The study found a β of 0.610 which was associated with a t-value of 5.960 and a p-value of 0.001 between technology and performance of microfinance institutions in Kitui county. The study concluded that technology had a positive and significant influence on the performance of microfinance institutions in Kitui County. The study recommends continued investment in information security by regularly updating security protocols and staying ahead of the evolving threats to protect sensitive information. The study also recommends for organizations to leverage decision support systems in decision-making. The microfinance institutions in Kitui County should train and provide resources to their staff to maximize the benefits of these systems.

Competitive information security investment under hacker knowledge dissemination

<p style='text-indent:20px;'>This paper discusses how two competitive firms invest in information security by constructing a differential game in which hacker knowledge dissemination and the law enforcement are considered. Feedback Nash equilibrium solution of information security investment rates and the resulting firm profits are derived, showing that inconsistent with common sense, firm profits may increase with hackers' evaluation rates of information assets and decrease with the law enforcement rate. Interestingly enough, I find that a higher growth rate of hacker knowledge dissemination sometimes increases firm profits. Meanwhile, I counter-intuitively demonstrate under certain circumstances that a higher efficiency of information security investment of inhibiting hacker knowledge dissemination may decrease firm profits and that a larger damage of hacker knowledge dissemination may increase firm profits.</p>

A competitive analysis of information security investment: The role of hacker attacks

The role of hacker attacks on information security investment and firm profits is fundamental in information security economics, which, however, has not been fully examined yet. This paper builds a duopolistic horizontal differentiation model to study this issue and yields a series of interesting findings. First, we find that each firm may benefit from an increase of the probability of hacker attacks when it gains more from security differentiation and suffers less from investment competition. Second, when market competition becomes fiercer, each firm invests less in information security to maintain security differentiation. Third, each firm may benefit from an increase of consumer security loss because the resulting security investment can lead to a more desirable security differentiation. Finally, an increase of cost coefficient of security investment may be profitable to each firm in spite of an increase of security expenditure. This is because an increase of cost coefficient may facilitate security differentiation through discouraging security investment. Additionally, the model is extended to analytically and numerically check the robustness of the main results.

An Extended Security Measurement Framework for Open-Source Enterprise Resource Planning Software Security

Modern organizations are adopting new ways of measuring their level of security for compliance and justification of security investments. The highly interconnected environment has seen organizations generate lots of personal information and sensitive organizational data. Easiness in automation provided by open-source enterprise resource planning (ERP) software has accelerated its acceptability. The study aimed at developing a security measurement framework for open-source ERP software. The motivation was twofold: paradigm shift towards open-source ERP software and the need for justified investment on information security. Product quality evaluation method based on ISO 25010 framework guided the selection of attributes and factors. A security measurement framework with security posture at the highest level, attributes and factors was developed presenting a mechanism for assessing organization’s level of security. Security posture promotes customers’ confidence and gives management means to leverage resources for information security investment. The future work includes definition of metrics based on the framework.

Relationship Structure Analysis on Determinants of Enterprise Information Security Investment Decision Based on ISM

Information security is one of the biggest threats to enterprises; how to identify the determinants of enterprise information security investment (EISI) and put forward corresponding countermeasures is related to the continuity of enterprise operation, which is an urgent problem to be solved at present. This article identifies the index system of factors that affect the EISI by using the Delphi method. The interpretive structural model (ISM) of the influence factors of EISI is constructed. The result shows that the ISM of EISI determinants is a multilevel hierarchical structure with five levels. According to the logical structure of the model, the most direct reasons affecting EISI are the level of enterprise information security technology and enterprise information security behavior; information security laws and regulations and national policies are the deep-seated reasons for EISI. It is of theoretical value and reference to understand the formation, model establishment, and evolution mechanism of EISI decision making.

Information security and value creation: The performance implications of ISO/IEC 27001

Although protecting information is the key challenge in a business environment characterized by increasing digitalization and connectivity, the impact of firms’ investments in information security on their financial performance is unclear. In this paper, we focus on ISO/IEC 27001 (i.e., the most renowned norm in the field and the fourth most widespread ISO standard) and analyze the relationship between the attainment of the certification and firms’ financial performance. We developed a set of theory-grounded hypotheses and tested them through a long-term event study complemented by an ordinary least squares regression on a dataset of 143 US-listed companies. The results indicate that the ISO/IEC 27001 certification is associated with improvements in profitability, labor productivity, and (partially) sales performance. The impact appears affected by the level of internationalization of the certified firm. The study contributes to the scientific debate on information security and certifications by developing the first large-scale empirical investigation based on secondary data on the financial implications of ISO/IEC 27001. Moreover, we further deepen the current knowledge on the effects of international management standards on firms’ performance thus enabling comparisons with other major management system standards.

Information security investment with budget constraint and security information sharing in resource-sharing environments

Nowadays, business connection between firms becomes rather common so that one firm stores not only its information asset but also some of other firms’ information asset. The management of information security is vital for these resource-sharing firms. This paper constructs a game-theoretic model between two resource-sharing firms and one hacker to examine their strategic interaction when the firms face budget constraint on security investment. We consider security information sharing between the firms, which can improve their overall security effort but meantime facilitate the hacker’s learning to reduce attack costs. We find that although a tight budget constraint can help save investment cost, the firms always suffer from a poorly secure environment. It shows that although security information sharing is usually encouraged, the firms may be hurt when security information sharing is excessive so that fierce cyber-attacks are induced. We finally design an optimal compensation mechanism, in which the compensation fund is shown to increase with the degree of resource sharing.

Comparison of the Most Important Models of Investments in Cyber and Information Security

Purpose of the article: Cyber security has become a key factor in determining the success or failure of companies that rely on information systems. However, this entails considerable investment. Typical investments in information technology aim to create value, while investments in cyber security aim to minimise losses caused by cyber-attacks. In the case of investment in cyber and information security, therefore, we must evaluate the amount of loss that will never actually occur. This is a complicated problem, and several approaches have been proposed over the years to estimate the cost-benefit balance of security investments.Methodology/methods: This paper is based on previous research (Podešva et al., 2021), where two most used methods of the ROI / ROSI (Bojanc, 2008) and Gordon-Loe model (Gordon, Loeb, 2002) were identified in the field of investments in cyber and information security. Both methods are described and the advantages and limitations for further research are identified.Scientific aim: The main goal is to select the most suitable method for further research in the field of investment in cyber and information security.Findings: ROI / ROSI does not seem suitable for further research because it only tells us what percentage of return on in-vestment will be provided during a given period. The separate use of this method (ROI / ROSI) provides us with very limited results and it is necessary to combine it with other methods. On the other hand, the Gordon-Loeb model is much more complex despite several limitations, especially for coefficients ʎ and t. Further research will therefore focus on the constant t (probability of attack on a given information set) and its value will be modelled based on the SIR epidemic model on network with standard incidents (Podešva, Koch 2019).Conclusions: At present, there is no standardised approach to decision-making and the size of investments in cyber and in-formation security. This is a very complex issue, and it is very difficult to find one universal model. Nevertheless, there are several models that help in this decision-making process, and as the most appropriate method for further research is Gordon Loe model

Employees' intentions toward complying with information security controls in Saudi Arabia's public organisations

Ensuring employees' compliance with information security controls is a major challenge experienced by the management of information security in organisations. While the investment in information security has been increased recently, many organisations around the world have failed to avoid security threats and data breaches because of noncompliant employees. This study proposes a model to explore employees' differences and identifies the factors that can shape their perceptions and intentions toward compliance. The model was examined and validated in a Saudi Arabian government organisation using partial least square structural equation modelling. The results of this study support the validity of the research model and disclose the factors that have a significant influence on employees' intentions toward compliance, particularly in Saudi Arabia's public organisations. To the best of our knowledge, this is the first study to investigate employees' perceptions and intentions toward complying with information security controls in public organisations across all regions of Saudi Arabia. The study contributes to the information security management domain in terms of the model's validity, which can be used to explore the influence of the identified factors on employees' perceptions and intentions toward complying with information security controls in different cultural and environmental contexts.

A process framework for information security management

Securing sensitive organizational data has become increasingly vital to organizations. An Information Security Management System (ISMS) is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's information security. Key elements of the operation of an ISMS are ISMS processes. However, and in spite of its importance, an ISMS process framework with a description of ISMS processes and their interaction as well as the interaction with other management processes is not available in the literature. Cost benefit analysis of information security investments regarding single measures protecting information and ISMS processes are not in the focus of current research, mostly focused on economics. This article aims to fill this research gap by proposing such an ISMS process framework as the main contribution. It is based on a set of agreed upon ISMS processes in existing standards like ISO 27000 series, COBIT and ITIL. Within the framework, identified processes are described and their interaction and interfaces are specified. This framework helps to focus on the operation of the ISMS, instead of focusing on measures and controls. By this, as a main finding, the systemic character of the ISMS consisting of processes and the perception of relevant roles of the ISMS is strengthened.

Information security investment and purchase decision for personalized products

Considering information security and personalization paradoxes, this paper investigates the optimal information security investments of a firm and purchasing decisions of consumers with different privacy concerns in online personalization. It is found that consumers and firm tend to fall into a prisoner's dilemma in Nash equilibrium. To improve security investment efficiency and boost personalization consumption, firm‐led Stackelberg game and firm‐led Stackelberg game with punishment mechanism are proposed and analyzed. The results indicate that the security information measures firm take in advance can effectively increase the waverers' willingness to purchase personalized products. Government punishment helps to facilitate a win‐win situation but does not work when proportion of wavers in the market is very small. Furthermore, the responses of equilibrium strategies and payoffs to related characteristics are discussed numerically. Finally, some managerial insights are recommended to firms who provide personalized products for making proper security investment and to government departments for formulating security punishment policies.

Expanding the Gordon-Loeb model to cyber-insurance

We present an economic model for decisions on competing cyber-security and cyber-insurance investment based on the Gordon-Loeb model for investment in information security. We consider a one-period scenario in which a firm may invest in information security measures to reduce the probability of a breach, in cyber-insurance or in a combination of both. The optimal combination of investment and insurance under the assumptions of the Gordon-Loeb model is investigated via consideration of the costs and benefits of investment in security alongside purchasing insurance at an independent premium rate. Under both exponential (constant absolute risk aversion) and logarithmic (constant relative risk aversion) utility functions it is found that when the insurance premium is below a certain value, utility is maximised with insurance and security investment. These results suggest that cyber-insurance is a worthwhile undertaking provided it is not overly costly. We believe this model to be the first attempt to integrate the Gordon-Loeb model into a classical microeconomic analysis of insurance, particularly using the Gordon-Loeb security breach functions to determine the probability of an insurance claim. The model follows the tradition of the Gordon-Loeb model in being accessible to practitioners and decision makers in information security.

An evolutionary game‐theoretic analysis of enterprise information security investment based on information sharing platform

The threat to enterprise information security is growing through advancing in information and communications technology; in order to enhance the efficiency of information security sharing platform, it is necessary to analyze the process about information security sharing between enterprises that take part in the sharing platform. In this paper, the evolutionary game theory (EGT) is applied to form a better understanding of information security investment based on information sharing platform. The evolution of information sharing and its influencing factors in information security sharing platforms are analyzed. The paper provides some suggestions for promoting the efficiency of platform information sharing.

EFFICIENCY OF THE INDICATORS INVESTMENT CALCULATION METHOD IN THE INFORMATION SECURITY SYSTEM OF INFORMATION OBJECTS

The article analyzes publications on the evaluation of investments in information security (IS) of objects of informatization (OBI). The possibility and necessity of obtaining the necessary data have been substantiated, contributing to a reliable assessment of the effectiveness of measures aimed at increasing the company’s IS. In the study process, the modelling methods have been used. A methodology is proposed for calculating indicators from investment activities in the context of increasing IS metrics of OBI. A specific example of such simulation is described. The proposed methodology provides an assessment of the damage prevention from a cyber-attack. The amount of the damage prevention from a cyber-attack is taken as a basic indicator for calculating the economic effect of investing in information security tools (IST). The performed simulation modelling allowed taking into account the relative uncertainty of the real situation with IS of OBI. The conducted study will help practitioners in the field of IS to obtain informed decisions to increase the efficiency of investment projects in the field of IS for OBI, using the approach outlined in the study. Unlike the existing ones, the proposed methodology takes into account both direct and indirect factors of investment projects in the field of IS of OBI

The financial impacts of information systems security breaches on publicly traded companies: reactions of different sectors

PurposeToday, information systems and technology provides a wide set of tools for companies to increase the efficiency of their businesses. Although technology offers many benefits to businesses, it also brings risks as the information systems security breaches. Security breaches and their financial impact is a constant concern of the researchers and practitioners. This paper explores information systems breaches and their financial impacts on the publicly traded companies in different sectors.Design/methodology/approachAfter a comprehensive data collection process, data from 192 events are analyzed by employing Event Study Methodology and a comparison of the results between the four highly affected sectors (Consumer Goods, Technology, Financial and Communications) is presented. The abnormal returns on the prices of stocks after the events are calculated with the Market Model. Also, the results of the Market Adjusted Model and Mean Adjusted Model are presented to support the results.FindingsWhile information systems security breaches have a significant negative impact on the Financials and the Technology sectors for all the event windows in the study ([−5, 0], [−5, 1], [−5, 5], and [−5, 10]), the significant negative impact is observed only on the [−5, 5] and [−5, 10] event windows for the Consumer Goods sector. No significant negative impact is observed in the Communications sector, in fact, the cumulative abnormal returns are positive for this sector.Originality/valueThe contribution of this paper to provide evidence about the financial impacts of the information systems breaches for businesses in different sectors. While there are studies that have previously focused on the information systems breaches and their financial impacts on businesses, to the best of our knowledge, this is the first study that compares this effect between the four highly impacted sectors. With a relatively larger sample size and broader event windows than the past studies in the literature, statistical evidence is provided to managers to justify their investments in information security and build preventive measures to secure the market value of their firms.

A Virus Propagation Model and Optimal Control Strategy in the Point-to-Group Network to Information Security Investment

Epidemiological dynamics is a vital method in studying the spread of computer network viruses. In this paper, an optimal control measure is proposed based on the SEIR virus propagation model in point-to-group information networks. First, considering the need for antivirus measures in reality, an optimal control problem is introduced, and then a controlled computer virus spread model in point-to-group information networks is established. Second, the optimal control measure is formulated by making a tradeoff between control cost and network loss caused by virus intrusion. Third, optimal control strategies are theoretically investigated by Pontryagin’s maximum principle and the Hamiltonian function. Finally, through numerical simulations, effective measures for controlling virus spread in point-to-group information networks are proposed.