Economics of IT Security Management: Four Improvements to Current Security Practices

Abstract

The importance of effective management of IT security from an economic perspective increased in recent years because of the increasing frequency and cost of security breaches. Each security breach incurs monetary damage, corporate liability, and loss of credibility. This article presents four important elements that every IT security manager should consider while managing the security function from an economic perspective. The four elements are: estimation of security breach cost, a risk management approach, cost effective technology configuration, and value from deployment of multiple technologies.

An analysis on effects of information security investments: a BSC perspective

“…Al-Humaigani and Dunn (2003), Tsiakis and Stephanides (2005), Hausken (2006), and Davis (2005) also defined economic assessments of information security investment with ROSI and other methods; they approached the correlation between the investment cost and effect of information security with mathematical modeling. Blatchford (1995), Lee (2003), and Cavusoglu et al (2002Cavusoglu et al ( , 2004a categorized various factors that need to be considered during information security investment. Bodin et al (2005) and Scott (1998) also suggested investment criteria for information security and mentioned that as information security investment in general has the characteristic of a long-term guarantee while reducing long-term risk, in many instances it does not provide a quantitative investment effect in the short term.…”

Culture Matters: Factors Affecting the Adoption of Telemedicine

“…Threats related to information security are a major concern for many organizations since these risks may increase their liability and decrease their credibility [15]. The core difference between telemedicine and traditional healthcare is the use of the Internet, and therefore, online patient information security, privacy, and policies are of paramount concern.…”

Making Sound Security Investment Decisions

“…They found that economic concepts, such as NPV and cost-benefit analysis, are beginning to gain acceptance from senior information security managers in budgeting for information security expenditures. It was also argued that economic analysis can be improved when the decision-makers consider intangible and long-term costs of security breaches, and actions of adversaries when they make their investment decisions (Cawsoglu et al, 2004a).…”

“…In fact, organizations balance the costs of managing the risk against the negative consequences of the risk materializing and the potential gains that the organization would enjoy indirectly when the risk is eliminated or reduced. Since organizations spend about 15 cents out of every IT dollar on security (Berinato, 2007), decision-makers are increasingly pressured to get these trade-offs right (Cavusoglu et al, 2004a). …”