Fixed Costs, Investment Rigidities, and Risk Aversion in Information Security: A Utility-theoretic Approach

Abstract

This paper addresses the question of determining the optimal timing of interventions in information security management. Using utility theory, we derive the limiting condition under which, given a potential or realized risk, a decision to invest, delay, or abandon can be justified. Our primary focus is on the decision to defer costly deterministic investments, such as the removal of a service or implementation of a security patch, when the costs associated with future security vulnerabilities are uncertain. We outline an investment function with irreversible fixed costs that introduces a rigidity into the investment decision-making profile. This rigidity introduces delay in the implementation of security measures, resulting in cyclical investments in information security, as the decision-maker determines the optimal investment horizon. We therefore show that cycles emerge endogenously given the policy-maker's chosen trade-offs between investment and the deterioration of the system attributes.

Contagion in cyber security attacks

“…The parameters of interest are, therefore, represented by the estimates of λ ∞ that are indicative of the existence of jumps. Contagion is captured by the elements of the contagion matrix (13). All of the statistical results that are presented in the tables below are statistically significant at 5%.…”

“…The critical tipping point for additional investment occurs when L K (t, T ) = L CS (t, T ). Similar models and conditions have been given in [11,12,13].…”

“…Following [13], building on [12,11], the system of equations can be uniquely characterized by the stochastic process driving threats:…”

Compositional Security Modelling

“…This use of multi-attribute utility theory (see [16] for a detailed account) has been employed as a tool for reasoning in a range of security settings; for example, [12,14].…”

“…Our hypothesis, supported by a body of exploratory (e.g., [1,2]) and theoretical (e.g., [13,14]) work, is that a specific combination of mathematical systems modelling of the structure and dynamics of organizations and their behaviour and economic modelling of their security policy design and decision-making can deliver a framework within which the consequences of security policy and technology co-design decisions can be predicted and explored experimentally. The security systems of interest are often complex assemblies of agents, be they software or human, policies, and technology.…”