Investing in Cybersecurity: Insights from the Gordon-Loeb Model

Abstract

Given the importance of cybersecurity to the survival of an organization, a fundamental economics-based question that must be addressed by all organizations is: How much should be invested in cybersecurity related activities? Gordon and Loeb [1] presented a model to address this question, and that model has received a significant amount of attention in the academic and practitioner literature. The primary objective of this paper is to discuss the Gordon-Loeb Model with a focus on gaining insights for the model's use in a practical setting.

A multicriterial analysis of the efficiency of conservative information security systems

“…A general economic model for the dependence of mathematical expectation of conditionally saved funds on the magnitude of investment in information security, the expected net benefits from an investment in information security (ENBIS), was proposed in paper [9]. This model underlies a series of works whose results are generalized in study [10].…”

Empirical Evidence on the Determinants of Cybersecurity Investments in Private Sector Firms

“…The GL Model is based on the fundamental economic principle of cost-benefit analysis and is grounded in mathematics [25]. However, the GL Model provides a basic framework for deriving a firm's level of spending on cybersecurity activities that can be utilized without sophisticated mathematics (e.g., see [26]). In 2017, a report by the U. S. Better Business Bureau addressing issues related to cybersecurity investments in small businesses recommended the GL Model as a framework that "…provides a useful guide for organizations trying to find the right level of cybersecurity investment" ( [27], p. 20).…”

“…For a more detailed analysis of how to implement the GL Model, including an example, see [26]. A three-minute YouTube Video explaining the general nature of the Model, including the four steps discussed below can be found at: https://www.youtube.com/watch?v=cd8dT0FuqQ4.…”

Robustness of Optimal Investment Decisions in Mixed Insurance/Investment Cyber Risk Management

“…In Huang and Behara (2013), a model with the same mathematical shape as that proposed in that seminal paper has also been derived for concurrent heterogeneous attacks through the theory of scale-free networks. Indications to use the GL model in a practical setting have been provided in the papers by Gordon, Loeb, and Zhou (2016) and Naldi and Flamini (2017). The GL model has been extended by Gordon, Loeb, Lucyshyn, and Zhou (2014) and Farrow and Szanton (2016) to cater for externalities.…”