Optimizing investment decisions in selecting information security remedies

Abstract

Purpose -This paper proposes a new framework for optimizing investment decisions when deciding about information security remedies. Design/methodology/approach -The framework assumes that the organization is aware of a set of remedies that can be employed to address end-effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end-effect. Given the two sets of costs, that of the end-effect and the potential damage it can cause and that of the remedy and the required level of protection from each end-effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization. Findings -The paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation. Practical implications -Concentrating on end-effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events. Originality/value -This research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security.

A game-theoretic analysis of information security investment for multiple firms in a network

“…Based on given data center network topology, Wang et al (2011) recommended a probability-based model for calculating the probability of insecurity of each protected resource and the optimal investment on each security protection device. Shirtz and Elovici (2011) put forward a new framework to optimize the information security investment strategies when facing with various security measures and found that a higher investment level did not assure a higher security level. Eisenga et al (2012) made an analysis on different practices and techniques which were used to calculate the investments in IT security.…”

A Markov Model for Optimization of Information Security Remedies

“…Отсев частичных решений, которые не могут быть достроены ни до допустимых, ни до оптимальных, осуществляется набором элиминирующих тестов В настоящей статье мы рассмотрели одну из возможных формулировок задачи оптимального выбора средств защиты информации, основанную на марковской модели киберугроз. В отличие от общепринятых подходов [2,9], где множество решений ограничивается допустимыми показателями экономического ущерба, мы задаем соответствующее ограничение с помощью функционально-временной характеристики системы, называемой нами средним временем ее жизни. В силу того что поставленная нами задача принадлежит к классу задач нелинейного целочисленного программирования, не существует универсальных методов для ее эффективного решения.…”

“…Математически постановка задачи выбора оптимального набора из заданного множества средств защиты может формулироваться в рамках различных моделей. Обзор современных популярных подходов к подобным формулировкам можно найти в работе [2]. Среди наиболее часто используемых следует выделить группу подходов, основанных на теоретических моделях оценки инвестиций в информационную безопасность [3,4,5], а также серию подходов, основанную на теории игр [6,7,8].…”

Managing the investment in information security technology by use of a quantitative modeling

“…In that context the past decade has introduced a more complex view of information-security management and risk assessment. Among the new approaches introduced in this field is compliance with the regulations and standards such as the ISO 27000 series and NIST publications (ISO, 2005) in addition to the demands for a justification of information-security budgets and for the support of organizational goals, while maintaining an appropriate level of security in a particular organization (Shirtz & Elovici, 2011). Meeting these requirements entails a complicated process of decision making and the selection of the best security measures and its implementation.…”