The impact of information sharing on cybersecurity underinvestment: A real options perspective

Gordon, Lawrence A.; Loeb, Martin P.; Lucyshyn, William; Zhou, Lei

doi:10.1016/j.jaccpubpol.2015.05.001

Cited by 82 publications

(50 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It does not consider supplemental or tangential papers published on this topic. Notably, Gordon et al (2015) extend the ROT approach with the aspect of sharing cybersecurity related information among firms, thus addressing some of the reported challenges on this approach (such as difficulties predicting threat timing/occurrence and key parameters needing to be estimated or simulated based on historical data).…”

Section: Results Review Question (4) and (5)mentioning

confidence: 99%

“…Hausken (2006b) analyses different classes of information security breach functions in order to examine the robustness of the Gordon-Loeb model, which is recognised in this paper under the Utility Maximization approach. Gordon et al (2015) extends the ROT approach by assessing the impact of information sharing at the example of a firm deciding on security investment timing. The authors find that sharing reduces a firm's uncertainty concerning a cybersecurity investment and decreases the value of the deferment option associated with the investment.…”

Section: Figure 3 -Primary Studies By Categorymentioning

confidence: 99%

“…In this section, we complement the SLR results by capturing the wider perspective to provide a more comprehensive view of the topic. Gordon et al (2015) emphasises the importance for firms to understand the process by which they can derive the most efficient allocation of their cybersecurity-related resources. This is now an widely accepted challenge and research on options to understand and address this gap is well underway (Gordon et al, 2003, Hausken, 2007, Dengpan et al, 2011.…”

Section: The Wider Perspectivementioning

confidence: 99%

See 2 more Smart Citations

Economic valuation for information security investment: a systematic literature review

Schatz

Bashroush

2016

Inf Syst Front

View full text Add to dashboard Cite

-Research on technological aspects of information security risk is a well-established area and familiar territory for most information security professionals. The same cannot be said about the economic value of information security investments in organisations. While there is an emerging research base investigating suitable approaches measuring the value of investments in information security, it remains difficult for practitioners to identify key approaches in current research. To address this issue, we conducted a systematic literature review on approaches used to evaluate investments in information security. Following a defined review protocol, we searched several databases for relevant primary studies and extracted key details from the identified studies to answer our research questions. The contributions of this work include: a comparison framework and a catalogue of existing approaches and trends that would help researchers and practitioners navigate existing work; categorisation and mapping of approaches according to their key elements and components; and a summary of key challenges and benefits of existing work, which should help focus future research efforts.

show abstract

Section: Results Review Question (4) and (5)mentioning

confidence: 99%

Section: Figure 3 -Primary Studies By Categorymentioning

confidence: 99%

Section: The Wider Perspectivementioning

confidence: 99%

See 1 more Smart Citation

Economic valuation for information security investment: a systematic literature review

Schatz

Bashroush

2016

Inf Syst Front

View full text Add to dashboard Cite

show abstract

“…This new kind of economy has created a business model that is characterized by large quantities of information being instantaneously transmitted through cyberspace and stored in a variety of electronic devices. 15 Although the interconnected digital world has resulted in many benefits to businesses, as well as individuals, a downside of this new way of operating and interacting with one and other has been the rapid growth of cybersecurity breaches. Unfortunately, no organization is immune to potential cybersecurity breaches.…”

Section: Concluding Commentsmentioning

confidence: 99%

“…Although we did not carry out the example to the point where one would not wish to invest more for those information sets, one can easily carry out the example to verify that one would want to invest less 37% of the expected loss for those sets as well. 15 The term cyberspace refers to the environment where digital communication, especially via the Internet and other computer networks, takes place. 16 For a 3-minute-and-34 second YouTube video providing a succinct overview of the Gordon-Loeb Model, see: https://www.youtube.com/watch?v=cd8dT0FuqQ4.…”

Section: Concluding Commentsmentioning

confidence: 99%

Investing in Cybersecurity: Insights from the Gordon-Loeb Model

Gordon¹,

Loeb²,

Zhou³

2016

JIS

Self Cite

View full text Add to dashboard Cite

Given the importance of cybersecurity to the survival of an organization, a fundamental economics-based question that must be addressed by all organizations is: How much should be invested in cybersecurity related activities? Gordon and Loeb [1] presented a model to address this question, and that model has received a significant amount of attention in the academic and practitioner literature. The primary objective of this paper is to discuss the Gordon-Loeb Model with a focus on gaining insights for the model's use in a practical setting.

show abstract

Threat intelligence platform for the energy sector

Wróbel

2019

Softw Pract Exp

View full text Add to dashboard Cite

In recent years, critical infrastructures and power systems in particular have been subjected to sophisticated cyberthreats, including targeted attacks and advanced persistent threats. A promising response to this challenging situation is building up enhanced threat intelligence (TI) that interlinks information sharing and fine-grained situation awareness. In this paper, a framework that integrates all levels of TI, ie, strategic, tactical, operational, and technical, is presented. The platform implements the centralized model of information exchange with peer-to-peer interactions between partners as an option. Several supportive solutions were introduced, including anonymity mechanisms or data processing and correlation algorithms. A data model that enables communication of cyberincident information, both in natural language and machine-readable formats, was defined. Similarly, security requirements for critical components were devised. A pilot implementation of the platform was developed and deployed in the operational environment, which enabled practical evaluation of the design. Also, the security of the anonymity architecture was analyzed.

show abstract

The impact of information sharing on cybersecurity underinvestment: A real options perspective

Cited by 82 publications

References 27 publications

Economic valuation for information security investment: a systematic literature review

Economic valuation for information security investment: a systematic literature review

Investing in Cybersecurity: Insights from the Gordon-Loeb Model

Threat intelligence platform for the energy sector

Contact Info

Product

Resources

About