Cybersecurity economics – balancing operational security spending

Abstract

Purpose The purpose of this paper is to demonstrate how to find the optimal investment level in protecting an organisation’s assets. Design/methodology/approach This study integrates a case study of an international financial organisation with various methods and theories in security economics and mathematics, such as value-at-risk (VaR), Monte Carlo simulation, exponential and Poisson probability distributions. Thereby it combines theory and empirical findings to establish a new approach to determining optimal security investment levels. Findings The results indicate that optimal security investment levels can be found through computer simulation with historical incident data to find VaR. By combining various scenarios, the convex graph of the risk cost function has been plotted, where the minimum of the graph represents the optimal invest level for an asset. Research limitations/implications The limitations of the research include a modest number of loss observations from one case study, and the use of normal probability distribution. The approach has limitations where there are no historical data available or the data has zero losses. These areas should undergo further research including larger data set of losses and exploring other probability distributions. Practical implications The results can be used by leading business practitioners to assist them with decision making on investment to the increased protection of an asset. Originality/value The originality of this research is in its new way of combining theories with historical data to create methods to measure theoretical and empirical strength of a control (or set of controls) and translating it to loss probabilities and loss sizes.

Cybersecurity awareness training programs: a cost–benefit analysis framework

“…Researchers from both the industry and academia have developed several useful methods and tools that can help assess a company's level of security, for instance, BitSight (Bannam, 2017), SecurityScorecard (Herath et al ., 2010), Value at Risk (Ekelund and Iskoujina, 2019), Factor Analysis of Information Risk (Freund and Jones, 2014), SAFE (Security Assessment Framework for Enterprise) platform (Lucideus Incorporated, 2020), and Cyber Doppler (Boston Consulting Group, 2019). These methods and tools can be employed to evaluate a company's security level before and after implementing a CSAT program and thus quantify its benefit.…”

“…Prior studies have explored the management of cybersecurity resources from a cost–benefit perspective (e.g. Gordon and Loeb, 2006; Ekelund and Iskoujina, 2019; Gordon et al ., 2020). However, very few of them have analyzed CSAT programs from such an aspect.…”

The severity and effects of Cyber-breaches in SMEs: a machine learning approach

“…Moreover, Couce-Vieira, Insua, and Kosgodagan (2020) pointed out that the impact of breaches not only affects the company but also has implications for its stakeholders, highlighting the importance of knowing how to correctly manage the information transmitted to customers and shareholders. Also, Ekelund and Iskoujina (2019) highlight the responsibility that companies have to their clients and to the administration, which can translate into compensation and associated costs. 8 Therefore, breaches not only have economic, financial and management implications for the company but also the firm's environment can be threatened by its practices, and by how the company manages its cybersecurity.…”

Systematically Understanding Cybersecurity Economics: A Survey

“…Much of the published research on cybersecurity economics has been focused on the economic valuation of the assets and finding the optimal security investment level in organizations to protect those assets [15][16][17][18][19][20][21]. However, cybersecurity economics not only is concerned with whether an organization is spending enough to secure their assets and whether the security budget is spent on the right security measures and controls [22,23], but is also concerned with how a digital ecosystem and its operating agents function and behave. Cybersecurity economics covers the regulatory changes and competitive pressures (e.g., how cybersecurity can be aligned with broader business processes [24]).…”