Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

Abstract

Network interconnection and information sharing among firms and their departments expose them to cybersecurity breaches. Traditional cybersecurity studies have paid little attention to the reallocation of security investment within firms. This paper proposes a mathematical model for optimal allocation of cybersecurity investment among headquarters and branches with budget constraints. The differences in size of information sets and system interconnection have been taken into account. The responses of optimal allocation to internal and external factors, such as the portion of branch information set, the propagation probability, the budget constraints, and the intrinsic vulnerability, have been studied in deep both theoretically and numerically. Analysis results indicate that the group will give priority to protecting headquarters when the total budget is small and intrinsic vulnerability is high. The security investment allocated to each branch increases with budget, propagation probability and portion of information set, but never exceeds 1 / ( n + 1 ) of total budget. Numerical simulations also verify that security information sharing among headquarters and branches can help improve the efficiency of security investment in the whole system. Furthermore, the findings of this paper will draw attention to the reallocation of cybersecurity investment within a business group and help cybersecurity managers to develop investment allocation strategies and policies.

Multicriteria Decision Analysis on Information Security Policy: A Prioritization Approach

“…The result reflects that the DORSU implementation for information security policy is imbalanced. Various literature shows the importance of cultural [11,[23][24][25] and economic aspect [12,16] as the basis on the effective and balances information security policy implementations. The result also shows that information security is a challenging issue in DORSU governance.…”

“…Mostly, the organization focuses on the management and technical aspects of IS [1]. Furthermore, recent studies are giving high emphasis on cultural [11] and economic aspects [12] in the information security. In general, aspects of the information security can be categorized into the technology, management, culture, and economy.…”

Information security investment and purchase decision for personalized products

“…Information security investment is one of the core issues in the area of information economics (Anderson & Moore, 2006). Gordon and Loeb (2002) first developed an economic model to determine the optimal security investments in individual organizations and proposed two classic probability functions of security breach, which has caused extensive attention of researchers (Bandyopadhyay et al, 2010; Huang & Behara, 2013; Li & Xu, 2021; Xu et al, 2019; Zhao et al, 2013). Huang and Behara (2013) analyzed the optimal security investments of risk‐averse decision‐making enterprises, and found that the optimal investment increases with the increase of potential loss but does not exceed it.…”

“…Businesses need to make a tradeoff between information security investments and sales profits of personalized products. Previous studies have adopted the economic and mathematical methods to investigate the optimal security investment from the angle of firms, but ignored the interactions between firm's security strategies and consumers' information disclosure decisions (Feng et al, 2019; Gordon & Loeb, 2002; Hausken, 2006; Huang & Behara, 2013; Nagurney et al, 2017; Simon & Omar, 2020; Xu et al, 2019; Zhao et al, 2013). To model the strategy interactions of multiple decision‐makers, the game theoretic approach is widely applied Huang and Behara (2013), Hausken (2006), Li (2021) and Nagurney et al (2017).…”

Optimal Investment in Cyber-Security under Cyber Insurance for a Multi-Branch Firm

“…This is exactly the problem we tackle here: How should a company jointly optimize security investments and insurance buying when it is composed of multiple branches, and a correlation exists between security accidents at the branches and at the headquarters? Here, we consider the same framework described by Khalili et al (2018) and Xu et al (2019), where the vulnerability of the headquarters is influenced by the characteristics and behavior of the branches, i.e., by their intrinsic vulnerability and their risk management choices, but not vice versa.…”