Expected benefits of information security investments

A Quantitative Model for Information-Security Risk Management

“…It uses survivor and failure functions, but since the available data are censored and therefore biased, the quality of the results is questionable. For this reason, Ryan and Ryan (2006) introduce the Kaplan-Meier and Nelson-Aalen estimators that can be used instead. The basic assumption is that an investment in security reduces the risk of successful attacks.…”

“…Willemson (2006), however, emphasizes that the suggested upper limit of the model may not be correct when the model is applied to the general case and to all possible vulnerability functions. Ryan and Ryan (2006) view security as an inversion of the risk and establish a quantitative approach to measure the gains in security through expected-loss risk measurements. The approach of basing an investment decision on the expected loss is suggested by Gordon and Loeb (2002), and the rule of thumb is that a positive expected net benefit is an attractive investment.…”

A Holistic View on Organizational IT Security: The Influence of Contextual Aspects During IT Security Decisions

“…Evidently, most studies largely focus on economic aspects of IT security decisions by proposing a valueat-risk or return on (security) investment approach (ROSI) [e.g., [33][34][35]. This is also reflected by the slight surplus of predominantly normative studies (56%) based on mathematical modelling (64% proportionately) [2,6,10,33,34,[36][37][38][39][40][41][42][43][44][45][46][47][48][49][50][51][52][53][54]. Whereas two studies pursue a purely qualitative approach [20,55] and six are purely conceptual [56][57][58][59][60][61], eleven studies employ a combination of several approaches [4,14,33,35,37,39,40,41,48,51,62] and three are based on panel data [3,…”

“…The investment nuances that are most often considered in these specific investment studies, but also in publications that pursue a more generic approach, are the specific area or content and the optimal level of investment [4,10,33,34,47,53,56,60,62]. Only a single study is dedicated towards to the decision regarding the source or origin of the investment [48] and a total of six studies consider the fundamental decision whether to invest at all [31,38,44,47,54,55].…”

Evaluation of Information Systems Security Awareness in Higher Education: An Empirical Study of Kuwait University

“…Gerber and Solms (2001) have stated that ensuring the availability of the required information at the right time is extremely important, because when the organization cannot get the information at the right time, it may not be able to perform the required operations effectively, which leads to the loss of the chance of gaining the competitive advantage over the others. According to Ryan and Ryan (2006), any one of integrity, confidentiality or availability, security objectives regarding information resources, can be compromised by illicit access even if the other two security objectives are preserved.…”