Abstract:The level of firms' information security investment has recently become a critical issue in the management of IT infrastructure. Prior studies have not considered attack types and firms interconnection simultaneously when investigating the optimisation of such investment. Using game theory, we demonstrate that the optimal security investment level of an interconnected firm against targeted attacks is different from that against opportunistic attacks. Our model shows that not all information security risks are worth fighting against. As the potential loss increases, it is unadvisable to increase the security investment proportionately. Firms should increase investments with intrinsic vulnerability when facing target attacks, but focus on those systems that fall into the midrange of intrinsic vulnerability when facing opportunistic attacks. Firms are unwilling to invest in security and often offload reliability problems onto others when the trusted interdependence relationship becomes tighter in the absence of economic incentives. Thus we also discuss two economic incentives to motivate firms: liability and security information sharing. We find-that if the rules are set properly, both economic incentives are effective to not only internalise the negative externality and improve a firm's security level, but also reduce the total expected cost. We show that firms' optimal investments of liability always increase with the increasing number of firms, but the optimal investments on security information sharing increase only when the number of firms is large enough. These insights draw attention to many trade-offs firms often face and the importance of accurate assessment of firms' security environment. Future research directions are discussed based on the limitations and possible extensions of this study. (C) 2015 Elsevier Ltd. All rights reserved.

Comparing Decision Support Approaches for Cyber Security Investment

Information Security Investment Game with Penalty Parameter

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

A Game-Theoretic Approach for Security Control Selection

Optimizing Investments in Cyber Hygiene for Protecting Healthcare Users

Quantifiable & Comparable Evaluations of Cyber Defensive Capabilities: A Survey & Novel, Unified Approach

Enhancing cybersecurity defenses: a multicriteria decision-making approach to MITRE ATT&CK mitigation strategy

Towards a Cybersecurity Investment Assessment method using Primitive Cognitive Network Process

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

BASCPS: How does behavioral decision making impact the security of cyber-physical systems?

A hybrid dynamic decision making methodology for defensive information technology contingency measure selection in the presence of cyber threats

A Quantal Response Analysis of Human Decision-Making in Interdependent Security Games Modeled by Attack Graphs

Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management

Comparison of Information Security Decisions under Different Security and Business Environments

'Context, Content, Process' Approach to Align Information Security Investments with Overall Organizational Strategy

A logging maturity and decision model for the selection of intrusion detection cyber security solutions

Cyber-Security Investment in the Context of Disruptive Technologies: Extension of the Gordon-Loeb Model

Information security investment prioritization using best-worst method for small and medium enterprises

The best laid plans or lack thereof: Security decision-making of different stakeholder groups

Decision making of optimal investment in information security for complementary enterprises based on game theory

Contrasting the optimal resource allocation to cybersecurity and cyber insurance using prospect theory versus expected utility theory