Abstract:The level of firms' information security investment has recently become a critical issue in the management of IT infrastructure. Prior studies have not considered attack types and firms interconnection simultaneously when investigating the optimisation of such investment. Using game theory, we demonstrate that the optimal security investment level of an interconnected firm against targeted attacks is different from that against opportunistic attacks. Our model shows that not all information security risks are worth fighting against. As the potential loss increases, it is unadvisable to increase the security investment proportionately. Firms should increase investments with intrinsic vulnerability when facing target attacks, but focus on those systems that fall into the midrange of intrinsic vulnerability when facing opportunistic attacks. Firms are unwilling to invest in security and often offload reliability problems onto others when the trusted interdependence relationship becomes tighter in the absence of economic incentives. Thus we also discuss two economic incentives to motivate firms: liability and security information sharing. We find-that if the rules are set properly, both economic incentives are effective to not only internalise the negative externality and improve a firm's security level, but also reduce the total expected cost. We show that firms' optimal investments of liability always increase with the increasing number of firms, but the optimal investments on security information sharing increase only when the number of firms is large enough. These insights draw attention to many trade-offs firms often face and the importance of accurate assessment of firms' security environment. Future research directions are discussed based on the limitations and possible extensions of this study. (C) 2015 Elsevier Ltd. All rights reserved.

An Analysis of Games of Information Security Investment Based on Interdependent Security

The Equilibrium Analysis of Organization Information Security Investment Game

Information Security Investment Game with Penalty Parameter

Information Security Problem Research Based on Game Theory

Information Security Game Analysis with Penalty Parameter

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

A game-theoretic analysis of information security investment for multiple firms in a network

Information security investment with budget constraint and security information sharing in resource-sharing environments

Evolutionary Dynamics of the Interdependent Security Games on Complex Network.

Research on Information Security Cost Based on Game-Theory

Decision making of optimal investment in information security for complementary enterprises based on game theory

Research on the Game of Information Security Investment Based on the Gordon-Loeb Model

Optimal information security investment analyses with the consideration of the benefits of investment and using evolutionary game theory

Stackelberg Interdependent Security Game in Distributed and Hierarchical Cyber-Physical Systems

Adaptive Model of Information Security Technique Investment

Information Security Investment with Different Information Types: A Two-Firm Analysis.

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Knowledge sharing and investment decisions in information security

Information security investment for complementary and substitutable firms: The role of technology similarity

How bad are selfish investments in network security?

Research on Decision of Cyber Security Investment Based on Evolutionary Game Model