Abstract:The level of firms' information security investment has recently become a critical issue in the management of IT infrastructure. Prior studies have not considered attack types and firms interconnection simultaneously when investigating the optimisation of such investment. Using game theory, we demonstrate that the optimal security investment level of an interconnected firm against targeted attacks is different from that against opportunistic attacks. Our model shows that not all information security risks are worth fighting against. As the potential loss increases, it is unadvisable to increase the security investment proportionately. Firms should increase investments with intrinsic vulnerability when facing target attacks, but focus on those systems that fall into the midrange of intrinsic vulnerability when facing opportunistic attacks. Firms are unwilling to invest in security and often offload reliability problems onto others when the trusted interdependence relationship becomes tighter in the absence of economic incentives. Thus we also discuss two economic incentives to motivate firms: liability and security information sharing. We find-that if the rules are set properly, both economic incentives are effective to not only internalise the negative externality and improve a firm's security level, but also reduce the total expected cost. We show that firms' optimal investments of liability always increase with the increasing number of firms, but the optimal investments on security information sharing increase only when the number of firms is large enough. These insights draw attention to many trade-offs firms often face and the importance of accurate assessment of firms' security environment. Future research directions are discussed based on the limitations and possible extensions of this study. (C) 2015 Elsevier Ltd. All rights reserved.

Research on the Game of Information Security Investment Based on the Gordon-Loeb Model

The Equilibrium Analysis of Organization Information Security Investment Game

Information Security Investment Game with Penalty Parameter

Information Security Problem Research Based on Game Theory

Optimal information security investment analyses with the consideration of the benefits of investment and using evolutionary game theory

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

Information Security Game Analysis with Penalty Parameter

Decision making of optimal investment in information security for complementary enterprises based on game theory

An Analysis of Games of Information Security Investment Based on Interdependent Security

Research on Information Security Cost Based on Game-Theory

A game-theoretic analysis of information security investment for multiple firms in a network

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Information security investment with budget constraint and security information sharing in resource-sharing environments

Adaptive Model of Information Security Technique Investment

Research on Decision of Cyber Security Investment Based on Evolutionary Game Model

Cyber-Security Investment in the Context of Disruptive Technologies: Extension of the Gordon-Loeb Model

Economics of Information Security Investment Integrated with IDS and Attacker’s Behavior

Evolutionary Dynamics of the Interdependent Security Games on Complex Network.

Knowledge sharing and investment decisions in information security

Comparison of Information Security Decisions under Different Security and Business Environments

How bad are selfish investments in network security?