Abstract:Cyber-security breaches inflict significant costs on organizations. Hence, the development of an information-systems defense capability through cyber-security investment is a prerequisite. The question of how to determine the optimal amount to invest in cyber-security has been widely investigated in the literature. In this respect, the Gordon-Loeb model and its extensions received wide-scale acceptance. However, such models predominantly rely on restrictive assumptions that are not adapted for analyzing dynamic aspects of cyber-security investment. Yet, understanding such dynamic aspects is a key feature for studying cyber-security investment in the context of a fast-paced and continuously evolving technological landscape. We propose an extension of the Gordon-Loeb model by considering multi-period and relaxing the assumption of a continuous security-breach probability function. Such theoretical adaptations enable to capture dynamic aspects of cyber-security investment such as the advent of a disruptive technology and its investment consequences. Such a proposed extension of the Gordon-Loeb model gives room for a hypothetical decrease of the optimal level of cyber-security investment, due to a potential technological shift. While we believe our framework should be generalizable across the cyber-security milieu, we illustrate our approach in the context of critical-infrastructure protection, where security-cost reductions related to risk events are of paramount importance as potential losses reach unaffordable proportions. Moreover, despite the fact that some technologies are considered as disruptive and thus promising for critical-infrastructure protection, their effects on cyber-security investment have been discussed little.

Decision making of optimal investment in information security for complementary enterprises based on game theory

Information Security Investment Game with Penalty Parameter

The Equilibrium Analysis of Organization Information Security Investment Game

Information Security Problem Research Based on Game Theory

Information Security Game Analysis with Penalty Parameter

Information security investment with budget constraint and security information sharing in resource-sharing environments

A game-theoretic analysis of information security investment for multiple firms in a network

Knowledge sharing and investment decisions in information security

Stackelberg Interdependent Security Game in Distributed and Hierarchical Cyber-Physical Systems

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Information security investment for complementary and substitutable firms: The role of technology similarity

Information Security Investment with Different Information Types: A Two-Firm Analysis.

Game analysis of enterprise safety investment and employee safety behavior strategy evolution in high-risk industries

Dynamic Competition in It Security: A Differential Games Approach

Cyber-Security Investment in the Context of Disruptive Technologies: Extension of the Gordon-Loeb Model

Comparing Decision Support Approaches for Cyber Security Investment

Protecting shared information in networks: a network security game with strategic attacks

Economics of Information Security Investment Integrated with IDS and Attacker’s Behavior

Computing Optimal Security Strategies for Interdependent Assets

Attack–Defense Game Model with Multi-Type Attackers Considering Information Dilemma

Application of hybrid strategies of complex network attack and defense games