The economics of information security investment

Reviewer: Melissa C. Stange

A practical approach is presented in this paper for determining the investment requirements necessary for information protection. The model used is explained in detail throughout the 18 pages of the paper. Gordon and Loeb's detailed approach, which includes textual explanations, formulas, graphics, and proofs, is excellent for clarifying the subject matter. The authors even take the extra step of including a discussion of which areas their research model does not address. These areas include perverse economic incentives affecting investment, dynamic issues, and game theoretic aspects. The paper is clearly written. It is organized into four sections, which easily flow from one to the next. The authors present analyses for a broad class of security breach probability functions; optimal security spending is presented as an increasing function of vulnerability level. The paper also provides a strong conceptual foundation in explaining why current research has fallen short in this area; the focus of research in information security has mainly been on technical issues. This useful and thought provoking model paper will not only be interesting to technical security professionals, but will also provide excellent reading for anyone faced with the task of developing a budget for information security. The most interesting thing I found in the paper was the fact that the model showed that management should be concentrating on midrange vulnerabilities, instead of on the high end. This is very important to current practice, in that most security teams do concentrate on the high end. Gordon and Loeb make a good recommendation to security teams, suggesting that all information be split into security breach vulnerability sets (low, middle, and high), and the sets then be defended moderately, instead of devoting all resources to one set. I recommend this paper highly to students, researchers, and information managers. Online Computing Reviews Service

Reviewer: Roxanne B. Everetts

Gordon and Loeb report on a model that they have developed to evaluate how much information security is needed to protect data assets, and to determine the optimal investment, given the value of the assets and their vulnerability. The authors argue that contrary to current best practices (which dictate that the more value attached to an asset, the greater the investment needed to protect it), the optimal information security investment does not always increase proportionately to increases in vulnerability; there is a point at which it is not in the best interest of a firm to make increasingly larger investments in information security. Gordon and Loeb’s findings indicate that investments in information security should not exceed 37 percent of the expected loss in the event of a breach. This finding offers an economic model for information security investment decisions. The authors observe correctly that the field of information security is currently drawing a great deal of attention. However, the focus of much of current research is on technical issues (how to make systems harder to breach), or on behavior (how to make people interact with systems in a manner that does not increase their vulnerabilities). There is little written to assist with determining the optimal level of investment, to help organizations determine how much it should cost to protect their information. The paper presents the authors’ model in scholarly fashion, and provides excellent dialogue to walk the reader through the proofs and propositions they have developed to support it. The arguments are well presented and clearly documented. Gordon and Loeb clearly identify the limitations of their research and the assumptions made in constructing their initial model. The references cited are mostly current, and reflect a wide range of inquiry into the field. The length of the paper is appropriate for the material presented. In layman’s terms, what Gordon and Loeb are arguing is that the law of diminishing returns applies to information security. It is not acceptable to continue to believe that if you throw endless amounts of money at a problem, you will have a solution. It is long past time that our field accepted this reality, and changed its focus accordingly. This work represents forward-looking thinking. It should be recognized as a valuable contribution to current research in the information security field. Online Computing Reviews Service

Reviewer: Lee Imrey

Gordon and Loeb's paper is well timed. As businesses suffer from the economic uncertainties of the 21st century, management is looking for ways to contain costs while continuing to meet fiduciary responsibilities. This requires companies to spend "enough" to protect their information assets, but no more than that. Unfortunately, we lack clear guidance on how much is "enough." Many auditing and vulnerability assessment teams approach information security from a technical perspective, and perform a "binary analysis" of security measures: "Do you have a firewall or not__?__" "Are you running a host-based IDS or not__?__" This approach generates a compendium of vulnerabilities, sometimes includes suggested countermeasures, but ultimately fails to address the business perspective, which must balance expected risk with cost of mitigation. In some cases, the most effective business decision may be to accept a risk, rather than mitigate it. Gordon and Loeb recognize this gap between the business perspective and the technical viewpoint, and have made a creditable first step to bridge it. Through applying the techniques of economic analysis to information security investment, they bring quantitative precision to what has been a more qualitative process of risk management. According to their mathematical analysis, optimal investments in information security rise with the vulnerability of information, but in some cases reach a point of diminishing return. This is intuitively known to all who have worked in the industry for any period of time, but Gordon and Loeb's paper provides definitive support for this view, which may be more effective in business impact analyses than intuition, however justified. The authors recognize that the model they use represents a simplification for most businesses, perhaps even an over-simplification, but correctly state that their work represents a starting point for further research into more complex models of information security investment, and into means to determine the optimal allocation of resources. Overall, I recommend this paper to those whose job requires budgeting for the protection of information. Online Computing Reviews Service