Decision-Theoretic and Game-Theoretic Approaches to IT Security Investment.

Author List: Cavusoglu, Huseyin; Raghunathan, Srinivasan; Yue, Wei T.;

Journal of Management Information Systems, 2008, Volume 25, Issue 2, Page 281-304.

Firms have been increasing their information technology (IT) security budgets significantly to deal with increased security threats. An examination of current practices reveals that managers view security investment as any other and use traditional decision-theoretic risk management techniques to determine security investments. We argue in this paper that this method is incomplete because of the problem's strategic nature--hackers alter their hacking strategies in response to a firm's investment strategies. We propose game theory for determining IT security investment levels and compare game theory and decision theory approaches on several dimensions such as the investment levels, vulnerability, and payoff from investments. We show that the sequential game results in the maximum payoff to the firm, but requires that the firm move first before the hacker. Even if a simultaneous game is played, the firm enjoys a higher payoff than that in the decision theory approach, except when the firm's estimate of the hacker effort in the decision theory approach is sufficiently close to the actual hacker effort. We also show that if the firm learns from prior observations of hacker effort and uses these to estimate future hacker effort in the decision theory approach, then the gap between the results of decision theory and game theory approaches diminishes over time. The rate of convergence and the extent of loss the firm suffers before convergence depend on the learning model employed by the firm to estimate hacker effort.

Keywords: decision theory;game theory;IT security investments

Algorithm:

List of Topics

#271	0.194	technology investments investment information firm firms profitability value performance impact data higher evidence diversification industry payoff return findings decisions greater
#48	0.145	dimensions electronic multidimensional game transactions relative contrast channels theory sustained model predict dimension mixture evolutionary results unique traditional likely finite
#187	0.138	learning model optimal rate hand domain effort increasing curve result experts explicit strategies estimate acquire learn referral observational skills activities
#44	0.106	approach analysis application approaches new used paper methodology simulation traditional techniques systems process based using proposed method present provides various
#73	0.094	security threat information users detection coping configuration avoidance response firm malicious attack intrusion appraisal countermeasures benefit costs threats ability rate
#8	0.074	decision making decisions decision-making makers use quality improve performance managers process better results time managerial task significantly help indicate maker
#56	0.071	information security interview threats attacks theory fear vulnerability visibility president vulnerabilities pmt behaviors enforcement appeals protection insiders attackers precautions vice