A Value-at-Risk Approach to Information Security Investment.

Author List: Wang, Jingguo; Chaudhury, Aby; Rao, H. Raghav;

Information Systems Research, 2008, Volume 19, Issue 1, Page 106-120.

Information security investment has been getting increasing attention in recent years. Various methods have been proposed to determine the effective level of security investment. However, traditional expected value methods (such as annual loss expectancy) cannot fully characterize the information security risk confronted by organizations, considering some extremal yet perhaps relatively rare cases in which a security failure may be critical and cause high losses. In this research note we introduce the concept of value-at-risk to measure the risk of daily losses an organization faces due to security exploits and use extreme value analysis to quantitatively estimate the value at risk. We collect a set of internal daily activity data from a large financial institution in the northeast United States and then simulate its daily losses with information based on data snapshots and interviews with security managers at the institution. We illustrate our methods using these simulated daily losses. With this approach, decision makers can make a proper investment choice based on their own risk preference instead of pursuing a solution that minimizes only the expected cost.

Keywords: extreme value analysis; information assurance; security investment; value-at-risk (VaR)

Algorithm:

List of Topics

#264	0.209	risk risks management associated managing financial appropriate losses expected future literature reduce loss approach alternative mitigate failures failure cause mitigation
#86	0.152	methods information systems approach using method requirements used use developed effective develop determining research determine assessment useful series critical existing
#271	0.116	technology investments investment information firm firms profitability value performance impact data higher evidence diversification industry payoff return findings decisions greater
#182	0.110	percent sales average economic growth increasing total using number million percentage evidence analyze approximately does business flow annual book daily
#186	0.107	security information compliance policy organizations breach disclosure policies deterrence breaches incidents results study abuse managed isp violations based comply protection
#44	0.086	approach analysis application approaches new used paper methodology simulation traditional techniques systems process based using proposed method present provides various
#81	0.062	applications application reasoning approach cases support hypertext case-based prototype problems consistency developed benchmarking described efficient practical address activity demonstrate effective