Determining the value of information security investments: A decision support system

Hannah Louise Davies*, Andrew J C Blyth

*Awdur cyfatebol y gwaith hwn

Allbwn ymchwil: Pennod mewn Llyfr/Adroddiad/Trafodion CynhadleddCyfraniad i gynhadleddadolygiad gan gymheiriaid

Crynodeb

Advances in the technological era are making information security breaches a more common occurrence. A vital part of ensuring an organisation is well protected from these increasingly complex threats is a suitable security solution. Suitability of a security solution should not only be measured in terms of goals such as reducing down time or reducing the risk of a certain threat, but also meet stakeholder and executive goals in terms of being cost effective. Currently, cost effective is determined by calculating a return on security investment calculation, where the cost of a solution is evaluated against any savings resulting after purchasing the solution to determine whether the option is viable. The current implementation of return on security investment calculations however is often subjective and inaccurate as calculations are performed in an ad-hoc manner. When there are multiple factors to consider, with uncertain or incomplete values available, a multi-attribute decision making method that utilises uncertainty is required in order to allow the decision maker to assess all possible options in the most logical and objective manner, whilst keeping in mind the goals of the organisation. In this paper we present and evaluate a conceptual, analytical framework that, with the use of multi-attribute utility theory under uncertainty, is able to model return on security investment calculations in a novel way. This new calculation is introduced as a Value of Information Security Investment calculation. The final goal is to create a framework that allows for repeatable, predictable and mature, calculations that determine the value of an information security investment.

Iaith wreiddiolSaesneg
TeitlKMIS 2014 - Proceedings of the International Conference on Knowledge Management and Information Sharing
CyhoeddwrINSTICC Press
Tudalennau426-433
Nifer y tudalennau8
ISBN (Electronig)9789897580505
StatwsCyhoeddwyd - 2014
Digwyddiad6th International Conference on Knowledge Management and Information Sharing, KMIS 2014 - Rome, Yr Eidal
Hyd: 21 Oct 201424 Oct 2014

Cynhadledd

Cynhadledd6th International Conference on Knowledge Management and Information Sharing, KMIS 2014
Gwlad/TiriogaethYr Eidal
DinasRome
Cyfnod21/10/1424/10/14

Ôl bys

Gweld gwybodaeth am bynciau ymchwil 'Determining the value of information security investments: A decision support system'. Gyda’i gilydd, maen nhw’n ffurfio ôl bys unigryw.

Dyfynnu hyn