Towards a standard approach for quantifying an ICT security investment

Authors:
Rok Bojanc;Borka Jerman-Blaič
Affiliations:
Institute Joef Stefan, Jamova 39, Ljubljana and University of Ljubljana, Faculty of Economics, Ljubljana, Slovenia;Institute Joef Stefan, Jamova 39, Ljubljana and University of Ljubljana, Faculty of Economics, Ljubljana, Slovenia
Venue:
Computer Standards & Interfaces
Year:
2008

Citing 4
Cited 6

The economics of information security investment

ACM Transactions on Information and System Security (TISSEC)
Why Information Security is Hard-An Economic Perspective

ACSAC '01 Proceedings of the 17th Annual Computer Security Applications Conference
The economic cost of publicly announced information security breaches: empirical evidence from the stock market

Journal of Computer Security - IFIP 2000
A model for evaluating IT security investments

Communications of the ACM - Has the Internet become indispensable?

Fuzzy economic decision-models for information security investment

IMCAS'10 Proceedings of the 9th WSEAS international conference on Instrumentation, measurement, circuits and systems
Information security investment decision-making based on fuzzy economics

WSEAS TRANSACTIONS on SYSTEMS
A web-based multi-perspective decision support system for information security planning

Decision Support Systems
Firms' information security investment decisions: Stock market evidence of investors' behavior

Decision Support Systems
Information technology standards: a viable solution to reach the performance

NNECFSIC'12 Proceedings of the 12th WSEAS international conference on Neural networks, fuzzy systems, evolutionary computing & automation
Managing the investment in information security technology by use of a quantitative modeling

Information Processing and Management: an International Journal

Quantified Score

Hi-index	0.00

Visualization

Abstract

The rise of the potential risks from different attacks on ICT systems means the investment in security technology is growing and is becoming a serious economic issue for many organizations. The assessment of the appropriate investment that is economically affordable and provides enough protection for the enterprise information system is an issue that is analysed here. The paper discusses the identification of the assets, the threats, the vulnerabilities of the ICT systems and provides an approach for the quantification of the necessary investment. The paper concludes with a recommendation for a standard approach to security-information investment assessment.