Information security investment decisions: evaluating the Balanced Scorecard method

Authors:
Linda J. Tallau;Manish Gupta;Raj Sharman
Affiliations:
Department of Management Science and Systems, School of Management, State University of New York, Buffalo, NY 14260, USA.;Department of Management Science and Systems, School of Management, State University of New York, Buffalo, NY 14260, USA.;Department of Management Science and Systems, School of Management, State University of New York, Buffalo, NY 14260, USA
Venue:
International Journal of Business Information Systems
Year:
2010

Citing 21
Cited 4

The balanced scorecard: a foundation for the strategic management of information systems

Decision Support Systems
The economics of information security investment

ACM Transactions on Information and System Security (TISSEC)
A Map of Security Risks Associated with Using COTS

Computer
Analyzing security costs

Communications of the ACM - E-services: a cornucopia of digital offerings ushers in the next Net-based evolution
The economic cost of publicly announced information security breaches: empirical evidence from the stock market

Journal of Computer Security - IFIP 2000
How much is enough: a risk management approach to computer security

How much is enough: a risk management approach to computer security
Why the Future Belongs to the Quants

IEEE Security and Privacy
Computer security strength and risk: a quantitative approach

Computer security strength and risk: a quantitative approach
Evaluating information security investments using the analytic hierarchy process

Communications of the ACM - Medical image modeling
Timing the Application of Security Patches for Optimal Uptime

LISA '02 Proceedings of the 16th USENIX conference on System administration
The Value of Intrusion Detection Systems in Information Technology Security Architecture

Information Systems Research
Budgeting process for information security expenditures

Communications of the ACM - Personal information management
Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability

Information Systems Frontiers
The Sarbanes-Oxley Act and the changing role of the CIO and IT function

International Journal of Business Information Systems
Communicating the value of uncertain information technology investments using an options approach

International Journal of Business Information Systems
An investigation of information availability and sharability for organisational performance measures

International Journal of Business Information Systems
The productivity of large business information system development

International Journal of Business Information Systems
The link between perceptions about the balanced scorecard approach and company performance an empirical study

International Journal of Business Information Systems
Managing digital enterprise

International Journal of Business Information Systems
Knowledge management within information security: the case of Barings Bank

International Journal of Business Information Systems
SP 800-55 Rev. 1. Performance Measurement Guide for Information Security

SP 800-55 Rev. 1. Performance Measurement Guide for Information Security

A study on usage of IT and its implications on e-procurement in Indian organisations

International Journal of Business Information Systems
Investing in IT Security: How to Determine the Maximum Threshold

International Journal of Information Security and Privacy
An effective and secure web banking system: development and evaluation

International Journal of Business Information Systems
Effects of implementing information security management systems on the performance of marketing and sales departments

International Journal of Business Information Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Justifying security investments has been challenging for managers and executives alike for several well-published reasons. With the growing importance of security measures, companies are increasing the share of security investments in their overall Information Technology (IT) budgets. This paper presents a practical application of the Balanced Scorecard method in evaluating the investment decisions made on the acquisition of security technologies by an organisation. The research shows that this methodology can be used effectively in comparative analysis situations where two or more investments are being considered using a set of best choices per organisational goal. The proposed methodology incorporates the percentages of financial, customer, business and growth goals defined in a set of metrics and places a weighted value on those percentages to achieve an overall percentage of met goals. The research is carried out in a US-based large public university's IT division.