Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

Optimizing investment decisions in selecting information security remedies

Optimizing investment decisions in selecting information security remedies Purpose – This paper proposes a new framework for optimizing investment decisions when deciding about information security remedies. Design/methodology/approach – The framework assumes that the organization is aware of a set of remedies that can be employed to address end‐effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end‐effect. Given the two sets of costs, that of the end‐effect and the potential damage it can cause and that of the remedy and the required level of protection from each end‐effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization. Findings – The paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation. Practical implications – Concentrating on end‐effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events. Originality/value – This research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Information Management & Computer Security Emerald Publishing

Optimizing investment decisions in selecting information security remedies

Download PDF
18 pages

Loading next page...
 
/lp/emerald-publishing/optimizing-investment-decisions-in-selecting-information-security-w3XlhSW3dN

References (37)

Publisher
Emerald Publishing
Copyright
Copyright © 2011 Emerald Group Publishing Limited. All rights reserved.
ISSN
0968-5227
DOI
10.1108/09685221111143042
Publisher site
See Article on Publisher Site

Abstract

Purpose – This paper proposes a new framework for optimizing investment decisions when deciding about information security remedies. Design/methodology/approach – The framework assumes that the organization is aware of a set of remedies that can be employed to address end‐effects that have been identified. The framework also assumes that the organization defines its information security policy by setting a minimum level of protection for each end‐effect. Given the two sets of costs, that of the end‐effect and the potential damage it can cause and that of the remedy and the required level of protection from each end‐effect, this framework can be used to identify the optimal set of remedies for a given budget that complies with the organization's information security policy. The framework is illustrated using a practical example concerning investment decision optimization in a financial organization. Findings – The paper shows that exhausting the information security budget does not assure a higher level of security required by the organisation. Practical implications – Concentrating on end‐effects and on the organizational requirements eases the process of remedy selection. The proposed methodology circumvents the common process of assuming probabilities of information security events. Originality/value – This research proposes a practical and an easily implementable framework, enabling the information security manager to align the information security remedies and best practice methodological requirements with organizational budget constraints and business requirements while maintaining a required level of security.

Journal

Information Management & Computer Security – Emerald Publishing

Published: Jun 7, 2011

Keywords: Data security; Investments; Information management

There are no references for this article.