The economics of information security investment

By Lawrence A. Gordon, Martin P. Loeb. TSEC, 2002

1,461 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/2466bbdfb23622956264ef444f48caa9f4b49e30

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Kjell Hausken
2. Esther Gal‐Or
3. Anindya Ghose
4. William Lucyshyn
5. Cormac Herley
6. Benjamin I. P. Rubinstein
7. Martin P. Loeb
8. Lawrence A. Gordon

In Information Systems

1. Kjell Hausken
2. Esther Gal‐Or
3. Anindya Ghose
4. William Lucyshyn
5. Cormac Herley
6. Martin P. Loeb
7. Benjamin I. P. Rubinstein
8. Lawrence A. Gordon

Citations in the corpus

• Sharing Information on Computer Systems Security: An Economic Analysis (2003, methodology): “Gordon et al. (2002) present a general discussion of information sharing in the context of Sharing Information on Computer Systems Security: An Economic Analysis SB/ISOs, but do not present a model or formal analysis.”
• Secure or insure?: a game-theoretic analysis of information security games (2008, background): “For example, Gordon and Loeb [18] as well as Hausken [22] focus on the impact of different security breach functions and degrees of vulnerability on an entity's investment strategy.”
• Information security and privacy in healthcare: current state of research (2010, background): “, 2007; Dhillon and Backhouse, 2001; Straub and Collins, 1990; Straub and Welke, 1998; Vaast, 2007) and economic theories to characterise investment decisions and information governance (Cavusoglu et al., 2004, 2005; Gordon and Loeb, 2002; Khansa and Liginlal, 2009; Kumar et al., 2007; Zhao and John”
• The economic cost of publicly announced information security breaches: empirical evidence from the stock market (2003, neutral): “Recent conceptual/theoretical studies by Anderson [2] and Gordon and Loeb [20] provide insights into the economics of information security, but do not investigate the actual magnitude of losses associated with information security breaches.”
• The Economic Incentives for Sharing Security Information (2005, result): “Volume-related spillovers costs yield, therefore, predictions that are more consistent with the free-riding behavior described in Gordon et al. (2003) or in the R&D literature (d’Aspremont and Jacquemin 1988, Kamien et al.”
• A model for evaluating IT security investments (2004, background): “Gordon and Loeb [6] develop an economic model to determine the optimal level of investment in information security.”
• Which Factors Explain Employees' Adherence to Information Security Policies? An Empirical Study (2007, neutral): “While in 1997-1999 surveys, 37-50% of the organizations were victims of information security breaches (Thompson, 1997), the same numbers in the years 2001-2003 ranged from 75% to 91% (Bagchi & Udo, 2003, p. 684; Gordon & Loeb, 2002 p. 438-439; Hinde 2002 p. 310).”
• The Plight of the Targeted Attacker in a World of Scale (2010, background): “However, investment strategies that echo the findings of Gordon and Loeb [30] and Boehme and Moore [39] spring from our findings.”
• A Learning-Based Approach to Reactive Security (2009, background): “Gordon and Loeb [15] and Hausken [17] analyze the costs and bene ts of security in an economic model (with non-strategic attackers) where the probability of a successful exploit is a function of the defense investment.”
• Income, interdependence, and substitution effects affecting incentives for security investment (2006, background): “Gordon and Loeb (2002) determine the optimal investment for information protection.”