How Much Should We Pay for Security? (Invited Paper)
Information systems security has become a top priority issue for most organizations worldwide IT managers try to protect their systems through a series of technical security measures. Even though these measures can be determined through risk analysis, the appropriate amount that should be invested in Information Systems security is, by and large, determined empirically. Organizations would also wish to insure their information systems against potential security incidents. In this case both parties, namely the organization and the insurance company would be interested in calculating a fair, mutually beneficial premium. In this paper a probabilistic structure, in the form of a Markov model, is used to provide some insight into these issues.
Key wordsInformation systems security security investment security insurance
- 2.Yannacopoulos A.N., Lambrinoudakis C, Gritzalis S., Hatzopoulos P., and Katsikas, S.K., A dynamic stochastic model for optimizing information systems security investment, submitted for publication.Google Scholar
- 3.Habennan, S. and Pitacco, E., Actuarial models for disability insurance, Chapman and Hall, 1999.Google Scholar
- 5.Varian, H.R., Microeconomic analysis, Norton and Co., 1992.Google Scholar