An Analysis of Information Security Management Strategies in the Presence of Interdependent Security Risk

다국어 초록 (Multilingual Abstract)

This study expands the current body of research by exploring multiple scenarios of insufficient and excessive IT security investments caused by interdependent risks and the interplay between IT security investments and cyber insurance. A key finding is that organizations experiencing interdependent risks with different types of cyber attacks (i.e., targeted and untargeted attacks) use different strategies in making IT security investment decisions and in purchasing cyber insurance policies for their information security risk management than firms that are facing independent risks. The study further provides an economic rationale for employing insurance mechanisms as a risk management solution for information security.

참고문헌 (Reference)

1 Schoemaker, P., "The expected utility model : its variants, purposes, evidence and limitations" 20 (20): 529-563, 1982

2 Kesan, J., "The Economic Case for Cyberinsurance" 2005

3 Brodkin, J, "TJX breach may spur greater adoption of credit card security standards"

4 Muermann, A, "Selfprotection and insurance with interdependencies" 36 (36): 103-123, 2008

5 Weiss, T.R., "Security holes closed in New York Times intranet after hacker intrusion"

6 Grance, T., "Security guide for interconnecting information technology systems" NIST 800-847, 2002

7 Dzung, D, "Security for industrial communication systems" 93 (93): 1152-1177, 2005

8 Doll, M., "Security and Technology Solutions: The 2002 Ernst and Young Digital Security Overview: An Executive Guide and Diagnostic" Ernst and Young LLP 2002

9 Camp, L.J., "Pricing security" 2000

10 Tally, G, "Phisherman: A Phishing Data Repository" 2009

11 Quaas, M, "Natural vs. financial insurance in the management of public-good ecosystems" 65 (65): 397-406, 2008

12 Bandyopadhyay, T., "Mitigation and transfer of information security risk: Investment in financial instruments and technology" The University of Texas at Dallas 2006

13 Ehrlich, I, "Market Insurance, Self-Insurance, and Self-Protection" 80 (80): 623-648, 1972

14 Varian, H, "Managing Online Security Risks"

15 Zhao, X., "Managing Interdependent Information Security Risks: An Investigation of Commercial Cyberinsurance and Risk Pooling Arrangement" 2009

16 Powell, B., "Is cybersecurity a public good? Evidence from the financial services industry" 1 (1): 497-510, 2005

17 Hirshleifer, J., "Investment, interest, and capital" Prentice-Hall 1970

18 Kunreuther, H, "Interdependent security" 26 (26): 231-249, 2003

19 Shim, W., "Interdependent risk and cyber security: An analysis of security investment and cyber insurance" Michigan State University 2010

20 Lakdawalla, D, "Insurance, self-protection, and the economics of terrorism" 89 (89): 1891-1905, 2006

21 Ogut, H., "Information technology security risk management" The University of Texas at Dallas 2006

22 Bhattacharya, J, "Health Insurance and the Obesity Externality" 17 (17): 279-318, 2006

23 Böhme, R., "Cyber-insurance Revisited" 2005

24 Bolot, J, "Cyber insurance as an incentive for Internet security" 2008

25 Turk, R. J., "Cyber incidents involving control systems" Idaho National Engineering and Environmental Laboratory 2005

26 Ogut, H., "Cyber Insurance and IT Security Investment: Impact of Interdependent Risk" 2005

27 Bolot, J, "A new perspective on internet security using insurance" 2008

28 Gordon, L., "A framework for using insurance for cyber-risk management" 46 (46): 81-85, 2003

29 Hau, A., "A Note on Insurance Coverage in Incomplete Markets" 66 (66): 433-442, 1999

30 Richardson, R, "2008 CSI Computer Crime and Security Survey" Computer Security Institute 2008