On the Gordon&Loeb Model for Information Security Investment (2006)
| Citations: | 9 - 0 self |
BibTeX
@MISC{Willemson06onthe,
author = {Jan Willemson},
title = {On the Gordon&Loeb Model for Information Security Investment},
year = {2006}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
In this paper we discuss a simple and general model for evaluating optimal investment level in information security proposed by Gordon and Loeb [5]. The authors leave an open question, whether there exists some universal upper limit for the level of optimal security investments compared to the total cost of the protected information set. They also conjecture that if such a level exists, it could be e # 36, 8%. In this paper, we disprove this conjecture by constructing an example where the required investment level of up to 50% can be necessary. By relaxing the original requirements of Gordon and Loeb just a little bit, we are also able to show that within their general framework examples achieving levels arbitrarily close to 100% exist.
Keyphrases
information security investment gordon loeb model universal upper limit original requirement open question optimal investment level optimal security investment little bit protected information general framework example information security general model required investment level total cost
