Investments in information security: A real options perspective with Bayesian postaudit

Journal of Management Information Systems

Volumn 25, Issue 3, 2009, Pages 337-375

  Herath, Hemantha S B ^a   Herath, Tejaswini C ^a  

^a BROCK UNIVERSITY   (Canada)

Author keywords

Bayesian revisions; Conjugate prior distributions; Economics of information security; Information security investments; Postaudit; Real options; Return on investment; ROC curves

Indexed keywords

BAYESIAN REVISIONS; CONJUGATE PRIOR DISTRIBUTIONS; ECONOMICS OF INFORMATION SECURITY; INFORMATION SECURITY INVESTMENTS; POSTAUDIT; REAL OPTIONS; RETURN ON INVESTMENT; ROC CURVES;

BAYESIAN NETWORKS; ECONOMICS; EDUCATION; INTERNET; INVESTMENTS; RISK ANALYSIS; RISK MANAGEMENT; VALUE ENGINEERING;

SECURITY OF DATA;

EID: 66549117052     PISSN: 07421222     EISSN: None     Source Type: Journal    
DOI: 10.2753/MIS0742-1222250310     Document Type: Article

References (35)

1. Bardhan, I.; Bagchi, S.; and Sougstad, R. Prioritizing a portfolio of information technology investment projects. Journal of Management Information Systems, 21, 2 (Fall 2004), 33-60.
2. Benaroch, M. Managing information technology investment risk: A real options perspective. Journal of Management Information Systems, 19, 2 (Fall 2002), 43-84.
3. Benaroch, M., and Kauffman, R. A case for using real options pricing analysis to evaluate information technology project investments. Information Systems Research, 10, 1 (1999), 70-86.
4. Benaroch, M.; Shah, S.; and Jeffery, M. On the valuation of multistage information technology investments embedding nested real options. Journal of Management Information Systems, 23, 1 (Summer 2006), 239-261.
5. Bierman, H., jr., and Rao, V. Investment decisions with sampling. Financial Management, 7, 7 (1978), 19-24.
6. Bridwell, L. ICSA Labs 10th annual computer virus prevalence survey 2004. Mechanicsburg, Pa: ICSa Labs, 2005 (available at www.icsalabs.com/ icsa/docs/html/library/whitepapers/ VPS2004.pdf).
7. Cavusoglu, H., and raghunathan, S. Configuration of detection software: A comparison of decision and game theory approaches. Decision Analysis, 1, 3 (2004), 131-148.
8. Cavusoglu, H.; Mishra, B.; and Raghunathan, S. The value of intrusion detection systems in information technology security architecture. Information Systems Research, 16, 1 (2005), 28-46.
9. Conrad, J.R. analyzing the risks of information security investments with Monte-Carlo simulations. Paper presented at the Fourth Workshop on the Economics of Information Security (WEIS), Harvard University, June 1-3, 2005 (available at http://infosecon.net/workshop/ pdf/13.pdf).
10. Copeland, T., and antikarov, V. Real Options - A Practitioner's Guide. New York: TEXERE, 2001.
11. Dixit, A.K., and Pindyck, R.S. Investment Under Uncertainty. Princeton: Princeton University Press, 1994.
12. Dos Santos, B.L. Justifying investments in new information technologies. Journal of Management Information Systems, 7, 4 (Spring 1991), 71-90.
13. Fichman, R.G. real options and IT platform adoption: Implications for theory and practice. Information Systems Research, 15, 2 (2004), 132-152.
14. Gordon, L.A. Managerial Accounting: Concepts and Empirical Evidence, 6th ed. New York: McGraw Hill, 2004.
15. Gordon, L. A., and Loeb, M.P. the economics of information security investment. ACM Transactions on Information and Systems Security, 5, 4 (2002), 438-457.
16. Gordon, L.A., and Myers, M.D. Postauditing capital projects: Are you in step with the competition? Management Accounting, 72, 7 (1991), 39-42.
17. Gordon, L.A.; Loeb, M.P.; and Lucyshyn, W. Information security expenditures and real options: A wait and see approach. Computer Security Journal, 19, 2 (2003), 1-7.
18. Gordon, L.A.; Loeb, M.P.; Lucyshyn, W.; and richardson, R. 2006 CSI/FBI computer crime and security survey. Computer Security Institute, San Francisco, 2006 (available at www. gocsi.com/forms/fbi/csi-fbi-survey.jhtml).
19. Herath, H.S.B., and Kumar, P. Multinomial approximation models for options. In C.F. Lee and A.C. Lee (eds.), Advances in Investment Analysis and Portfolio Management, New Series, vol. 2. North Brunswick, NJ: Center for Pacific Basin Business, Economic and Finance Research, 2006, 199-226.
20. Herath, H.S.B., and Park, C.S. Real option valuation and its relationship to Bayesian decision-making methods. Engineering Economist, 46, 1 (2001), 1-32.
21. Herath, H.S.B., and Park, C.S. Multi-stage capital investment opportunities as compound real options. Engineering Economist, 47, 1 (2002), 1-27.
22. Hoo, K.J.S. How much is enough? a risk management approach to computer security. Ph.D. dissertation, Department of Management Science and Engineering, Stanford University, Stanford, 2000.
23. Kambil, a.; Henderson, J.; and Mohensadeh, H. Strategic management of information technology investments: an options perspective. In R.D. Banker, R.J. Kauffman, and M.A. Mahmood (eds.), Strategic Information Technology Management: Perspectives on Organizational Growth and Competitive Advantage. Middletown, PA: Idea Group, 1993, pp. 161-178.
24. Kumar, R.L. a framework for assessing the business value of information technology infrastructures. Journal of Management Information Systems, 21, 2 (Fall 2004), 11-32.
25. Law, A., and Kelton, W.D. Simulation Modeling and Analysis, 3d ed. New York: McGraw-Hill, 2000.
26. Longstaff, T.A.; Chittister, C.; Pethia, R.; and Haimes, Y.Y. are we forgetting the risks of information technology? IEEE Computer, 33, 12 (2000), 43-51.
27. Luce, R.D., and Raiffa, H. Games and Decisions. New York: Wiley, 1957.
28. McGrath, R.G., and MacMillan, I.C. assessing technology projects using real options reasoning. Research Technology Management, 43, 4 (2000), 35-49.
29. Over-confidence is pervasive amongst security professionals. CSO magazine in cooperation with U.S. Secret Service, Computer Emergency response team (CERT) Coordination Center, and Microsoft Corporation, 2007 (available at www.cert.org/archive/pdf/ecrimesum-mary07.pdf).
30. Raiffa, H., and Schlaifer, R. Applied Statistical Decision Theory. Cambridge: Harvard University Press, 1961.
31. Savage, L.J. The Foundations of Statistics. New York: Wiley, 1954.
32. Taudes, A. Software growth options. Journal of Management Information Systems, 15, 1 (Summer 1998), 165-185.
33. Taudes, A.; Feurstein, M.; and Mild, A. Options analysis of software platform decisions: A case study. MIS Quarterly, 24, 2 (2000), 227-243.
34. Ulvila, J.W., and Gaffney, J.E., Jr. A decision analysis method for evaluating computer intrusion detection systems. Decision Analysis, 1, 1 (2004), 35-50.
35. Yue, W., and Çakanyildirim, M. Intrusion prevention in information systems: Reactive and proactive responses. Journal of Management Information Systems, 24, 1 (Summer 2007), 329-353.