An analysis on effects of information security investments: A BSC perspective

Journal of Intelligent Manufacturing

Volumn 23, Issue 4, 2012, Pages 941-953

  Kong, Hee Kyung ^a   Kim, Tae Sung ^b   Kim, Jungduk ^c  

^a Electronics and Telecommunications Research Institute (ETRI)   (South Korea)

^b Chungbuk National University   (South Korea)

^c Chung Ang University   (South Korea)

Author keywords

Balanced score card (BSC); Critical success factors (CSF); Empirical analysis; Information security investments; Key performance indicators (KPI); Structural equation model (SEM)

Indexed keywords

BALANCED SCORECARDS; CRITICAL SUCCESS FACTOR; EMPIRICAL ANALYSIS; INFORMATION SECURITY INVESTMENT; KEY PERFORMANCE INDICATORS; STRUCTURAL EQUATION MODELS;

BENCHMARKING; COMPETITION; INDUSTRY; INVESTMENTS; KNOWLEDGE MANAGEMENT; SOCIETIES AND INSTITUTIONS;

SECURITY OF DATA;

EID: 84865215063     PISSN: 09565515     EISSN: 15728145     Source Type: Journal    
DOI: 10.1007/s10845-010-0402-7     Document Type: Review

References (48)

1. M. Al-Humaigani D. B. Dunn 2003 A model of return on investment for information systems security Circuits and Systems 1 483 485
2. Anderson, R. (2001). Why information security is hard-an economic perspective. Computer Security Application Conference (pp. 358-365).
3. J. C. Anderson D. W. Gerbing 1988 Structural equation modeling in practice: a review and recommended two-step approach Psychological Bulletin 103 411 423 10.1037/0033-2909.103.3.411
4. Bae, B. R. (2007). Principles and practice of structural equation modeling using Amos 7. South Korea: Cheongram (in Korean).
5. R. P. Bagozzi Y. Yi 1991 Multitrait-multimethod matrices in consumer research Journal of Consumer Research 17 4 426 439 10.1086/208568
6. R. P. Bagozzi 1988 Performance and satisfaction in and industrial sales force: An examination of their antecedents and simultaneity Journal of Marketing 44 65 77 10.2307/1249978
7. B. Blakely 2001 Returns on security investment: An imprecise but necessary calculation Secure Business Quarterly 1 2 27
8. C. Blatchford 1995 Information Security Controls Are They Cost-effective Computer Audit Journal 3 11 19 10.1016/0960-2593(95)90080-2
9. L. D. Bodin L. A. Gordon M. P. Loeb 2005 Evaluating information security investments using the analytic hierarchy process Communications of the ACM 48 79 83 10.1145/1042091.1042094
10. K. Campbell L. A. Gordon M. P. Loeb L. Zhou 2003 The economic cost of publicly announced information security breaches: Empirical evidence from the stock market Journal of Computer Security 11 3 431 448
11. Cavusoglu, H.; Mishra, B. K.; & Raghunathan, S. (2002). Optimal design of IT security architecture. Working Paper. TX: University of Texas at Dallas.
12. H. Cavusoglu H. Cavusoglu S. Raghunathan 2004 Economics of IT security management: Four improvements to current security practices Communications of the Association for Information System 14 65 75
13. H. Cavusoglu B. Mishra S. Raghunathan 2004 A model for evaluating IT security investments Communications of the ACM 47 7 87 92 10.1145/1005817. 1005828
14. Chaiy, S. I. (1995). Social Science Research Methodology. South Korea: Hakhyunsa (in Korean).
15. A. Davis 2005 Return on security investment-proving it's worth it Network Security 2 8 10 10.1016/S1353-4858(05)70301-9
16. S. Devaraj M. Fan R. Kohli 2002 Antecedent of B2C channel satisfaction and preference: Validating e-Commerce metrics Information Systems Research 13 3 316 333 10.1287/isre.13.3.316.77
17. C. Fornell D. Larcker 1981 Evaluating structural equations models with unobservable variables and measurement error Journal of Marketing Research 18 39 50 10.2307/3151312
18. Gal-Or, E.; & Ghose, A. (2004). The economic incentives for sharing security information. Working Paper. Pittsburgh: University of Pittsburgh and Carnegie Mellon University.
19. L. A. Gordon M. P. Loeb 2002 The economics of information security investment ACM Transactions on Information and System Security 5 4 438 457 10.1145/581271.581274
20. Gordon L. A.; Loeb, M. P.; & Lucyshyn, W. (2002). An economics perspective on the sharing of information related to security breaches. In Proceedings of Workshop on the Economics of Information Security.
21. Gwon, Y. O.; & Kim, B. D. (2007) The effect of information security breach and security investment announcement on the market value of Korean firms. Information Systems Review, 9(1), 105-120. (in Korean).
22. Hair J. F. Jr.; Black W. C.; Babin B. J.; Anderson R. E.; Tatham R. L. (2006) Multivariate data Analysis 6th ed. Prentice-Hall International, NJ
23. Harris S. (2001) CISSP All-in-One Exam Guide. McGraw-Hill, New York
24. K. Hausken 2006 Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability Information System Frontiers 8 5 338 349 10.1007/s10796-006-9011-6
25. Hong, K. H. (2003). A study on the effect of information security controls and processes on the performance on the performance of information security. South Korea: Kook-Min University. (in Korean).
26. Kaplan R. S.; Norton D. P. (1996) The balanced scorecard-translating strategy into action. Harvard Business School Press, Boston
27. Kaplan, R. S.; & Norton, D. P. (1992). The balanced scorecard-measures that drive. Harvard Business Review, Jan/Fab (pp. 71-79).
28. Kaplan R. S.; Norton D. P. (2001) The Strategy-focused organization. Harvard Business School Press, Boston
29. S. K. Kim H. J. Lee 2005 Cost-benefit analysis of security investments: methodology and case study International Conference on Computational Science and its Applications 3482 1239 1248
30. Kim, J. D.; & Park, J. E. (2003) A study on TCO-based return on security investment (ROSI). In Proceedings of the Korea Digital Policy Conference (Vol. 1, pp. 251-261) (in Korean).
31. Kline R. B. (2000) Principles and practice of structural equation modeling. The Guilford Press, New Jersey
32. K. L. Kumar 2004 A framework for assessing the business value of information technology infrastructures Journal of management Information Systems 21 2 11 32
33. V. C. S. Lee 2003 A fuzzy multi-criteria decision model for information system security investment Lecture Notes in Computer Science 2690 436 441 10.1007/978-3-540-45080-1-58
34. Lee, J. S. & Lee, H. J. (2007). Evaluating information security investment using TCO-based Security ROI. In: Proceedings of the Korea Information Processing Society Conference (pp. 1125-1128) (in Korean).
35. Mun, J. T.; Shin, M. S.; & Jung, M. Y. (2009). A goal-oriented trust model for virtual organization creation. Journal of Intelligent Manufacturing. http://www.springerlink.com/content/03685347x1837440/.
36. Nam, S. H. (2006). An empirical study on the impact of security events to the stock price in the analysis method of enterprise security investment effect. South Korea: Korea University. (in Korean).
37. NIST (1996) An introduction to computer security. NIST Special Publication 800-12.
38. Romero, D.; Galeano, N.; & Molina1, A. (2008). Virtual organisation breeding environments value system and its elements. Journal of Intelligent Manufacturing. http://www.springerlink.com/content/x2374786057w57j3/.
39. Roper C. A. (1999) Risk management for security professionals. Butterworth-Heinemann, London
40. Scott D. (1998) Security Investment Justification and Success Factors. Gartner, Stamford
41. Scott, D. (2002). Best practices and trends in business continuity Planning, U.S. Symposium/ITxpo.
42. Shin, I. S. (2004). Review the economics means to information security. Information Security Review, 1(1), 27-40. (in Korean).
43. Soo Hoo K. J. (2000) How much is enough? A risk-management approach to computer security. Stanford University, Palo Alto, CA
44. Sun, H. G. (2005). A Study on the effect of information security policy and organization on the performance of information security. In Proceedings of the Korea management information system international conference, (pp. 1087-1095) (in Korean).
45. H. Tanaka K. Matuura O. Sudoh 2005 Vulnerability and information security investment: An empirical analysis of E-local government in Japan Journal of Accounting and Public Policy 24 37 59 10.1016/j.jaccpubpol.2004.12.003
46. T. Tsiakis G. Stephanides 2005 The economic approach of information security Computers and Security 24 2 105 108 10.1016/j.cose.2005.02.001
47. Witty R. J.; Girard J.; Graff J. W.; Hallawell A.; Hildreth B.; MacDonald N.; Malik W. J.; Pescatore J.; Reynolds M.; Russell K.; Wheatman V.; Dubiel J. P.; Weintraub A. (2001) The price of information security. Gartner, Stamford
48. J. E. Yu M. K. Ha Choi J. J. Rho 2005 Extending the TAM for a t-commerce Information and Management 42 965 976 10.1016/j.im.2004.11.001