2021/12/08 by Dimitri Percia David, David, Dimitri Percia, Alain Mermoud +3
Computer Science · Engineering · Social Sciences · #Cryptography and Security (cs.CR) #Cybersecurity and Cyber Warfare Studies #FOS: Computer and information sciences #FOS: Economics and business #Information and Cyber Security #Infrastructure Resilience and Vulnerability Analysis #Theoretical Economics (econ.TH)
paper · pdf · doi:10.48550/arxiv.2112.04310
openalex publication_date 2021/12/08 · openalex created_date 2021/12/31 · openalex updated_date 2026/07/28
Cyber-security breaches inflict significant costs on organizations. Hence, the development of an information-systems defense capability through cyber-security investment is a prerequisite. The question of how to determine the optimal amount to invest in cyber-security has been widely investigated in the literature. In this respect, the Gordon-Loeb model and its extensions received wide-scale acceptance. However, such models predominantly rely on restrictive assumptions that are not adapted for analyzing dynamic aspects of cyber-security investment. Yet, understanding such dynamic aspects is a key feature for studying cyber-security investment in the context of a fast-paced and continuously evolving technological landscape. We propose an extension of the Gordon-Loeb model by considering multi-period and relaxing the assumption of a continuous security-breach probability function. Such theoretical adaptations enable to capture dynamic aspects of cyber-security investment such as the advent of a disruptive technology and its investment consequences. Such a proposed extension of the Gordon-Loeb model gives room for a hypothetical decrease of the optimal level of cyber-security investment, due to a potential technological shift. While we believe our framework should be generalizable across the cyber-security milieu, we illustrate our approach in the context of critical-infrastructure protection, where security-cost reductions related to risk events are of paramount importance as potential losses reach unaffordable proportions. Moreover, despite the fact that some technologies are considered as disruptive and thus promising for critical-infrastructure protection, their effects on cyber-security investment have been discussed little.