Abstract
We live in an unsafe world in which we encounter threats against our safety and security every day. This is especially true in the information processing environment. Managements are engaging and facing difficult problems to manage information security issues. One of the most brain-teasing management issues is “How they could make a decision on security-related investment to maximize the economic balance?” To solve this problem the ROI of security investments must be measured and managed. This paper provides the integrated methodology which consists of a process model and analysis criteria of cost factors and benefit factors to support an economic justification of security investments. Also, a case study is provided to show practicality of this methodology.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Alpar, P., Kim, M.A.: A Microeconomic Approach to the Measurement of Information Technology Value. Journal of Management Information Systems 7 (1990)
Barua, A., et al.: Information Technologies and Business Value: An Analytic and Empirical Investigation. Information Systems Research 6 (1995)
Brynjolfsson, E., Hitt, L.: Paradox Lost? Firm-level Evidence on the Returns to Information Systems. Management Science 42 (1996)
Mahmood, M.A., Mann, G.J.: Measuring the Organizational Impact of Information Technology Investment: An Exploratory Study. Journal of Management Information Systems 10 (1993)
Mitra, S., Chaya, A.K.: Analyzing Cost-effectiveness of Organizations: the Impact of Information Technology Spending. Journal of Management Information Systems 13 (1996)
Rai, A., et al.: Technology Investment and Business Performance. Communications of the ACM 40 (1997)
Eloff, J.H.P., et al.: A Comparative Framework for Risk Analysis Methods. Computers & Security 12 (1993)
Geer, D.E.: Making Choices to Show ROI. Secure Business Quarterly 1 (2001)
Checkland, P.: Systems Thinking, Systems Practice. John Wiley & Sons, Chichester (1981)
Delone, W.H., McLean, E.R.: Information Systems Success: The Quest for the Dependent Variable. Information Systems Research (1992)
Mahmood, M.A.: A Comprehensive Model for Measuring the Potential Impact of Information Technology on Organizational Strategic Variables. Decision Sciences 22 (1991)
Palvia, P.C.: Developing a Model of the Global and Strategic Impact of Information Technology. Information & Management 32 (1997)
Grover, V., et al.: Information Systems Effectiveness: The Construct Space and Patterns of Application. Information & Management 31 (1996)
Saarinen, T., Scheer, A.W.: Business Process Engineering. Springer, Heidelberg (1994)
Torkzadeh, G., Doll, W.J.: The Development of a Tool for Measuring the Perceived Impact of Information Technology on Work, Omega (1999)
Renkema, T.J.W., Berghout, E.W.: Methodologies for Information Systems Investment Evaluation at the Proposal Stage: A Comparative Review. Information and Software Technology 39 (1997)
Remenyi, D., et al.: Effective Measurement and Management of IT Costs and Benefits. Butterworth-Heinemann (2000)
Jiang, J.J., Klein, G.: Information System Project-selection Criteria Variations within Strategic Classes. IEEE Transactions on Engineering Management 46 (1999)
Bacon, C.J.: The Use of Decision Criteria in Selecting Information Systems / Technology Investments. MIS Quarterly (September 1992)
Scott, D.: Security Investment Justification and Success Factors. Gartner (1998)
Bates, R.J.: Disaster Recovery Planning. McGraw-Hill, New York (1991)
Power, R.: CSI/FBI Computer Crime and Security Survey. Computer Security Issues & Trends 18 (2002)
Blakley, B.: Returns on Security Investment: An Imprecise but Necessary Calculation. Secure Business Quarterly 1 (2001)
Witty, R., et al.: The Price of Information Security, Strategic Analysis Report. Gartner (2001)
Malik, W.: A Security Funding Strategy. Gartner (2001)
Kim, S.: A Study on Enterprise Information System Investment Evaluation, Master thesis. Yonsei University (2000)
Harris, S.: CISSP All-in-One Exam Guide. McGraw-Hill, New York (2001)
Roper, C.A.: Risk Management for Security Professionals. Butterworth Heinemann (1999)
Fites, P.E., et al.: Controls and Security of Computer Information Systems. Computer Science Press, Rockville (1989)
Hutt, A.E.: Management’s Roles in Computer Security. In: Computer Security Handbook. Macmillan Publishing Company, Basingstoke (1988)
Vallabhaneni, R.: CISSP Examination Textbooks. SRV Professional Publications (2000)
Krutz, R.L., Vines, R.D.: The CISSP Prep Guide: Mastering the Ten Domains of Computer Security. John Wiley & Sons, Chichester (2001)
Schweitzer, J.A.: Protecting Information in the Electronic Workplace: A Guide for Managers. Reston Publishing Company (1983)
Scott, D., Malik, W.: Best Practices in Business Continuity Planning. In: Symposium/ITxpo 2001 (2001)
Porter, M.E.: How Competitive Forces Shape Strategy. Harvard Business Review 57 (1979)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, S., Lee, H.J. (2005). Cost-Benefit Analysis of Security Investments: Methodology and Case Study. In: Gervasi, O., et al. Computational Science and Its Applications – ICCSA 2005. ICCSA 2005. Lecture Notes in Computer Science, vol 3482. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11424857_132
Download citation
DOI: https://doi.org/10.1007/11424857_132
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-25862-9
Online ISBN: 978-3-540-32045-6
eBook Packages: Computer ScienceComputer Science (R0)