Economic Evaluation of IT Security

摘要

Security has become a fundamental part of information technology (IT) investment. A common view of security is based on the implementation of preventive mechanisms such as firewalls, VPNs, encryption, and access control. Although having good preventive measures in place may reduce security vulnerabilities and losses from security breaches; it is not clear to organizations how much they must invest in information security. In this paper, common quantitative approaches of economics in information security are presented.