A Value-at-Risk Approach to Information Security Investment

2008 | Information Systems Research | Citations: 0

Authors: Wang, Jingguo; Chaudhury, Aby; Rao, H. Raghav

Abstract: Information security investment has been getting increasing attention in recent ... Expand

Abstract: Information security investment has been getting increasing attention in recent years. Various methods have been proposed to determine the effective level of security investment. However, traditional expected value methods (such as annual loss expectancy) cannot fully characterize the information security risk confronted by organizations, considering some extremal yet perhaps relatively rare cases in which a security failure may be critical and cause high losses. In this research note we introduce the concept of value-at-risk to measure the risk of daily losses an organization faces due to security exploits and use extreme value analysis to quantitatively estimate the value at risk. We collect a set of internal daily activity data from a large financial institution in the northeast United States and then simulate its daily losses with information based on data snapshots and interviews with security managers at the institution. We illustrate our methods using these simulated daily losses. With this approach, decision makers can make a proper investment choice based on their own risk preference instead of pursuing a solution that minimizes only the expected cost. Collapse

Topics: data security website security policy IT security enterprise information system

Methods: extreme value analysis augmented Dickey–Fuller test qualitative interview sensitivity analysis descriptive statistic

Theories: decision theory

A Multilevel Investigation of the Motivational Mechanisms Underlying Knowledge Sharing and Performance

2007 | Organization Science | Citations: 47

Authors: Quigley, Narda R.; Tesluk, Paul E.; Locke, Edwin A.; Bartol, Kathryn M.

Abstract: This study draws on three different, yet complementary, theories of motivation, ... Expand

Abstract: This study draws on three different, yet complementary, theories of motivation, which we combine in an interactive manner, to explain the mechanisms that underlie the exchange between knowledge providers and recipients and ultimately impact performance. More specifically, we use incentive, goal-setting-social cognitive, and social motivation theories to examine knowledge sharing within dyads and its influence on individual performance. One hundred and twenty participants functioning as interdependent manager dyads completed a strategic decision-making simulation. Hierarchical regression and random coefficient modeling techniques were used to test hypothesized relationships. Results demonstrated that the effect of group-oriented incentive systems on the knowledge provider was enhanced when more positive norms for knowledge sharing existed among dyad members. The recipient's self-efficacy had a stronger relationship with performance goals when the recipient trusted the provider. Finally, self-set goals and knowledge sharing had both direct and interactive effects on individual performance. We argue that these findings constitute a useful advance in middle-range motivation (Landy and Becker 1987, Pinder 1984) theory pertaining to knowledge sharing and utilization. Collapse

Topics: knowledge sharing self efficacy information exchange knowledge utilization knowledge management

Methods: simulation regression analysis method ANOVA parametric test theoretical contribution

Theories: motivation theory goal setting theory theory of shared mental models social cognitive theory

An Extreme Value Approach to Information Technology Security Investment

2005 | International Conference on Information Systems | Citations: 0

Authors: Wang, Jingguo; Chaudhury, Abhijit; Rao, Raghav

Abstract: Information technology security investment is receiving increasing attention in ... Expand

Abstract: Information technology security investment is receiving increasing attention in recent years. Various methods have been proposed to determine the effective level of security investment. In this paper, we introduce an extreme value approach to address the issues of effective budgeting and investing in IT security. In our model, the security status of a system depends on two factors: system security level, which is measured by the level of security investment, and system attack level, which reflects the security risk with which the system is confronted. Security investment level is endogenous to the system, while attack level is exogenous. Extreme value analysis is used to characterize the stochastic behavior of high-level attacks based on the historical data and to make inferences on future attacks. Based on these inferences, we determine the effective security solutions and the level of security investment to modulate the likelihood of system failure. For illustration purposes, we use an extreme value approach to analyze a set of traffic data collected from a regional bank. Collapse

Topics: IT security IS failure email spam internet technology electronic business

Methods: extreme value analysis regression analysis method sensitivity analysis survival function literature study