Decision-Theoretic and Game-Theoretic Approaches to IT Security Investment
Authors: Cavusoglu, Huseyin; Raghunathan, Srinivasan; Yue, Wei T.
Journal: Journal of Management Information Systems (2008)
DOI: 10.2753/mis0742-1222250211
Firms have been increasing their information technology (IT) security budgets significantly to deal with increased security threats. An examination of current practices reveals that managers view security investment as any other and use traditional decision-theoretic risk management techniques to determine security investments. We argue in this paper that this method is incomplete because of the problem’s strategic nature—hackers alter their hacking strategies in response to a firm’s investment strategies. We propose game theory for determining IT security investment levels and compare game theory and decision theory approaches on several dimensions such as the investment levels, vulnerability, and payoff from investments. We show that the sequential game results in the maximum payoff to the firm, but requires that the firm move first before the hacker. Even if a simultaneous game is played, the firm enjoys a higher payoff than that in the decision theory approach, except when the firm’s estimate of the hacker effort in the decision theory approach is sufficiently close to the actual hacker effort. We also show that if the firm learns from prior observations of hacker effort and u…