On the Gordon & Loeb Model for Information Security Investment.
Jan Willemson · WEIS · 2006
In this paper we discuss a simple and general model for evaluating optimal investment level in information security proposed by Gordon and Loeb [5]. The authors leave an open question, whether there exists some universal upper limit for the level of optimal security investments compared to the total cost of the protected information set. They also conjecture that if such a level exists, it could be 1 e ≈ 36, 8%. In this paper, we disprove this conjecture by constructing an example where the required investment level of up to 50% can be necessary. By relaxing the original requirements of Gordon and Loeb just a little bit, we are also able to show that within their general framework examples achieving levels arbitrarily close to 100% exist.