IT Security Investment and Gordon-Loeb's 1/e Rule.
Yuliy M. Baryshnikov · 2012
ABSTRACT. Gordon-Loeb’s model of investment into mitigation of Information Technology risks is simple and versatile, and thus attracted significant attention of both IT practitioners and economists. One of the claims of the original research was that the optimal investment level never exceeds 1/e-th fraction of the value at risk, the result they verified for several of instances of their model. At the same time, subsequent works showed that the result is false in the full generality of GL model. In this note we first put the GL model into a more general context, deriving their postulates from several verifiable axioms. Further, we prove that in this framework, the 1/e rule indeed holds in full generality, thus justifying the intuition of [2]. 1.