A Composite Risk Model for Optimizing Information System Security
Yahel Giat, Michael Dreyfuss · Advances in knowledge acquisition, transfer, and management book series/Advances in knowledge acquisition, transfer and management book series · 2020
This chapter describes a two-step decision-support risk model that focuses on investment in information technology security. In the first step, the risk level of each of the system's components is mapped with the goal of identifying the subsystems that pose the highest risk. In the second step, the model determines how much to invest in various technological tools and workplace culture programs to enhance information security. The mode is applied to an information system in an academic institution in Israel. This system comprises 10 subsystems and the three that are responsible to most of the risk are identified. These findings are then used to determine the parameters of the investment allocation problem and find the optimal investment plan. The results of the model's application indicate that monetary incentives and grade cheating are the greatest threats to the system's security. In addition, the results provide support to the claim that information security officials tend to overinvest in security technological tools and underinvest in improving security workplace culture.