Cyber security investment cost-benefit investigation using system dynamics modelling

Abstract

As cyber-attacks pose a major threat to organisations, security measures are required to protect networks and information. Defence against these attacks requires substantial resources and investments from organisations. The level of perceived risk should provide guidance on the level of cyber defence investment required. Not being able to effectively assess the consequences of information security investment decisions, leaves managers to speculate on is cost benefit. The cyber security investment assessment model needs to capture the complexities of the security decision while permitting a systematic exploration of alternative security options. This complex problem with a large number of closely coupled variables associated with information security problems requires different analytical tools to support decisions on investment of limited resources. System Dynamics provides a tool for analysing complex situations. It helps to identify the causal relationships amongst the variables identified in the problem situation. System Dynamics models can capture the complexities of the security decision to support systematic exploration of alternative security options through simulation. This paper proposes a System Dynamics model to assess different cyber security investment strategies.