The Optimal Investment Strategy of Information Security

This study analyzes an optimal investment strategy for information security (IS) for a profit-maximizing online monopoly when it is facing attacks from cyber criminals by considering a network security theoretical model with time-varying characteristics. The intangible profit of security investment is transformed into a measurable sales benefit by using a successful entry ratio that links the relationships among IS investment, security improvement, and increases in consumer demand. The dynamic optimization technique is adopted to analyze optimal network security investments for enterprises. It is found that there exists a unique optimal IS investment level. This investment strictly increases with market potential and degree of threat, but the increment strictly decreases with changes in market potential and the degree of threat. The benefit-cost ratio of investment versus threat is strictly concave in regard to threat degree. Next, in a finite time frame, an optimal investment in information security monotonically decreases over time until the end of the time period whenever the discount rate is low. Finally, it is also found that the optimal upgrade time to invest in information security occurs when a monopoly’s gross profits in two generations of products are the same.