Justifying Spam and E-mail Virus Security Investments: A Case Study

Justifying Spam and E-mail Virus Security Investments: A Case Study Hemantha Herath and Tejaswini Herath Abstract: Our paper investigates the problem of justifying security investments concerning spam and email virus using real life data from a midsize North American university. We formulate the spam and email virus security problem as a capital budgeting problem using operating characteristic (ROC) curves in a decision theoretic framework. Prior research has investigated the optimal configuration in a detection system focusing on hacking. In a corporate setting when making the case for information security not only the technology specific detection costs but other costs (capital expenditures, operating costs and opportunity costs) have to be considered. We contribute to the current literature by investigating the spam email and virus problem and demonstrating how theoretical research can really be applied in practice through a real life case study.