Towards a Multi-objective Optimization Model to Support Information Security Investment Decision-making

The protection of assets, including IT resources, intellectual property and business processes, against security attacks has become a challenging task for organizations. From an economic perspective, rms need to minimize the probability of a successful security incident or attack while staying within the boundaries of their information security budget in order to optimize their investment strategy. In this paper, an optimization model to support information security investment decision-making in organizations is proposed considering the two con icting objectives (simultaneously minimizing the costs of countermeasures while maximizing the security level). Decision models that support the rms’ decisions considering the trade-o between the security level and the investment allocation are bene cial for organizations to facilitate and justify security investment choices.