What drives cybersecurity investment?

What drives cybersecurity investment?: Organizational factors and perspectives from decision-makers

de Vries, Jennie (TU Delft Technology, Policy and Management)

Pieters, W. (mentor)
Kroesen, M. (mentor)
van Gelder, P.H.A.J.M. (mentor)

Delft University of Technology

Systems Engineering, Policy Analysis and Management (SEPAM)

2017-09-29

One of the leading perspectives from literature is that decisions about investments should be made based on a comprehensive cost-benefit analysis and on a cyber-risk assessment. However, many organizations do not undertake this sophisticated analyses due to the lack of available data about costs, benefits and the impact and likelihood of attacks. This study tries to increase the understanding of this decision-making process, and how organizational factors and individual perspectives influence this process. The Global Information Security Survey has been subjected to a latent class analysis to find investment strategies and organizational factors that influence these. Four different investment strategies were identified and mainly differ in their initial investment and change in the coming twelve months. Organizational factors that influence these investment strategies are size, revenue, type (public/private) and budget and other factors as regulation, management awareness, incidents and type of risks. We used the q-method to investigate underlying perspectives from decision-makers. Four different perspective were found and differ in their focus on concerns, resilience, hierarchy and flexibility.

cybersecurity
investment
decision-making
perspectives
risk-management

http://resolver.tudelft.nl/uuid:119719ff-cb69-44c5-a566-3ee8373509f7

Student theses

master thesis

© 2017 Jennie de Vries