Abstract:

In order to study the impacts of externalities of information security investment,the Gordon-Loeb model was extended to a multi-organization game environment.The relationships of the optimal information security investment with vulnerability,potential loss and investment effectiveness when confronted with different attack types under the positive and negative externalities were obtained respectively,and the difference with the optimal information security investment under the social optimum condition was compared.The results show that there were some similarities in the varying pattern of information security investment between the condition of the positive externality and a single organization,but information security investment under the negative externality changes greatly and was generally more cautious,and attack types also have important impacts on information security investment.

Key words: information security investment, Gordon-Loeb model, externality, attack type