Profit-maximizing firm investments in customer information security
Profit-maximizing firm investments in customer information security
复制标题
DOI：
10.1016/j.dss.2011.02.009
复制
发表时间：
2011-11
期刊：
影响因子：
--
通讯作者：
Y. Lee;R. Kauffman;Ryan Sougstad
中科院分区：
文献类型：
--
作者：
Y. Lee;R. Kauffman;Ryan Sougstad
当客户与公司互动时，大量的个人信息通常是在个人不知情的情况下收集的。处理这类信息会带来重大风险。提供保护可能会降低私人信息丢失和滥用的风险，但它会给公司及其客户带来一些成本。尽管如此，客户信息安全漏洞仍有可能发生。它们具有几个不同的特征：(1)通常很难量化与其相关的金钱损失；(2)客户信息安全漏洞可能是由故意攻击以及无意的组织和客户行为造成的；以及(3)此类事件的频率通常很低，尽管发生此类事件可能会造成非常高的代价。因此，使用历史数据的预测模型和解释性统计分析并不有效。提出了一种客户信息安全投资的利润优化模型。我们的方法是基于金融经济学中的风险价值方法和操作风险建模。这项工作的主要结果是：(1)为客户信息安全投资的风险和回报之间的权衡提供指导；(2)为卖家定义技术支持的风险补偿的有效投资范围；(3)模型如何处理政府指令的投资水平与技术投资的自我监管；以及(4)当公司能够将部分成本转嫁给消费者时，描述客户信息安全投资水平的特征。我们使用开放安全基金会的经验数据来说明我们的理论发现，作为我们的分析的基础，并为读者提供对我们的理论和主要结果的管理解释的直觉。结果表明，我们可以根据与客户信息安全相关的可评估风险和损失来缩小解决方案提供商和政策制定者的决策集。我们还讨论了我们的方法在实践中的应用。
When a customer interacts with a firm, extensive personal information often is gathered without the individual's knowledge. Significant risks are associated with handling this kind of information. Providing protection may reduce the risk of the loss and misuse of private information, but it imposes some costs on both the firm and its customers. Nevertheless, customer information security breaches still may occur. They have several distinguishing characteristics: (1) typically it is hard to quantify monetary damages related to them; (2) customer information security breaches may be caused by intentional attacks, as well as through unintentional organizational and customer behaviors; and (3) the frequency of such incidents typically is low, although they can be very costly when they occur. As a result, predictive models and explanatory statistical analysis using historical data have not been effective. We present a profit optimization model for customer information security investments. Our approach is based on value-at-risk methods and operational risk modeling from financial economics. The main results of this work are that we: (1) provide guidance on the trade-offs between risk and return in customer information security investments; (2) define the range of efficient investments in technology-supported risk indemnification for sellers; (3) model how to handle government-dictated levels of investment versus self-regulation of investments in technology; and (4) characterize customer information security investment levels when the firm is able to pass some of its costs on to consumers. We illustrate our theoretical findings with empirical data from the Open Security Foundation, as a means of grounding our analysis and offering the reader intuition for the managerial interpretation of our theory and main results. The results show that we can narrow the decision set for solution providers and policy-makers based on the estimable risks and losses associated with customer information security. We also discuss the application of our approach in practice.