IT security risk management under network effects and layered protection strategy

Abstract

This paper considers the implications of network effects and distinction of security measures in the risk management procedure. We compare three models in the risk management procedure: without network effects and general protection measures, without network effects but with general protection, and with both network effects and general protection measures. The paper details the impact in terms of security risks, investment levels, and benefits of security investment, in the three models. We show that the preferable way to conduct risk management procedure is to follow the latter of the three models.