Research on the Information Security Investment Strategies Considering Budget Constraints and the Attacker's Preferences

Information security investment is the basis to ensure the stable operation of information systems. By adopting expected utility theory, the paper studies the influences of budget constraints, attacker preferences, attack types and other factors on firm information security investment strategies. The results show, under a certain budget constraint, when opportunistic attackers prefer to select attack targets from the system vulnerability and targeted attackers prefer to select attack targets from the value of information assets, the optimal information security investment of a firm has a minimum value and the minimum value increases with the security investment efficiency of defending against targeted attacks. When the network exposure is small, investment on defending against targeted attack decreases with the network exposure. When the network exposure is relatively large, security investment on defending against targeted attack increases with the network exposure, and security investment on defending against opportunistic attack decreases with the network exposure.