Optimizing Information Security Investments with Limited Budget

The importance of information security is constantly increasing with technology becoming more pervasive every day. As a result, the necessity and demand for practical methods to evaluate and improve information security is particularly high. The aim of this paper is to apply mathematical optimization techniques tool improve information security. According to the identified problem structure, a combinatorial optimization model is established. The objective of the presented approach is to maximize system security by choosing the best combination of security controls limited by available budget. In addition, by performing a What-If analysis and systematic budget variations, the decision maker can get improved insights and thus determine an ideal budget proposition yielding the highest benefit among all possible control configurations. An exemplary case study demonstrates how this approach can be used as a tool within the risk management process of an organization.