조직의 특성에 적합한 정보보호 투자 의사결정을 위한 투자 최적화 모델의 비교

다국어 초록 (Multilingual Abstract)

As the information security environment becomes increasingly complex, the issue of efficiently distributing limited resources has become a key task in establishing an organization's security strategy. This study aims to compare and analyze major models for determining the optimal investment level and alternative options in information security, taking into account the effectiveness of security controls, using the dataset employed by Fielder et al. (2016). We analyzed studies that considered factors such as expected damage from vulnerabilities, attack probability, severity, and attack cost, and empirically evaluated the impact of different approaches on security investment decisions. In addition, the cost-effectiveness of security control options was quantitatively compared, and the performance of major models used to calculate the optimal investment size was compared and verified.<BR/> This study confirmed that there are differences in effectiveness and efficiency among the models, suggesting that appropriate investment strategies may vary depending on an organization’s objectives and data environment. It is expected to help information security decision-makers select the most suitable investment decision model for their organizational context and establish more rational investment strategies.