The most pressing cyberthreats once came from emailed viruses, but today’s cyberattacks increasingly take the form of massive identity and intellectual property thefts and the potential for physical damage to critical infrastructure. As cyberattacks have proven to be increasingly disruptive to the economy, a growing body of scholarship examines how much firms should invest in protection and what are appropriate roles for governments. Gordon and Loeb, GL [1] , and later, Gordon, Loeb, Lucyshyn and Zhou, GLLZ [2] , are leaders in examining the optimal level of spending that organizations should optimally invest in cybersecurity. Their approach uses an unconstrained expected profit maximization model where cybersecurity investments are separable from other activities of the firm. The benefit to the firm from a cybersecurity investment is a cost reduction; the remaining probability of a security breach (S(z)) times the loss (L), which can be altered based on investing in cybersecurity, z. GL analyzed direct (private) damages while GLLZ extended the model to include external damages.

GL and GLLZ investigate the implications of their model in some detail after first deriving the condition that the optimum (interior) investment is found where the incremental benefits of information security equal the incremental costs. As the optimal investment is shown to be increasing in damages (losses), including external damages increases the optimal level of investment. As with standard models of investment, an organization that only considers private losses in its optimization is correct if there are no external losses; but if external losses exist then optimum social expenditures increase. By investigating several functional forms for the security breach function, GL and later researchers showed that it is not uncommon for investments to have a maximum of about 37 percent of expected losses although this result is conditional on the specification.

This paper proceeds by investigating extensions to the GL and GLLZ models implied by a general investment model for homeland security expenditures. A review of legal cases involving cybersecurity breaches is then used to assess the implications of including external costs in the optimal investment model.

While GL and GLLZ examine how much an individual firm should invest in preventing a cyberattack, related work by Farrow [3] investigates a set of expected, constrained cost minimization models for homeland security expenditures. The models were originally conceived to support Government performance audits in the US Government Accountability Office. The GL, GLLZ and Farrow models make similar simplifying assumptions about the relevance of expected value decision-making, continuity and derivatives of key functions¹. The core similarities and differences are investigated below followed by several extensions presented in Farrow. The extensions illustrate modifications to investment rules where there are different types of constraints, interactions, and investment alternatives.

A summary of the definitions for the general homeland security investment model based on Farrow [3] is below. The “organization” referred to was originally modeled as the government, since governments are expected to consider both direct and external effects and assumed to select the socially optimal outcome. The organization could also be a firm or consumer. However, these organizations are typically modeled as having different objective functions. While the government is concerned with minimizing overall social costs, a self-interested firm or consumer will not consider the external effects of its choices unless there is some feedback mechanism, such as legal liability, which incentivizes the firm or individual to internalize the costs it creates for others.

Define:

e_i: organizational security expenditures on site i.

: an aggregate expenditure constraint over all sites and pathways.

P(e_i): probability of an event. P′ < 0; P″ > 0 where P' is the partial derivative and functions are assumed to be twice continuously differentiable. This assumes some behavior or reaction function on the part of the attacker such that expenditures could alter their choice of targets or the expenditures could lead to capture prior to an attack.

S(e_i): additional costs incurred as a result of the investment expenditure whether for the expending organization or third parties such as time in security lines or changes in productivity which are not part of the budget constraint, expect S′ > 0.

C(e_i): social cost given an event happens, C′ < 0; C″ > 0, which includes direct costs to the organization, C^D(e_i) and costs external to the organization (external costs) C^E(e_i). Note that the constrained expenditure amount e_i is always assumed to be obligated and spent whether or not an attack occurs. It is the social cost, C, that is conditional on the event occurring.

The organization’s investment problem is stated as choosing the level of expenditure at each site () in order to minimize expected social cost:

Min

Subject to:

The unconstrained minimization form of the problem is that used by Baryshnikov [5] in his extension of the underlying mathematical properties of the GL model and by Gordon, Loeb and Lucyshyn [6] . The GL and GLLZ models can be seen as the dual of the Farrow model prior to the inclusion of constraints―maximizing cost reductions is the dual of minimizing costs for an interior solution [6] .

GL and GLLZ do not consider a budget constraint, although they note that conflict between the Chief Information Officer and the Chief Executive Officer may affect the derivation of the optimal amount. In many instances, a budget constraint may be a more realistic decision context. In the budget constrained problem, a budget larger than the optimum expenditure yields the unconstrained solution (the constraint is not binding) while a binding constraint implies a shadow price affecting the expenditure allocation. At the same time, the parameterization in GL adds greater interpretation to the Farrow results.

The notation changes and constraints to place the GL model in the Farrow notation are as below (Table 1).

Farrow investigated several cases which can be considered extensions of the GL and GLLZ models². Security and investment concerns modeled by these extensions include:

1) Multiple sites with a budget constraint: The primary difference compared to GL and GLLZ is inclusion of the shadow price of the constraint. First order conditions require that the marginal (incremental) benefit of the investment equal the marginal cost at each site where the marginal cost takes into account the shadow price associated with the binding constraint. Further, marginal expected social costs avoided―the benefits―are to be equated across sites. Where such equality cannot occur, some sites have zero optimal investment. In application, GL appear to follow such an approach for multiple information sets [7] .

2) Probability and consequence reductions: Investments may reduce not only the probability of an attack but the loss from the attack. When these impacts are separated, investments should occur until the incremental return per dollar invested is the same across the probability and consequence domains. Recent cybersecurity approaches echo this conclusion by extending cybersecurity beyond protecting access to actions designed to limit internal and external damage.

3) Attacker diversion: Investments in defense by one organization may divert attacker effort to another site. If larger firms are better protected than smaller firms, whether in the defense industry or elsewhere; the probability of attack may increase at less defended sites.

4) Continuous asymmetric focus or advanced persistent attack: Limitations on ability to defend a site or consequences of an attack may lead to optimal inequality of defense across sites and information sets as security may not be reducible to the level desired in the absence of such persistent attacks.

5) Shared filtering or defenses: The benefit of the investment includes the sum of benefits across all units to the extent that defensive activity reduces damages at other sites through positive external effects. This may occur for example if government or the private sector provides centralized hacker detection. The centralization