• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.10a
• /
• pp.349-352
• /
• 2017

Since the early 2000s, many information security professionals have sought to measure the effectiveness of information security investments. Such efforts have devised a number of ways to calculate the return in ROSI (Return On Security Investment) including the Gordon & Loeb method for calculating cyber damage. However, due to the characteristics of information security structure, the lack of relate information sharing, and many qualitative factors are included, the damage calculation is inaccurate.. This study reviews related studies, analyzes the Gordon & Loeb method and the Shin-Jin method, which are considered to be the most efficient of the existing methods, and designs improved methods.

• The Journal of Society for e-Business Studies
• /
• v.20 no.2
• /
• pp.93-106
• /
• 2015

Providing trading partners with personal information to establish an e-commerce financial transaction is inevitable. Most e-commerce companies keep personal information and transaction data for user's convenience and develop additional services as their applications. However, keeping personal information increases the likelihood of identity theft causing direct or indirect damage while it may simplify repetitive financial transactions. This study introduces risk management methods based on quantitative and qualitative analysis including demand-supply curve model and Gordon & Loeb model to analyze the risks for security management. The empirical analysis with survey results from KISA (Korea Information Security Agency) shows that the root cause of different statistics of personal information leakage incidents according to core business of internet companies is the difference in their Loss Expectancy caused by them. Also we suggest disciplinary compensation and higher standard for personal information protection as a solution to prevent the variation of investment on it between individual companies.