11institutetext: Military Academy at ETH Zurich, Department of Defense
Economics

# Cyber-Security Investment in the Context of Disruptive Technologies:
Extension of the Gordon-Loeb Model

Dimitri Percia David 11 0000-0002-9393-1490 Alain Mermoud 11
0000-0001-6471-772X Sébastien Gilliard 11 n.a.

###### Abstract

Cyber-security breaches inflict significant costs on organizations. Hence, the
development of an information-systems defense capability through cyber-
security investment is a prerequisite. The question of how to determine the
optimal amount to invest in cyber-security has been widely investigated in the
literature. In this respect, the Gordon-Loeb model and its extensions received
wide-scale acceptance. However, such models predominantly rely on restrictive
assumptions that are not adapted for analyzing dynamic aspects of cyber-
security investment. Yet, understanding such dynamic aspects is a key feature
for studying cyber-security investment in the context of a fast-paced and
continuously evolving technological landscape. We propose an extension of the
Gordon-Loeb model by considering multi-period and relaxing the assumption of a
continuous security-breach probability function. Such theoretical adaptations
enable to capture dynamic aspects of cyber-security investment such as the
advent of a disruptive technology and its investment consequences. Such a
proposed extension of the Gordon-Loeb model gives room for a hypothetical
decrease of the optimal level of cyber-security investment, due to a potential
technological shift. While we believe our framework should be generalizable
across the cyber-security milieu, we illustrate our approach in the context of
critical-infrastructure protection, where security-cost reductions related to
risk events are of paramount importance as potential losses reach unaffordable
proportions. Moreover, despite the fact that some technologies are considered
as disruptive and thus promising for critical-infrastructure protection, their
effects on cyber-security investment have been discussed little.

###### Keywords:

information systems security economics cyber-security investment Gordon-Loeb
model security analytics.

##  1 Introduction

Cyber-security breaches inflict significant costs on organizations,
businesses, and individuals [4, 13, 21]. As a result, operators of information
systems (IS) must develop an IS-defense capability. In order to build a
capability, investing in material resources is a prerequisite [42, 9, 33]. In
the context of cyber-security, such material resources are composed by
processes, products and/or services that are related to the security
management of IS in general and, among others, to cyber-threats monitoring in
particular [2, 36, 39, 7] – e.g., intrusion-detection systems (IDS).

The cyber-security investment issue has received significant academic
attention (for an extensive literature review, see [36]), and such a
literature is often directly related to practitioners’ needs. For instance, as
organizations face budget constraints, an important challenge for these same
organizations is to maximize the efficiency of any monetary investment in
cyber-security processes, products and/or services [12, 20, 36]. Prior IS
research has produced many quantitative models that propose to optimize such
investment, as well as recommendations to invest in particular technologies or
systems (e.g., [12, 24, 26, 29, 38]). These formal approaches are complemented
by less formal practitioner-oriented discussions [8, 40, 46]. Among all the
available models and approaches, the Gordon-Loeb (GL) model has received wide-
scale acceptance [48]. The GL model is based on microeconomics – more
precisely on the fundamental economic principle of cost-benefit analysis [22,
20] –, establishing a general setup for determining the optimal level of
cyber-security investment. By specifying a security-breach probability
function (SBPF), the GL model attempts to determine the above-mentioned
optimal investment amount for cyber-security processes, products and/or
services (e.g., [10, 22, 28, 20, 47]).

However, the GL model framework evades dynamic issues such as perverse
economic incentives111 For example, externalities arising when the decisions
of one party affect those of others [3]. and the advent of a disruptive222 In
economic terms, the notion of disruptive technology [17] refers to a radically
innovative technology that significantly disrupts existing economic
structures, markets and value networks, thus displacing established leading
products, processes and/or services [17]. Therefore, a disruptive technology
comes from innovation. However, not all innovations are disruptive, even
though they can be revolutionary. For instance, the advent of personal
computers (PC) in the IT landscape can be considered as a disruption. The
multi-purpose functionalities of PCs, as well as their relatively small size,
their extended capabilities, and their low price facilitated their spread and
individual use. PCs displaced large and costly minicomputers and mainframes,
significantly affecting the lives of individuals and the management of
organizations. cyber-security technology [20]. Yet, in the case of the latter,
accounting for such dynamic issues could significantly enrich the initial
model by giving supplementary time-related insights concerning the potential
consequences that disruptive technologies might trigger for cyber-security
investment. If conventional cyber-security processes, products and/or services
such as IDS are essentially assimilated to the targeted event-based detection
approach [2, 39, 7], the swift evolution of both the technological landscape
and cyber-threats calls for a complementary approach based on behavior-anomaly
detection [2, 39, 45, 15, 18, 34, 43], and its subsequent (potentially)
disruptive technologies.

By extending the original GL model to a multi-period setup, and by relaxing
the assumption of a continuously twice-differentiable SBPF, we create room for
additional insights on cyber-security investment by delivering a theoretical
ground that enables to investigate the effect of a disruptive technology on
such investment. In this article, we illustrate the concept of disruptive
technologies through the case of big-data analytics333 In this article, the
term big data refers to data whose complexity impedes it from being processed
(mined, stored, queried and analyzed) through conventional data-processing
technologies [27]. The complexity of big data is defined by three attributes:
$(1)$ the volume (terabytes, petabytes, or even exabytes ($10^{18}$ bytes);
$(2)$ the velocity (referring to the fast-paced data generation); and $(3)$
the variety (referring to the combination of structured and unstructured data)
[27]. The field of BDA is related to the extraction of value from big data –
i.e., insights that are non-trivial, previously unknown, implicit and
potentially useful. BDA extracts patterns of actions, occurrences, and
behaviors from big data by fitting statistical models to these patterns
through different data-mining techniques (e.g., predictive analytics, cluster
analysis, association-rule mining, and prescriptive analytics) [35, 14]. (BDA)
technologies and their related techniques. To the best of our knowledge, our
proposed extension of the GL model is the first approach responding to the
need of capturing the aforementioned time-related insights that a disruptive
technology might bring on cyber-security investment.

The remainder of this article is structured as follows. In Section 2, we
contextualize this research by emphasizing the evolution of cyber-threats
monitoring approaches and their potential disruptive technologies. In Section
3, we present an extension of the GL model and we provide related propositions
in order to create room for capturing the consequences of disruptive
technologies on cyber-security investment. In Section 4, we suggest that our
framework can be applied by critical-infrastructure providers (CIP) in order
to help them optimize their investment in IS defense technologies. In the last
section, we discuss limitations and future work.

##  2 Cyber-Threat Monitoring Approaches

Cyber-threat monitoring approaches can be divided in two broad classes: (1)
targeted event-based detection and (2) behavior-anomaly detection [2, 39].
Both approaches aim to detect suspicious events (i.e., related to security
concerns such as data breaches) through IDS [39]. However, technologies
related to (2) are rapidly evolving and could disrupt the cyber-security
market and the investment in these technologies.

###  2.1 The Targeted Event-Based Detection Approach

For the past three decades, scholars, practitioners, and organizations have
been developing numerous conventional technical means to increase cyber-
security by using signature-detection measures and encryption techniques [7,
6]. However, the success of such conventional approaches has been limited [16,
7, 6, 12].

The targeted event-based detection approach essentially relies on signature-
detection measures in which an identifier is attributed to a known threat444
Common cyber-risks include malware (spyware, ransomware, viruses, worms,
etc.), phishing, man-in-the-middle attacks (MitM), (distributed) denial-of-
service attacks ((D)DoS), malicious SQL injections, cross-site scripting
(XSS), credential reuse, and brute-force attacks. (i.e., a threat that had
been witnessed in the past), so that this threat can be subsequently
identified [7, 39, 2]. Examples of targeted event-based detection include
network-IDS, access-control mechanisms, firewalls and pattern-based antivirus
engines [2, 39, 7]. For instance, a signature-detection technology such as an
anti-virus scanner might detect a unique pre-established pattern of code that
is contained in a file. If that specific pattern (i.e., signature) is
discovered, the file will be flagged in order to warn the end-user that their
file is infected. [7]. Yet, such an approach is becoming more and more
ineffective, as the swift evolution of cyber-threats is becoming more
sophisticated [7, 2, 45, 15]. Over the last decade, cyber-crimes have rapidly
increased because hackers have developed new procedures to circumvent IS
security to gain unauthorized and illegal access to the system. For instance,
as malware spread from one system to the next, hackers employ polymorphic
code555 A polymorphic code is a code that employs a polymorphic engine in
order to mutate while keeping the original algorithm intact. In other terms,
the code changes itself each time it runs, but its semantics – the function of
the code – will not change [19]. techniques in order to (automatically)
rapidly modify the pattern [19], thus evading and circumventing existing
detection mechanisms.666 Additional techniques such as, sandbox resistance,
fast fluxing, adversarial reverse engineering, social-engineering attacks,
spoofing, and advanced persistent threats (APT) are continuously evolving and
spreading [2]. Consequently, such a targeted event-based detection would be
ineffective because of the lag that exists between the development of
signatures and the rapid expansion of cyber-threats. Moreover, zero-day777 A
zero-day vulnerability is a computer-software vulnerability that is either
unknown to or unaddressed by operators who should be interested in mitigating
the vulnerability. Zero-day vulnerabilities enable hackers to exploit it in
order to adversely affect computer programs, networks, and data [25].
vulnerabilities cannot be caught with such an approach.

Therefore, an important limiting factor of the targeted event-based detection
approach is that it is intrinsically reactive in nature [7, 2]. Attributing a
signature to a cyber-threat is always preceded by a cyber-incident, which
implies that signatures are unable to identify unknown and/or emerging
threats. As a consequence, signature-detection measures can be rendered almost
ineffective by hackers [45, 15]. Such a scenario is even amplified in the era
of extended digitization and big data [39]. The reasons are that (1) the swift
development of computer networks (e.g., the extensive use of cloud and mobile
computing) in the past decades generated new channels that expose data to
cyber-attack, thus increasing the pool of systems to be attacked hence
amplifying numerous security issues related to intrusions on computer and
network systems [39]; (2), up to multiple exabytes of information are being
transferred daily, usually impeding the process of the entire set of security
information, e.g., network logs, access records, etc.; (3) the velocity of
data generation makes any type of data processing difficult through
conventional computer hardware and software architectures; (4) the complexity
of data also impedes security information from being processed by conventional
computers, e.g., data come from diverse sources, it is stored in different
formats and on different IT. Hence, the damage done by cyber-threats could be
identified only after an attack, giving hackers more efficient possibilities
to access networks, to hide their presence and to inflict damage [16].

###  2.2 The Behavior-Anomaly Detection Approach

In order to address the drawbacks of the targeted event-based detection
approach, research & development has been focused on a behavior-anomaly
detection approach [16, 39, 34, 18, 15, 43, 45]. Such an approach aims to
detect suspicious/unusual events through the extraction of patterns, by using
behavior anomalies and/or deviations from behaviors (actions, occurrences) of
entities and/or users of a network, rather than patterns of code as in the
case of the targeted event-based detection [16, 39, 34, 18, 15, 43, 45]. The
targeted event-based detection approach is predominantly based on security
analytics888 The field of security analytics aims to detect suspicious events
by extracting patterns related to behavioral anomalies and/or deviations from
behaviors (actions, occurrences) of entities and/or users of a network. In
other words, security analytics methods aim to distinguish patterns generated
by legitimate users from patterns generated by suspicious and/or malicious
users [16]. and aims to provide dynamic detection of cyber-threats through
techniques derived from BDA by fitting statistical models on these patterns
through different techniques (e.g., predictive analytics, cluster analysis,
association-rule mining, and prescriptive analytics) [35, 14] used for network
forensics, traffic clustering and alert correlation [2]. Some examples have
been developed by [43, 18, 34].

Complementing the targeted event-based detection approach by using signature-
detection measures, such a behavior-anomaly detection approach is envisioned
to foster cyber-threats monitoring by increasing its productivity [16].
Examples of security analytics applications are the development of security
information and event management (SIEM). SIEM products and services combine
security-information management (SIM) and security-event management (SEM)
[11]. SIEM provide real-time analysis of information-security alerts generated
by applications and network hardware. SIEM are sold as managed services, as
software, or as appliances [11]. These products and services are also used to
log security data and to generate reports for compliance purposes. SIEM
products and services are widely used within information-security operation
centers (ISOC) – also called fusion centers – of organizations. The open-
threat exchange platform called AlienVault OTX is an example of SIEM products
and services.999 https://www.alienvault.com/

Cyber-security technologies related to the behavior-anomaly detection approach
– and more precisely related to security analytics – are susceptible to
disrupting the cyber-security market [45, 43, 18, 34]. However, the dynamic
(i.e., time related) consequences of such disruptive technologies on cyber-
security investment cannot be analyzed through the existing GL model and its
extensions. They rely on restrictive assumptions that are not adapted for
analyzing dynamic aspects of cyber-security investment [20]. Consequently, a
supplementary extension of the GL model is necessary.

##  3 Extending the Gordon-Loeb Model

By focusing on costs and benefits associated with cyber-security, the GL model
states that each organization’s objective is to maximize its expected net-
benefits in cyber-security function ($ENBIS$) [20]. This corresponds to
minimizing the total expected cost, equivalent to the addition of the expected
loss101010 Wherein $v$ is is the organization’s inherent vulnerability –
defined as the probability that a threat, once realized (i.e., an attack),
would be successful – to cyber-security breaches, (P); and $L$ is the
potential loss associated with the security breach, ($). The model description
and its assumptions were explained in detail by [22, 20]. ($vL$) due to cyber-
security breaches and the expenses ($z$) in cyber-security processes, products
and/or services implemented and/or undertaken in order to counter such
breaches [22, 20]. Figure 1 on page 1 illustrates the maximization of the
expected benefits coming from cyber-security expenditures ($EBIS$).111111 In
order to simplify the illustration, figures 1, 2 and 3 on pages 1 and 3
depicts the $EBIS$ function instead of the $ENBIS$ function. The $ENBIS$
function is obtained by subtracting the investment ($z$) to the $EBIS$
function.

In Section 2, we emphasized that the advent of the behavior-anomaly detection
approach – triggered by security analytics and its use of BDA – is bringing to
the fore new cyber-security technologies that have the potential to disrupt
the cyber-security market [45, 43, 18, 34, 35] by hypothetically bringing
superior returns on investment vis-à-vis conventional measures related to the
targeted event-based detection approach [35]. As a consequence, the $EBIS$
function might shift to the left. Figure 2 on page 2 illustrates the potential
maximization of the $EBIS$ function in the context of BDA. Accordingly:

> Proposition 1: If BDA is employed in order to provide cyber-threats
> monitoring, the $ENBIS$ function will shift to the left due to a greater
> productivity of BDA compared to conventional technologies.

Consequently, the optimal level of cyber-security investment will decrease
from $z^{*}$ to $z^{*}_{d}$ (c.f.: Figure 2 on page 2). For the same level of
protection, investment in cyber-security will decrease – ceteris paribus.
Accordingly:

> Proposition 2: If BDA is implemented in order to provide cyber-threats
> monitoring, the $ENBIS$ function will witness a discontinuity in its domain
> $Z$ due to a greater productivity of BDA compared to conventional
> technologies.

Figure 1: Level of Investment in Cyber-Security
Notes to Figure 1: The original function of the expected benefits in cyber-
security ($EBIS_{0}(z)$) has a do- main $Z$ that yields a distribution between
zero and the monetary value of the expected loss ($vL$) in the absence of any
cyber-security investment. The monetary value (i.e., costs) of the investment
($z$), corresponds to the 45° line. The optimal level of cyber-security
investment ($z^{*}$) is obtained when the difference between benefits and
costs is maximized (tangent to $EBIS_{0}(z)$ – where the marginal benefits are
equivalent to the marginal cost of one – yielding a slope of 45°, in blue).
N.B.: the optimal level of cyber-security investment ($z^{*}$) is smaller than
the expected loss ($vL$) in the absence of any investment. Figure 2: Left
Shift of the Level of Investment in Cyber-Security
Notes to Figure 2: The new function of the expected benefits in cyber-security
($EBIS_{d}(z)$) has also a do- main $Z$ that yields a distribution between
zero and the monetary value of the expected loss ($vL$) in the absence of any
cyber-security investment. The monetary value (i.e., costs) of the investment
($z$), also cor- responds to the 45° line. Similarly to Figure 1, the optimal
level of cyber-security investment ($z^{*}_{d}$) is obtained when the
difference between benefits and costs is maximized (tangent to $EBIS_{d}(z)$,
yielding a slope of 45°, in green). Yet, due to the left shift of the $EBIS$
function (from $EBIS_{0}(z)$ to $EBIS_{d}(z)$), the optimal level of cyber-
security investment also shifts from $z^{*}$ to $z^{*}_{d}$.

Figure 3 on page 3 illustrates such a discontinuity in the $ENBIS$ function
described in Proposition 2. Yet, as the implementation of a disruptive
technology implicitly triggers a productivity differential over time, we
propose to extend the GL model in two distinct but related ways.

Figure 3: Left Shift of the Level of Investment in Cyber-Security Over Time
Notes to Figure 3: In this graph, the horizontal axis represents both
investment ($z$) and time ($t$). The red line represents the function of the
expected benefits in cyber-security over time ($EBIS_{mix}(z)$). The red
dashed line represents the discontinuity in the domain $Z$ of the
$EBIS_{mix}(z)$ function – due to the implementation of a disruptive
technology at time $t_{1}$. Without the implementation of a disruptive
technology, the function of the expected benefits in cyber-security remains
$EBIS_{0}(z)$ (in blue). With the implementation of a disruptive technology
from $t=0$, the function of the expected benefits in cyber-security is
$EBIS_{d}(z)$ (in green). The optimal level of cyber-security investment is
$z^{*}_{mix}=z^{*}_{d}$.

###  3.1 A Temporal Setup

First, in order to capture the advent of a disruptive technology and its
dynamic consequences on cyber-security investment, a temporal setup has to be
implemented. As the GL model was developed for a single-period, it excludes
the fundamental temporal dimension for analyzing the technological-shift
dynamics induced by efficiency improvements. Hence, the extension of the
original single-period model to a multi-period121212 Even though there is
still an open debate in the field of mathematics about whether time should be
considered as continuous or discrete [37], in our proposed extension of the GL
model, we consider time as discrete. Such a choice is determined by the fact
that any further empirical research that would test our extension will be
essentially conditioned by measuring time as a discrete variable.
Consequently, the following extension is based on an antidifference instead of
an antiderivative. setup might bring significant insight in understanding the
dynamic aspects of cyber-security investment that were originally evaded.

Specifically, we adapt the GL model from [20], such as the maximization of the
$ENBIS$ function is determined by an antidifference operator of this same
function, which has the domain $Z\subseteq\mathbb{R}_{\geq 0}$ (representing
the set of investment possibilities, $z_{i}$) at the end of the specified time
horizon $T\subseteq\mathbb{N}$, wherein each period $i\in[1,n]$. This yields:

$\max_{z_{i}\in Z}\Delta^{-1}ENBIS(z_{i})=\max_{z_{i}\in
Z}{\left\\{\sum_{i=1}^{n}[v_{i}-S^{I}_{i}(z_{i,}v_{i})]L_{i}-z_{i}\right\\}}$
(1)

> wherein for each period $i\in[1,n]$:
>
>   * –
>
> $v_{i}$ is the organization’s vulnerability131313 In the original GL model
> [20], the organization’s inherent vulnerability is defined as the
> probability that a threat, once realized (i.e., an attack), would be
> successful. to cyber-security breaches, (probability $\mathbb{P}$);
>
>   * –
>
> $S^{I}_{i}$ is the organization’s security-breach probability function
> (SBPF), defined as the probability that a cyber-security-breach occurs,
> (probability $\mathbb{P}$);
>
>   * –
>
> $z_{i}$ is the organization’s investment in cyber-security, (monetary value
> $);
>
>   * –
>
> $L_{i}$ is the potential loss associated with the security breach, (monetary
> value $).
>
>

###  3.2 A Discontinuity in the Security-Breach Probability Function

Second, the presumed technological shift induced by the superior productivity
of a disruptive technology challenges the assumption of a continuously twice-
differentiable security-breach probability function. The original model
defines continuously decreasing but positive returns to scale of cyber-
security investment. Yet, this continuously twice-differentiable setup leaves
no room for a discrete emergence of a technological shift brought by a
disruptive and more efficient technology.141414 [20] explicitly acknowledge
that they ‘abstract from reality and assume that postulated functions are
sufficiently smooth and well behaved’, thus creating favorable conditions for
applying basic differential calculus, hence simplifying the optimization
problem of the security-investment phenomenon. Although a smooth approximation
of the security-investment phenomenon done by [20] is a reasonable first
approach, in order to deliver insight concerning the problem of determining an
optimal level of cyber-security investment, such an approach lacks realism. As
explicitly mentioned by [20]: […] ‘in reality, discrete investment in new
security technologies are often necessary to get incremental result. Such a
discrete investment results in discontinuities.’ In such a theoretical
framework, the elasticity of the protection of cyber-security processes,
products and/or services evades radical technological progress. However,
technological progress induced by the implementation of a disruptive
technology – such as BDA – could considerably reduce cyber-security investment
by bringing suggestively greater returns on investment.151515 In BDA, an
extremely large, fast paced and complex amount of information can be processed
in significantly shortened time frames and at almost zero marginal cost per
additional unit of information – once the fixed development and implementation
costs of systems and algorithms for investigating threat patterns are invested
[41]. Furthermore, the real-time analytics provided by big-data algorithms are
likely to neutralize any attacker’s information advantage, such that the
probability of a cyber-breach should be reduced. For example, an attacker can
exploit zero-day vulnerabilities by knowing where to attack, whereas the
defender does not know, hence has to protect all potential entry spots. As
real-time analytics reveals both the time and the position of the attack as it
happens, the defender can react precisely on the attacked spot, thus save any
unnecessary investment in the protection of spots that are not attacked.

The investor realizes a Pareto improvement by either obtaining a higher level
of protection for the same investment or by obtaining the same level of
protection at a lower cost; because fewer resources, such as time and human
labor, can be largely substituted by algorithms, and automation might be used.
As a result, with the implementation of BDA, cyber-security investment might
be significantly reduced by disruption: BDA would introduce a discontinuity in
the security-breach probability function, hence modifying the original GL
model assumption of continuity. Accordingly, adapting the security-breach
probability function ($S^{I}$) from [20], we propose the following security-
breach probability function ($S^{I^{\prime}}_{i}$) in order to capture the
advent of a disruptive technology by introducing discountinuity through the
parameter $d_{i}$:

$S^{I^{\prime}}_{i}(z_{i},v_{i})=\frac{v_{i}}{(\alpha_{i}z_{i}+1)^{\beta_{i}+d_{i}}}$
(2)

> wherein for each period $i\in[1,n]$:
>
>   * –
>
> $\alpha_{i}\in\mathbb{R}_{>0}$ and $\beta_{i}\in\mathbb{R}_{\geq 1}$
> represent productivity parameters of a given cyber-security technology at
> period $i$ (i.e., for a given $(z_{i},v_{i})$, the security-breach
> probability function $S^{I^{\prime}}_{i}$ is decreasing in both $\alpha_{i}$
> and $\beta_{i}$);161616 [20] did not specify $\alpha$ and $\beta$. These
> productivity parameters could be, for instance, the relative productivity of
> a given technology when compared to another ($\alpha$) and the joint
> productivity of the same technology when in interaction with a set of
> already employed technologies in an organization ($\beta$).
>
>   * –
>
> $d_{i}$ is a discontinuity parameter at period $i$, and it is represented by
> a dummy variable. This dummy takes the value $0$ when no disruptive
> technology is used, and $1$ otherwise.
>
>

From equation 2, equation 1 can be rewritten as:

$\max_{z_{i}\in Z}\Delta^{-1}ENBIS(z_{i})=\max_{z_{i}\in
Z}{\left\\{\sum_{i=1}^{n}[v_{i}-\frac{v_{i}}{(\alpha_{i}z_{i}+1)^{\beta_{i}+d_{i}}}]L_{i}-z_{i}\right\\}}$
(3)

Although, in order to extend the original GL model, the multi-period setup and
the suggested security-breach probability function ($S^{I^{\prime}}_{i}$)
constitute the main theoretical contributions, the application of this
contribution to a concrete context is necessary in order to exemplify and
demonstrate their relevancy, and to empirically test them in a further
research.

##  4 Application for CIPs

A cyber-security breach inflicted on a critical infrastructure (CI) generates
massive negative externalities, especially due to the increasing
interdependency and to technical interconnectedness of different CIs [22, 1].
As a result, cyber-security issues are the main challenge for CIP [5].
Therefore, the issue of cyber-security investment becomes highly relevant in
the context of CIs, and especially so from a social-welfare perspective [22].

In this respect, cyber-security investment is a national security priority for
the great majority of governments (e.g., [32]). For example, on February 12,
2013, the administration of US President Barack Obama implemented Executive
Order 13636 [31] named Improving Critical Infrastructure Cybersecurity. This
executive order stated that ‘The national and economic security of the United
States depends on the reliable functioning of the Nation’s critical
infrastructure in the face of such threats. It is the policy of the United
States to enhance the security and resilience of the Nation’s critical
infrastructure and to maintain a cyber-environment that encourages efficiency,
innovation, and economic prosperity while promoting safety, security, business
confidentiality, privacy, and civil liberties’ [31]. Following this trend, on
May 11, 2017, the administration of US President Donald Trump implemented
Executive Order 13800 [44], named Strengthening the Cybersecurity of Federal
Networks and Critical Infrastructure. This executive order stated that
‘Effective immediately, each agency head shall use ‘The Framework for
Improving Critical Infrastructure Cybersecurity’ developed by the National
Institute of Standards and Technology, or any successor document, to manage
the agency’s cyber-security risk. Each agency head shall provide a risk
management report to the Secretary of Homeland Security and the Director of
the Office of Management and Budget within 90 days of the date of this order’
[44].

We believe that our suggested extension of the GL model should be
generalizable across any kind of cyber-security concerns, yet we illustrate
our approach in the context of CIP as security-cost reduction related to risk
events are of prior importance because potential losses reach unaffordable
dimensions [22]. Despite the fact that BDA is considered a promising method
for CIP, its concrete implications have not been discussed much.

More specifically, our extension of the GL model provides a theoretical
framework for analyzing the impact of the implementation of any given novel
technology on cyber-security investment over time. In this respect, by
subtracting antidifference operators of $ENBIS$, $\Delta^{-1}ENBIS(z_{i})$, at
two different specified time-span of same duration, ($A-B$), a potential
decrease in cyber-security investment, $\Delta_{Z}$, can be analyzed – ceteris
paribus:

$\Delta_{Z}={\left\\{\Delta^{-1}ENBIS(z_{A})\right\\}}-{\left\\{\Delta^{-1}ENBIS(z_{B})\right\\}}$
(4)

> where $B\subseteq\mathbb{N}$ is a time-span, wherein each period
> $i_{B}\in[n,t]$, and in which a given novel technology is implemented;
> whereas $A\subseteq\mathbb{N}$ is a time-span, wherein each period
> $i_{A}\in[1,m]$, and in which no novel technology is implemented. Note that
> ${\sum_{i=n}^{t}i}$ and ${\sum_{i=1}^{m}i}$ must be equal in order to
> proceed to the comparison.

From equations 1 and 4, equation 5 can be written as:

$\Delta_{Z}={\left\\{\sum_{i=1}^{m}[v_{i}-S^{I}_{i}(z_{i,}v_{i})]L_{i}-z_{i}\right\\}}-{\left\\{\sum_{i=n}^{t}[v_{i}-S^{I}_{i}(z_{i,}v_{i})]L_{i}-z_{i}\right\\}}$
(5)

From the original equation of [20], equation 5 can be rewritten as:

$\Delta_{Z}={\left\\{\sum_{i=1}^{m}[v_{i}-\frac{v_{i}}{(\alpha_{i}z_{i}+1)^{\beta_{i}}}]L_{i}-z_{i}\right\\}}-{\left\\{\sum_{i=n}^{t}[v_{i}-\frac{v_{i}}{(\alpha_{i}z_{i}+1)^{\beta_{i}}}]L_{i}-z_{i}\right\\}}$
(6)

By controlling for every parameters to remain equal between time-span $A$ and
$B$ – except for the domains $Z$, wherein $Z_{A}\neq Z_{B}$ –, an organization
can determine if any given novel technology generates a greater $ENBIS$. If it
is the case, the organization might consider the novel technology implemented
in $B$ as disruptive; inversely, if the $ENBIS$ does not substantially
changes, the implemented novel technology cannot be considered as disruptive.
Note that even though equation 6 can be used for analyzing the differential in
cyber-security investment between two time-spans, equation 3 remains necessary
in order to determine the optimal level of cyber-security investment ($z_{i}$)
through the maximization of the $ENBIS(z_{i})$ function.

The application of our GL model extension to the context of CIP should provide
us with a relevant and seminal basis on which our arguments can be formally
modeled and simulated. In the case of human-processed information and defense
tactics, these issues would probably make the optimal level of protection
difficult to attain or even impossible to finance, as the expected loss would
be extreme in the case of cascading failures of CIs; hence the resulting
cyber-security investment would also have to reach extreme levels. However,
with the effects that the BDA technology (or any similar disruptive
technology) could have on investment in cyber-security, the investment needs
by CIP could remain at the same level or even decrease, as these novel threats
are neutralized by the superior technology that BDA offers.

##  5 Discussion

In this last section, we present our concluding comments, the policy
recommendations resulting from concluding comments, we discuss the limitations
of this study and suggest paths for further research.

###  5.1 Concluding Comments

In this article, we propose an extension of the GL model by adapting its
initial theoretical framework in order to capture time-related insights
related to the consequences that a disruptive technology can have on cyber-
security investment. We propose two important contributions. First, we argue
that a single-period model is not adapted to capture dynamic aspects of cyber-
security investment such as the advent of a disruptive technology. The
extension to a multi-period model is indeed necessary. Second, in the context
of the introduction of a discrete disruptive cyber-security technology, the
security-breach probability function of the original GL model could not be
considered as continuously differentiable. These two arguments enrich the
initial model by giving supplementary insight on cyber-security investment.
Through our extended $ENBIS$ function, our proposed revision of the GL model
captures both the financial consequences on the optimal level of investment
and the security productivity of the advent of any given novel (and
potentially disruptive) technology. Although we believe that this reasoning is
generalizable across a wide range of cyber-security concerns, we illustrate
our approach in the context of CIP, for which cyber-security breaches inflict
unaffordable social costs that urgently need to be reduced.

###  5.2 Considerations for Policy Recommendations

First and foremost, our extension of the GL model is intended to be used for
determining the optimal level of cyber-security investment through the
maximization of the $ENBIS(z_{i})$ function. The optimal level of cyber-
security investment is obtained when the difference between benefits and costs
are maximized – i.e., where the marginal benefits of cyber-security investment
are equivalent to the marginal cost of potential losses due to cyber-security
threats.

Also, our extension of the GL model provides a theoretical framework in order
to analyze the expected net-benefits of the implementation of any given novel
technology over time. By subtracting antidifference operators of $ENBIS$ at
two different specified time-spans, and by controlling for every parameters to
remain equal between two time-spans (except for investment), a potential
decrease in cyber-security investment can be analyzed. Throughout our model,
an organization can determine if any given novel technology generates a
greater $ENBIS$. If it is the case, the organization might consider the novel
technology implemented as disruptive; inversely, if the $ENBIS$ does not
substantially changes, the implemented novel technology cannot be considered
as disruptive.

We presented a dynamic analysis for determining the optimal investment level
for IS defense, in the context of potentially disruptive technologies. By
conceptualizing a security-breach probability function that includes
productivity parameters ($\alpha$ and $\beta$) of a given cyber-security
technology, practitioners can calculate the optimal level of investment in IS
defense processes, products and/or services, and also select them according to
the highest productivity parameters. Although this work remains theoretical,
it gives a systematic method for optimizing IS defense investment in the
context of potentially disruptive technologies.

###  5.3 Limitations and Paths for Further Research

Finally, our research design – based on theoretical modeling and utility
maximization – has some limitations that future research could help relax.

First, the productivity parameters ($\alpha_{i}$ and $\beta_{i}$) of a given
cyber-security technology are theoretically conceptualized, but not
empirically measured. Such an effort could add a substantive benefits in terms
of validation/refutation of our propositions. However, researchers might find
it difficult to gain access to data as they are substantially difficult to
measure and/or to find [30]. A possible solution in order to measure these
productivity parameters could be derived from equation 6, by computing the
ratio between $Z_{B}$ and $Z_{A}$. By doing so, a relative measure of
productivity between a technology employed in $\Delta^{-1}ENBIS(z_{A})$ and a
technology employed in $\Delta^{-1}ENBIS(z_{B})$ could be extracted.

Second, the term disruptive technologies [17] has been qualitatively defined,
but not quantitatively delimited. Such a research effort is necessary in order
to delimit the dummy variable $d_{i}$ (that takes the value $0$ when no
disruptive technology is used, and $1$ otherwise). Again, such a quantitative
delimitation could be drawn by determining a threshold value in the
aforementioned ratio between $Z_{B}$ and $Z_{A}$.

Third, and consequently, this article formally modeled an extension to the GL
model, but it did not simulate or empirically test our suggested extension. We
decided to leave this operationalization to future research as we wanted to
focus on the generalizability of the model. Any simulation or empirical
operationalization requires a specification of the above-mentioned
productivity parameters $\alpha_{i}$ and $\beta_{i}$ of each technology
considered for investment, as well as the specification of the dummy variable
$d_{i}$ for classifying which technologies are considered disruptive (and
when). Such choices make the model more specific to particular assumptions
about technological and productivity contexts. Hence, we suggest that our
model should be operationalized by a series of different simulations and
empirical tests, rather than by one illustrative simulation run. Given the
fact that specifications of such simulations and/or empirical tests would
require multiple cases and thus multiple contexts (and thus multiple
articles). Nevertheless, we recommend that future research simulates, tests
and develops further the model we proposed here.

Fourth, the security-breach probability function $S^{I^{\prime}}_{i}$ that we
employed in this work can be replaced by many other families of more complex
functions. In this research, we selected the first family of security-breach
probability function proposed by [20], namely $S^{I}$. However, in reality,
adding more families of functions could enrich the analysis (e.g., [28]).

Once the aforementioned points are defined by empirical analyzes and field
surveys, further research could propose to simulate a multi-player and multi-
period game (e.g., [23]) that models the cyber-security for CIP in the era of
disruptive technologies. Such research – by collecting simulated data and
quantitatively analyzing them – would contribute to complement the theoretical
approach presented in this article, hence test the intuition of our
theoretical development.

## References

  * [1] Alcaraz, C., and Zeadally, S. Critical infrastructure protection: Requirements and challenges for the 21st century.  53–66.
  * [2] Amini, L., Christodorescu, M., Cohen, M. A., Parthasarathy, S., Rao, J., Sailer, R., Schales, D. L., Venema, W. Z., and Verscheure, O. Adaptive cyber-security analytics.  Tech. rep., 2015.  US Patent 9,032,521.
  * [3] Anderson, R. Why information security is hard – an economic perspective.  In Seventeenth Annual Computer Security Applications Conference (2001), IEEE, pp. 358–365.
  * [4] Anderson, R., Barton, C., Böhme, R., Clayton, R., van Eeten, M. J. G., Levi, M., Moore, T., and Savage, S. Measuring the cost of cybercrime.  In The Economics of Information Security and Privacy, R. Böhme, Ed. Springer, 2013, pp. 265–300.
  * [5] Anderson, R., and Fuloria, S. Security economics and critical national infrastructure.  In Economics of Information Security and Privacy, T. Moore, D. Pym, and C. Ioannidis, Eds. Springer, 2010, pp. 55–66.
  * [6] Anderson, R., and Moore, T. The economics of information security.  610–613.
  * [7] Anderson, R. J. Security Engineering: A Guide to Building Dependable Distributed Systems.  John Wiley & Sons, 2010.
  * [8] Azorin, P. Cybersecurity & data privacy trends in 2020.
  * [9] Barney, J. Firm resources and sustained competitive advantage.  99–120.
  * [10] Baryshnikov, Y. IT security investment and gordon-loeb’s 1/e rule.  In 2012 Workshop on the Economics of Information Security (2012).
  * [11] Bhatt, S., Manadhata, P. K., and Zomlot, L. The operational role of security information and event management systems.  35–41.
  * [12] Böhme, R. The Economics of Information Security and Privacy.  Springer, 2013.
  * [13] Campbell, K., Gordon, L. A., Loeb, M. P., and Zhou, L. The economic cost of publicly announced information security breaches: Empirical evidence from the stock market.  431–448.
  * [14] Cardenas, A. A., Manadhata, P. K., and Rajan, S. P. Big data analytics for security.  74–76.
  * [15] Casas, P., Soro, F., Vanerio, J., Settanni, G., and D’Alconzo, A. Network security and anomaly detection with big-dama, a big data analytics framework.  In IEEE 6th International Conference on Cloud Networking (CloudNet’17) (2017), IEEE, pp. 1–7.
  * [16] Chen, H., Chiang, R. H. L., and Storey, V. C. Business intelligence and analytics: From big data to big impact.  1165–1188.
  * [17] Christensen, C. M., Raynor, M., and McDonald, R. What is disruptive innovation?  44–53.
  * [18] Cui, B., and He, S. Anomaly detection model based on hadoop platform and weka interface.  In 10th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS’16) (2016), IEEE, pp. 84–89.
  * [19] Forest, E., Schmidt, F., and McIntosh, E. Introduction to the polymorphic tracking code.  2002\.
  * [20] Gordon, L. A., and Loeb, M. P. The economics of information security investment.  438–457.
  * [21] Gordon, L. A., Loeb, M. P., Lucyshyn, W., and Richardson, R. 2005 csi/fbi computer crime and security survey.  1\.
  * [22] Gordon, L. A., Loeb, M. P., Lucyshyn, W., and Zhou, L. Externalities and the magnitude of cyber security underinvestment by private sector firms: A modification of the gordon-loeb model.  24–30.
  * [23] Grossklags, J., Christin, N., and Chuang, J. Secure or insure?: A game-theoretic analysis of information security games.  In Proceeding of the 17th International Conference on World Wide Web (2008), ACM Press, pp. 209–218.
  * [24] Herath, H. S., and Herath, T. C. Investments in information security: A real options perspective with bayesian postaudit.  337–375.
  * [25] Holm, H. Signature-based intrusion detection for zero-day attacks: (not) a closed chapter?  In 47th Hawaii International Conference on System Sciences (2014), IEEE, pp. 4895–4904.
  * [26] Jerman-Blažič, B., et al. Quantitative model for economic analyses of information security investment in an enterprise information system.  276–288.
  * [27] Laney, D. 3d data management: Controlling data volume, velocity and variety.  1\.
  * [28] Lelarge, M. Coordination in network security games: a monotone comparative statics approach.  2210–2219.
  * [29] Li, J., and Su, X. Making cost effective security decision with real option thinking.  In International Conference on Software Engineering Advances (ICSEA 2007) (2007), IEEE, pp. 14–14.
  * [30] Moore, T., Kenneally, E., Collett, M., and Thapa, P. Valuing cybersecurity research datasets.  In Proceedings of the Workshop on the Economics of Information Security (WEIS’19) (2019), pp. 1–27.
  * [31] Obama, B. Executive order (13636) – improving critical infrastructure cybersecurity, 2013.
  * [32] OECD.  Cybersecurity Policy Making at a Turning Point: Analysing a New Generation of National Cybersecurity Strategies for the Internet Economy.  OECD Publishing, 2012.
  * [33] Penrose, E. The Theory of the Growth of the Firm, 4 ed.  Oxford University Press, 2009.
  * [34] Sait, S. Y., Bhandari, A., Khare, S., James, C., and Murthy, H. A. Multi-level anomaly detection: Relevance of big data analytics in networks.  1737–1767.
  * [35] Sathi, A. Big Data Analytics: Disruptive Technologies for Changing the Game.  Mc Press, 2012.
  * [36] Schatz, D., and Bashroush, R. Economic valuation for information security investment: a systematic literature review.  1205–1228.
  * [37] Serfozo, R. F. An equivalence between continuous and discrete time markov decision processes.  616–620.
  * [38] Shirtz, D., and Elovici, Y. Optimizing investment decisions in selecting information security remedies.  95–112.
  * [39] Singh, J., and Nene, M. J. A survey on machine learning techniques for intrusion detection systems.  4349–4355.
  * [40] Smeraldi, F., and Malacaria, P. How to spend it: optimal investment for cyber security.  In Proceedings of the 1st International Workshop on Agents and CyberSecurity (2014), ACM, p. 8.
  * [41] Sowa, J. F. Conceptual Structures: Information Processing in Mind and Machine, 1 ed.  Systems Programming Series. U.S. Department of Energy Office of Scientific and Technical Information, 1983.
  * [42] Teece, D. J. A capability theory of the firm: an economics and (strategic) management perspective.  1–43.
  * [43] Terzi, D. S., Terzi, R., and Sagiroglu, S. Big data analytics for network anomaly detection from netflow data.  In International Conference on Computer Science and Engineering (UBMK’17) (2017), IEEE, pp. 592–597.
  * [44] Trump, D. Presidential executive order (13800) – strengthening the cybersecurity of federal networks and critical infrastructure, 2017.
  * [45] Wang, Y., Wang, Y., Liu, J., and Huang, Z. A network gene-based framework for detecting advanced persistent threats.  In Ninth International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC’14) (2014), IEEE, pp. 97–102.
  * [46] Weinberger, S. Computer security: Is this the start of cyberwarfare?  142–145.
  * [47] Willemson, J. Extending the gordon and loeb model for information security investment.  In 2010 International Conference on Availability, Reliability and Security (2010), IEEE, pp. 258–261.
  * [48] Zhou, L., Loeb, M. P., Gordon, L. A., and Lucyshyn, W. Empirical evidence on the determinants of cybersecurity investments in private sector firms.  720–726.