Framing Information Security Budget Requests to Maximize Investments

Nearly one in three security practitioners believe that the organization they work for under-funds information security efforts. Rational choice and economic models have been developed to help decision makers determine the optimal amount they should spend to protect a set of information assets. These models presume investment decisions are rationally made, despite long-standing behavioral and decision making research to the contrary that shows decisions are not entirely rational when risk and uncertainty are involved. The purpose of this research was to empirically validate our hypothesis that information security investment decision makers exhibit irrational decision making behavior when faced with competing budget alternatives involving risk. Specifically, we test the Framing Effect under Prospect Theory, which suggests that individuals exhibit unique risk attitudes when evaluating gain related and loss related risk decisions. The results of an on-line survey empirically validates our hypothesis that information security investment decision makers in fact exhibit irrational decision making behavior when faced with competing budget alternatives involving risk. High-level decision makers exhibit irrational decision making behavior concerning information security when faced with competing budget alternatives involving risk. The findings suggest that justifying budget requests in terms of assets protected will often garner greater budgets than those framed in terms of the negative ramifications if security investments are not made. The findings also suggest that existing rational choice and economic models for information security investments should be augmented with measurement of risk perception and account for expected decision biases.