On the Singularity of Valuating IT Security Investments

Companies spend considerable amounts of resources on minimizing security breaches but often neglect to implement efficient ones and are not aware whether their investments are effective. Literature provides many approaches aiming to define the value of IT security investments but often can not fulfill the expectation of decision makers in practice, e.g. due to lacking support for considering multiple objectives, business issues or a variety of investment alternatives. This paper identifies criteria for proper IT security evaluation methods from literature and evaluates some selected methods in order to show their applicability in practice. A focus of this evaluation lies on the comparison to methods for IT investment evaluation, in order to answer the question what the difference of evaluating IT investments and IT security investments is.