IDEAS home Printed from
   My bibliography  Save this article

IT security planning under uncertainty for high-impact events


  • Rakes, Terry R.
  • Deane, Jason K.
  • Paul Rees, Loren


While many IT security incidents result in relatively minor operational disruptions or minimal recovery costs, occasionally high-impact security breaches can have catastrophic effects on the firm. Unfortunately, measuring security risk and planning for countermeasures or mitigation is a difficult task. Past research has suggested risk metrics which may be beneficial in understanding and planning for security incidents, but most of these metrics are aimed at identifying expected overall loss and do not directly address the identification of, or planning for, sparse events which might result in high-impact loss. The use of an upper percentile value or some other worst-case measure has been widely discussed in the literature as a means of stochastic optimization, but has not been applied to this decision domain. A key requirement in security planning for any threat scenario, expected or otherwise, is the ability to choose countermeasures optimally with regard to tradeoffs between countermeasure cost and remaining risk. Most of the planning models in the literature are qualitative, and none that we are aware of allow for the optimal determination of these tradeoffs. Therefore, we develop a model for optimally choosing countermeasures to block or mitigate security attacks in the presence of a given threat level profile. We utilize this model to examine scenarios under both expected threat levels and worst-case levels, and develop budget-dependent risk curves. These curves demonstrate the tradeoffs which occur if decision makers divert budgets away from planning for ordinary risk in an effort to mitigate the effects of potential high-impact outcomes.

Suggested Citation

  • Rakes, Terry R. & Deane, Jason K. & Paul Rees, Loren, 2012. "IT security planning under uncertainty for high-impact events," Omega, Elsevier, vol. 40(1), pages 79-88, January.
  • Handle: RePEc:eee:jomega:v:40:y:2012:i:1:p:79-88

    Download full text from publisher

    File URL:
    Download Restriction: Full text for ScienceDirect subscribers only

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    1. Cha, Young-Ho & Kim, Yeong-Dae, 2010. "Fire scheduling for planned artillery attack operations under time-dependent destruction probabilities," Omega, Elsevier, vol. 38(5), pages 383-392, October.
    2. Sawik, Tadeusz, 2010. "An integer programming approach to scheduling in a contaminated area," Omega, Elsevier, vol. 38(3-4), pages 179-191, June.
    3. Sawik, Tadeusz, 2011. "Selection of supply portfolio under disruption risks," Omega, Elsevier, vol. 39(2), pages 194-208, April.
    4. Liu, Zugang & Nagurney, Anna, 2011. "Supply chain outsourcing under exchange rate risk and competition," Omega, Elsevier, vol. 39(5), pages 539-549, October.
    5. Rockafellar, R. Tyrrell & Uryasev, Stanislav, 2002. "Conditional value-at-risk for general loss distributions," Journal of Banking & Finance, Elsevier, vol. 26(7), pages 1443-1471, July.
    Full references (including those not matched with items on IDEAS)


    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.

    Cited by:

    1. Schilling, Andreas & Werners, Brigitte, 2016. "Optimal selection of IT security safeguards from an existing knowledge base," European Journal of Operational Research, Elsevier, vol. 248(1), pages 318-327.
    2. Qian, Fubin & Gribkovskaia, Irina & Laporte, Gilbert & Halskau sr., √ėyvind, 2012. "Passenger and pilot risk minimization in offshore helicopter transportation," Omega, Elsevier, vol. 40(5), pages 584-593.
    3. Durbach, Ian N. & Stewart, Theodor J., 2012. "A comparison of simplified value function approaches for treating uncertainty in multi-criteria decision analysis," Omega, Elsevier, vol. 40(4), pages 456-464.
    4. Martzoukos, Spiros H. & Zacharias, Eleftherios, 2013. "Real option games with R&D and learning spillovers," Omega, Elsevier, vol. 41(2), pages 236-249.


    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:eee:jomega:v:40:y:2012:i:1:p:79-88. See general information about how to correct material in RePEc.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: (Dana Niculescu). General contact details of provider: .

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service hosted by the Research Division of the Federal Reserve Bank of St. Louis . RePEc uses bibliographic data supplied by the respective publishers.