Return on Information Security Investment

An MBA Dissertation (e-business) that the author completed successfully with distinction. An original generic model that aids organisations to assess the return on information security investment (ROISI) is proposed. The model builds on the notion of a ROISI triad consisting of “Viability of Expenditure”, “Successfulness of Attack” and “Motivation to Attack”. Organisations should aim to strike a balance among these three aspects to find the optimum information security investment. The model is applied to a real organisation to assess the implementation of anti-spam solution in a wired and wireless environment. The text includes a history of information security and can serve as an introduction to information security for the novice.