Marcus Thorén , pp. 34. MAM/Sektionen för Management, 2005.
My interviews show that the organisations did different types of economic assessments. In two of the four cases the economic judgement was based on the size of the investment cost. One of the organisations was influenced in their assessment from another organisation’s experiences in network security.
The study shows that organisations prefer small investment costs within network security depending on the rapid progress of the IT-development. Doing many small network security investments instead of a few and expensive ones, can enable the company to adjust its network security products when new types of threats appear as viruses or force attacks.
One organisation assessed their investments based on earlier experiences from another organisation. The other organisation described their own negative economic consequences. As a result, the probability of an attack was influenced by the so called availability bias.