This document summarizes a systematic literature review on how information availability drives information security investments. The review found that while a few studies confirm information availability can directly increase such investments, most literature so far has only indirectly linked information to investments through raising awareness of security needs. The review also noted literature has focused more on developing new evaluation tools than directly examining the relationship between information and investments. Moving forward, the authors encourage more research directly investigating how information availability impacts security spending.

1. Information Availability as Driver of
Information Security Investments:
A Systematic Review Approach
Duy P.T. Dang & Mathews Z. Nkhoma

2. The problems
Making investment decisions for information security is difficult:
–Too much uncertainty / asymmetric information
–What are the values of information security investments?
–How to measure ROI?
Low information security investments
Firms are at risks against cyber-threats

3. The current solutions
Encourage
information
sharing
Reduce
asymmetric
information
Improve
awareness
about
information
security
Improve
investment in
information
security
Does Information only has indirect driving relationship
with Information security investments through the
increase of Awareness?

4. Research questions
• RQ1: What have been done to investigate their
driving function since 2007?
• RQ2: Can information availability (internal and
external) drive information security investments?
 Information Availability’s role in investment is
emphasised

5. Research methodology
• Systematic Literature Review
–Contemporary literature review method
–Covers detailed information during the LR process that is
identifiable and reproducible for future research
• Consists of two parts:
–Descriptive analysis:
Provides the big picture of the literature’s theme
Descriptive statistics to identify the trends over periods of time
–Thematic analysis:
How to reproduce the LR process
Identify the themes and analyse the collected data to come up
with organised findings

6. Research findings (1) – Descriptive Analysis
RQ1: What have been done to investigate IA driving function
since 2007?

7. Research findings (1) – Descriptive Analysis

8. Research findings (2) – Thematic Analysis
RQ2: Can information availability (internal and external) drive
information security investments?
• Few confirmatory studies indicate that information can directly drive
information security investments; despite
–The exploratory literature suggests information availability can
contribute to evaluation of needs to invest in information security
–Focuses much on development of new tools and methods to
evaluate information security investments

9. Synthesis and the way forward
• We encourage future research to focus on
investigating the driving function of Information
Availability to information security investments
• We are also conducting an ongoing research on
this topic by surveying 500+ IT decision-makers
in Vietnam

10. Synthesis and the way forward

11. Q&A
•Duy Dang
–dptdang@gmail.com
–http://rmit.academia.edu/duydang
•Dr. Mathews Nkhoma
–mathews.nkhoma@gmail.com
–http://rmit-
vn.academia.edu/MATHEWSNKHOMA