Firm's Strategic Decision Process Modeling in Security Investment

Growing interest in information security technologies and security investments has resulted in many studies analyzing the information security investment process of firms and individuals. Existing studies, however, have focused on illustrating the behavior of a defender or an attacker unilaterally rather than observing the interaction of two players simultaneously. This study, therefore, expands the model of a defender's decision-making process that started with the accounting model, analyzes strategic behavior of an attacker and models the interactive decision-making process of two players. The most significant point of this study is to model the interaction of the two players making optimal decisions in relation to each other's decisions. In addition, we compared the equilibrium of a simultaneous game with a sequential game in which one player moves first and the other moves later. The late mover observes the behavior of the first mover and then decides its own behavior. We show the best point of time for the firm to invest in information security.