Systematic Review Approaches to Information Security Investment

Information security is an extremely important aspect of information systems. A lot of research has been done in the field of technological security of information, but with the development of security needs, attention has been paid to the role of management in information security. Economic valuation of investment in the information security of organizations is one of the issues of management in this field. In this research, to examine the issue of evaluating investment in information security and finding suitable methods for it, a systematic review of the approaches in information security investment has been done. Other goals of this study are to study the evolution of approaches used in the years 2006 to 2017. In order to carry out this systematic review of all studies in the field of information security investment using the research keywords, extracted Springer, IEEE-Explore, Web of Science, Science Direct databases, ultimately 146 articles related to This topic have been investigated. The research findings identified eight main approaches (game theory, risk-based approach, decision support systems, Utility maximization, rate of return on investment, Net Present Value, expected utility theory, real options theory). According to the results of this research there has been more interested in using game theory in recent years.