Extending the Gordon and Loeb Model for Information Security Investment

In this paper we study the information security investment model proposed by Gordon and Loeb. We argue that the original model is missing at least one important restriction concerning monotonicity of the remaining vulnerability viewed as a function of original vulnerability level, and propose adding the respective condition. We present a new family of remaining vulnerability functions satisfying all the conditions and generalizing all the currently known example function families.