تصمیمات سرمایه گذاری امنیت اطلاعات شرکت؛ شواهد بازار سهام از رفتار سرمایه گذاران

In the information society, it is important for firms to manage their core information resources securely. However, the difficulty of measuring the return on an IT security investment is one of the critical obstacles for firms in making such investment decisions. By utilizing event methodology, this study examines the value of an investment in IT security, based on stock market investors' behavior toward a firms' IT security investment announcements. Based on a sample of 101 investment announcements of firms whose stocks are publicly traded in the U.S. stock market between 1997 and 2006, we find substantial support for the hypotheses that information security investment leads to positive abnormal returns for firms. Interestingly, security investments with commercial exploitation tend to result in higher returns than those for IT security improvement. Another interesting finding is that stock market reaction to security investments shows higher abnormal returns after the Sarbanes–Oxley Act (SOX) than any of those before it.

In examining the recent business environment, the Internet is a critical infrastructure for many organizations. In this electronically networked world, it is more important for organizations to manage various risks on IT components than to apply IT for competitive advantages [14]. As networked computers and connections to the Internet flourish, the numbers of unsecured and unpatched computers on the networks have also increased substantially in the recent past. These unsecured computers may result in serious threats to organizations and individuals alike. According to Computer Emergency Readiness Team (CERT), the number of computer security incidents has increased dramatically from 1996 to 2003

In an information society, investments in data and information security are unavoidable expenses for firms. However, it is difficult for them to measure the direct return from IT security investments. Based on our main hypothesis, that firms' IT security investment decisions will cause a positive reaction from investors in the stock market, this study found a meaningful result in that announcements regarding information security investment generate tangible returns from the stock market as an abnormal return. This study result can be interpreted that investors positively react toward a firm's IT security investment decision.