Investigating security investment impact on firm performance

• Pages: 194-208
• DOI: https://doi.org/10.1108/IJAIM-04-2014-0026
• Published date: 29 July 2014
• Date: 29 July 2014
• Author: Ranjit Bose,Xin (Robert) Luo
• Subject Matter: Accounting & Finance,Accounting/accountancy,Accounting methods/systems

Investigating security investment

impact on rm performance

Ranjit Bose and Xin (Robert) Luo

Anderson School of Management, University of New Mexico,

Albuquerque, New Mexico, USA

Abstract

Purpose – The purpose of this study is to propose to use the economic value added to measure rm

performance against information security investments.

Design/methodology/approach – The authors develop a conceptual framework to capture non

information technology (IT)-related and IT-related security investment factors and propose to study

their holistic inuences on rm performance.

Findings – The authors propose 14 propositions to understand the relationship between security

investments and rm performance.

Research limitations/implications – The authors propose a validation process to guide future

research to further empirically capture all needed data and analyze the proposed relationships.

Practical implications – Managers can view security investment from a more comprehensive

perspective and understand how to potentially contribute each of the non IT-related and IT-related

factors to rm performance.

Originality/value – This is one of the early attempts studying information security investment vs

rm performance from a comprehensive conceptual angel.

Keywords Firm performance, Economic value added (EVA), Information security investment

Paper type Conceptual paper

1. Introduction

As information technology (IT) continues to play an increasing role in a company’s

quest for growing its market share, security threats simultaneously continue to increase

as well. As companies create more customer-facing tools and more distributed ways of

working, IT leaders and top executives are spending more time and energy ensuring

enterprise security. The data collected in a company and the way it is used change, both

the internal and external threats to the company, also change and evolve. To effectively

protect the company, the IT group must build partnerships with top executives and

users to establish a shared responsibility for security. Numerous research studies have

investigated the relationships between investment in IT and rm performance.

However, due to increasing necessity to provide security of information and systems at

all levels of business organizations, research studies aimed at in-depth understanding of

the payoffs from information security investments with respect to rm performance are

becoming critical in recent years.

Organizations today face serious security threats due to the rapid increase in both volume

and frequency of malicious attacks on their IT infrastructures. Consequently, to protect and

This paper is dedicated to the memory of our wonderful scholar and friend, Dr. Lee. J. Yao, who

recently passed away.

The current issue and full text archive of this journal is available at

www.emeraldinsight.com/1834-7649.htm

IJAIM

22,3

194

Received 18 April 2014

Revised 20 April 2014

Accepted 20 April 2014

International Journal of Accounting

& Information Management

Vol. 22 No. 3, 2014

pp. 194-208

© Emerald Group Publishing Limited

1834-7649

DOI 10.1108/IJAIM-04-2014-0026