Firm-level Resource Allocation to Information Security in the Presence of Financial Distress

In this paper, we adopt an organizational perspective to the management of information security and analyze in a multi-period context how an organization should allocate its internal cash flows and available external funds to revenuegenerating (productive) and security assuring (protective) processes in the presence of security breach, borrowing and financial distress costs. We show analytically and illustrate numerically that the capital stock accumulation is lower and allocations to security are higher in the initial periods compared to the benchmark (no security breach) case, while in the long run, the steady state allocations do not differ. Further, we show that external insurance can be beneficial to both the firm and the provider and examine the cost parameters that affect the feasibility range. The results highlight the importance of resource allocation and insurance at the organizational level in addressing security breach problems and enable managers to seek and use relevant information effectively.