查看文章

Information security management becomes more challenging nowadays due to the diverse security risk interdependency between firms. Prior researches rarely consider the impact of risk interdependency on security decisions. This paper comprehensively considers two types of security risk interdependency caused by the nature of information assets and the technical similarity. We find that it is necessary to distinguish the complementary and substitutable information assets since they have different effects on the firm’s investment incentive. As for the risk interdependency caused by the nature of the information assets, although both the high complementation degree and high substitution degree inhibit firms’ incentives to invest, the underlying reasons are different. Besides, for another risk interdependency, the technical similarity enhances the investment incentive of the complementary firms but suppresses that of …