Procedia Computer Science 100 ( 2016 ) 971 – 978
1877-0509 © 2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
Peer-review under responsibility of the organizing committee of CENTERIS 2016 doi: 10.1016/j.procs.2016.09.261
ScienceDirect
&RQIHUHQFHRQ(17(5SULVH,QIRUPDWLRQ6\VWHPV,QWHUQDWLRQDO&RQIHUHQFHRQ3URMHFW
0$1DJHPHQW&RQIHUHQFHRQ+HDOWKDQG6RFLDO&DUH,QIRUPDWLRQ6\VWHPVDQG7HFKQRORJLHV
&(17(5,63URM0$1+&LVW2FWREHU
7ZRVWDJHVHFXULW\FRQWUROVVHOHFWLRQ
,U\QD<HYVH\HYD
D9LWRU%DVWR)HUQDQGHV
E$DGYDQ0RRUVHO
F+HOJH-DQLFNH
D0LFKDHO
(PPHULFK
Ga Cyber Technology Institute, Faculty of Technology, De Montfort University, Gateway House, The Gateway, LE1 9BH Leicester, UK
b School of Technology and Management, Computer Science and Communications Research Centre, Polytechnic Institute of Leiria, Leiria 2411- 901, Portugal
cCentre for Cybercrime and Computer Security, School of Computing Science, Newcastle University, Newcastle upon Tyne NE1 7RU, UK
dLIACS, Leiden University, Niels Bohrweg 1, 2333-CA Leiden, The Netherlands
$EVWUDFW
7RSURWHFWDV\VWHPIURPSRWHQWLDOF\EHUVHFXULW\EUHDFKHVDQGDWWDFNVRQHQHHGVWRVHOHFWHIILFLHQWVHFXULW\FRQWUROVWDNLQJLQWR
DFFRXQW WHFKQLFDO DQG LQVWLWXWLRQDO JRDOV DQG FRQVWUDLQWV VXFK DV DYDLODEOH EXGJHW HQWHUSULVH DFWLYLW\ LQWHUQDO DQG H[WHUQDO
HQYLURQPHQW +HUH ZH PRGHO WKH VHFXULW\ FRQWUROV VHOHFWLRQ SUREOHP DV D WZRVWDJH GHFLVLRQ PDNLQJ )LUVW PDQDJHUV DQG
LQIRUPDWLRQVHFXULW\RIILFHUVGHILQHWKHVL]HRIVHFXULW\EXGJHW6HFRQGWKHEXGJHWLVGLVWULEXWHGEHWZHHQYDULRXVW\SHVRIVHFXULW\
FRQWUROV%\YLHZLQJORVVSUHYHQWLRQZLWKVHFXULW\FRQWUROVPHDVXUHGDVJDLQVUHODWLYHWRDEDVHOLQHORVVHVZLWKRXWDSSO\LQJVHFXULW\
FRQWUROVZHIRUPXODWHWKHGHFLVLRQPDNLQJSURFHVVDVDFODVVLFDOSRUWIROLRVHOHFWLRQSUREOHP7KHPRGHODVVXPHVVHFXULW\EXGJHW
DOORFDWLRQDVDWZRREMHFWLYHSUREOHPEDODQFLQJULVNDQGUHWXUQJLYHQDEXGJHWFRQVWUDLQW7KH6KDUSHUDWLRLVXVHGWRLGHQWLI\DQ
RSWLPDOSRLQWRQWKH3DUHWRIURQWWRVSHQGWKHEXGJHW$WWKHPDQDJHPHQWOHYHOWKHEXGJHWVL]HLVFKRVHQE\FRPSXWLQJWKHWUDGH
RIIVEHWZHHQ6KDUSHUDWLRVDQGEXGJHWVL]HV,WLVVKRZQWKDWWKHSURSRVHGWZRVWDJHGHFLVLRQPDNLQJPRGHOFDQEHVROYHGE\
TXDGUDWLFSURJUDPPLQJWHFKQLTXHVZKLFKLVVKRZQIRUDWHVWFDVHVFHQDULRZLWKUHDOLVWLFGDWD
7KH$XWKRUV3XEOLVKHGE\(OVHYLHU%9
3HHUUHYLHZXQGHUUHVSRQVLELOLW\RI6FL.$$VVRFLDWLRQIRU3URPRWLRQDQG'LVVHPLQDWLRQRI6FLHQWLILF.QRZOHGJH
Keywords:PXOWLFULWHULDRSWLPLVDWLRQVHFXULW\VXEVHWVHOHFWLRQVHFXULW\EXGJHWSRUWIROLRRSWLPL]DWLRQ6KDUSHUDWLR
&RUUHVSRQGLQJDXWKRU7HOID[
E-mail address:LU\QD\HYVH\HYD#GPXDFXN
© 2016 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
Peer-review under responsibility of the organizing committee of CENTERIS 2016
,QWURGXFWLRQ
,QGXVWU\QHHGVWRSURWHFWLWVDVVHWVSURGXFWVDQGEXVLQHVVSURFHVVHVIURPSRWHQWLDOF\EHUVHFXULW\EUHDFKHVLQRUGHU
WRPDLQWDLQLWVEXVLQHVVIXQFWLRQV7KLVERLOVGRZQWRWKHVHOHFWLRQRIVHFXULW\controls RU countermeasuresDLPHGDW
HLWKHUEORFNLQJDQDWWDFNRUPLWLJDWLQJGDPDJHIURPDVXFFHVVIXODWWDFN3RWHQWLDOWKUHDWVFRPHIURPKDFNHUVDLPLQJ
DW DWWDFNLQJ UDQGRP XVHUV DQG FRPSDQLHV HJ YLD VSDP DQG VRFLDO HQJLQHHULQJ DWWDFNV HJ SKLVKLQJ YLUXVHV DQG
WURMDQVVS\ZDUHDQGPDOZDUHERWQHWVHWFRUWDUJHWLQJSDUWLFXODUFRPSDQLHVRULQGLYLGXDOVHJYLDGLVWULEXWHGGHQLDO
RIVHUYLFH''R6VSHDUSKLVKLQJUDQVRPZDUHDQGRWKHUEUXWHIRUFHRUORZUDWHDWWDFNV(VSHFLDOO\GDQJHURXVDUH
FRPSOH[SHUVLVWHQWDWWDFNVWKDWDLPDWGLVUXSWLQJWKHQRUPDOIXQFWLRQLQJRIDSDUWLFXODUFRPSDQ\H[SORLWLQJVHYHUDO
YXOQHUDELOLWLHVDWRQFH
7KHUDFHEHWZHHQDWWDFNHUVZKRDUHFRQVWDQWO\VHDUFKLQJIRUYXOQHUDELOLWLHVDQGDQWLYLUXVVRIWZDUHSURGXFHUVZKR
DUH FRQVWDQWO\ SDWFKLQJ YXOQHUDELOLWLHV FRQWLQXHV 'HVSLWH FRQWLQXRXV LQFUHDVH RI LQYHVWPHQWV LQ VHFXULW\ E\ ODUJH
FRPSDQLHV UHJXODU PHGLD UHSRUWV DERXW HPHUJHQW DWWDFNV VHFXULW\ EUHDFKHV DQG WKH LQFUHDVLQJ VFDOH RI HFRQRPLF
ORVVHVGHPRQVWUDWHWKDWWKHSUREOHPRIVHFXULW\LVIDUIURPEHLQJVROYHG
7KHLQIRUPDWLRQVHFXULW\EUHDFKHVVXUYH\>@FRQGXFWHGE\3Z&IRU8.JRYHUQPHQWUHSRUWHGWKDWRI
ODUJHDQGRIVPDOORUJDQL]DWLRQVVXIIHUHGVHFXULW\EUHDFKHVLQDQLQFUHDVHIURPWKHSUHYLRXV\HDUIURP
DQGUHVSHFWLYHO\7KHDYHUDJHZRUVWVLQJOHVHFXULW\EUHDFKFRVWZHQWXSIURP N PLQWR P
PLQIRUDODUJHRUJDQL]DWLRQDQGIURP N NLQWR N NLQIRUDVPDOOEXVLQHVV
RIUHVSRQGHQWVH[SHFWDQLQFUHDVHRIVHFXULW\LQFLGHQWVLQWKHXSFRPLQJ\HDUVVXJJHVWLQJDQLQFUHDVHLQVHFXULW\
EXGJHWVWRSUHYHQWDQGWRPLWLJDWHVHFXULW\EUHDFKHV6LPLODUWUHQGVDUHUHSRUWHGIRUEXVLQHVVHVLQWKH86VHHHJ
3RQHPRQ,QVWLWXWHUHSRUW>@
,QWKLVFRQWH[WFRPSDQLHVIDFHDWOHDVWWZRSUREOHPV)LUVWO\WRGHFLGHRQWKHEXGJHWIRUVHFXUHIXQFWLRQLQJRIWKH
FRPSDQ\ VHFRQGO\ WRGLYLGH WKH EXGJHW DPRQJ VHFXULW\ FRQWUROV WREX\ DQG WRXSGDWH $QRWKHU LQWHUHVWLQJ LVVXH
ZKLFKLVEH\RQGWKHVFRSHRIWKLVSDSHULVKRZWRDFWLQWKHFDVHRIDEUHDFKZKLFKFRXQWHUPHDVXUHVWRDSSO\ZKHQ
DQDWWDFNKDSSHQVDQGKRZWRSHUIRUPLQFLGHQWUHVSRQVHPRVWHIILFLHQWO\
7KH SUREOHP RI FKRRVLQJ D EXGJHW WR EH VSHQW LV D PDQDJHPHQW GHFLVLRQ XVXDOO\ PDGH E\ WKH ERDUG RI
GLUHFWRUVRZQHUVRIFRPSDQ\WRJHWKHUDQGLVLQIRUPHGE\&KLHI,QIRUPDWLRQ6HFXULW\2IILFHU&,627KHGHFLVLRQ
PDNLQJLQYROYHVHVWLPDWLQJULVNVUHODWHGWRSRWHQWLDODWWDFNVDQGVHFXULW\EUHDFKHVDQGFRQVLGHULQJKRZZHOORWKHU
FRPSHWLWRUFRPSDQLHVDUHSURWHFWHG,QEXVLQHVVLWLVEHOLHYHGWKDWLWLVHQRXJKWREHSURWHFWHGVOLJKWO\EHWWHUWKDQ
FRPSHWLWRUVLQRUGHUWRUHGXFHWKHFKDQFHVRIEHLQJDWWDFNHGVLQFHDWWDFNHUVVHDUFKIRUHDVLHVWWDUJHWV>@
7KHSUREOHPRIDOORFDWLQJEXGJHWEHWZHHQGLIIHUHQWVHFXULW\FRQWUROVLVVROYHGE\WKH&,62ZKRXVXDOO\IROORZV
VHFXULW\SROLFLHVRIWKHFRPSDQ\DQGH[LVWLQJVWDQGDUGVIRUULVNDVVHVVPHQWHJ>@'HFLVLRQVDERXWZKLFKFRQWUROV
WREX\ZRXOGW\SLFDOO\EHGRQHZLWKDOLPLWHGEXGJHWDQGLWLVQRWSRVVLEOHWREX\DOODYDLODEOHFRQWUROV
([LVWLQJULVNDVVHVVPHQWPRGHOVDUHEDVHGRQTXDOLWDWLYHRUTXDQWLWDWLYHDQDO\VLVRUVRPHFRPELQDWLRQRIERWK)RU
LQVWDQFHLQWHUQDWLRQDOVWDQGDUGV,62,(&>@DQG1,67>@SURYLGHJHQHUDOUHFRPPHQGDWLRQVIRUTXDOLWDWLYH
ULVNDVVHVVPHQW,Q>@ERWKDSSURDFKHVDUHXVHGTXDOLWDWLYHIRULGHQWLI\LQJJURXSVRIDWWDFNHUVRUDVVLJQLQJOHYHOVRI
DWWDFNVHYHULW\DQGTXDQWLWDWLYHIRUPHDVXULQJHIILFLHQF\RIFRXQWHUPHDVXUHVDJDLQVWYDULRXVWKUHDWVDQGWKHLUFRVW
%RWKRIWKHLQGLFDWHGSUREOHPVKDYHEHHQDGGUHVVHGLQWKHOLWHUDWXUHEXWQRWVROYHGWRJHWKHU5HFHQWDSSURDFKHVWR
ULVNDVVHVVPHQWDQGSODQQLQJDGGUHVVPLQLPL]LQJVHFXULW\ULVNDQGEXGJHWIRUFRQWUROVVLPXOWDQHRXVO\>@DSSO\LQJ
ILQDQFLDO PRGHOOLQJ IRU ULVN DVVHVVPHQW >@ SODQQLQJ XQGHU XQFHUWDLQW\ IRU KLJK LPSDFW HYHQWV >@ IRUPXODWLQJ
EXGJHWDOORFDWLRQDVDPXOWLSOHNQDSVDFNSUREOHP>@,QRXUSUHYLRXVZRUN>@VHYHUDODOWHUQDWLYHIRUPXODWLRQV
IRUVHOHFWLQJWKHRSWLPDOVXEVHWRIVHFXULW\FRQWUROVZHUHVXJJHVWHG
,QWKLVSDSHUZHH[WHQGZRUNVWDUWHGLQ>@DQGDGGUHVVWZRVWDJHVRIVHFXULW\FRQWUROVVHOHFWLRQSUREOHPWKH
VHFXULW\EXGJHWLQJDQGVHOHFWLRQRIVHFXULW\FRQWUROVJLYHQVXFKEXGJHW,Q6HFWLRQVWDWHRIWKHDUWDSSURDFKHVDUH
FRQVLGHUHGIRUERWKLQGLFDWHGSUREOHPVDQGLQ6HFWLRQZHSURSRVHRXUDSSURDFKWRVROYLQJWKHVHSUREOHPV7KH
SUHVHQWHGDSSURDFKLVLOOXVWUDWHGZLWKDQH[DPSOHLQ6HFWLRQ:HGUDZFRQFOXVLRQVDQGLQGLFDWHIXWXUHGLUHFWLRQVIRU
WKLVZRUNLQ6HFWLRQ
%XGJHWDQGVHFXULW\FRQWUROVVHOHFWLRQ
2QHRIWKHPDLQFKDOOHQJHVLQWKHVHFXULW\LQGXVWU\LVWKHGLIILFXOW\RIGHPRQVWUDWLQJDQGTXDQWLI\LQJWKHEHQHILWRI
VHFXULW\ LQYHVWPHQWV WR FRQYLQFH PDQDJHUV WR LQYHVW LQ VHFXULW\ 7KH GLIILFXOWLHV LQ GHILQLQJ F\EHUVHFXULW\ FUHDWH
FRQIXVLRQDQGDODFNRISXEOLFXQGHUVWDQGLQJRIF\EHUVHFXULW\WKUHDWV>@+HQFHSRWHQWLDOUHVLVWDQFHRIPDQDJHUV
WRLQYHVWLQWRF\EHUVHFXULW\PD\EHUHODWHGWRVXFKOXFNRIXQGHUVWDQGLQJ7RKHOSPDQDJHUVWRPDNHLQIRUPHGGHFLVLRQ
DERXWWKHVHFXULW\EXGJHWVHYHUDOHGXFDWLRQDOVHVVLRQVDERXWVHFXULW\WKUHDWVPD\EHRUJDQL]HG,QWKLVVHFWLRQDQ
DSSURDFKIRUKHOSLQJPDQDJHUVRQVHFXULW\EXGJHWVHOHFWLRQDQGLWVDOORFDWLRQEHWZHHQVHFXULW\FRQWUROVLVSURSRVHG
EDVHGRQSRUWIROLRVHOHFWLRQSUREOHPZHOONQRZQLQILQDQFLDOPDQDJHPHQW
2.1. Budget selection
,QEXGJHWVHOHFWLRQRQHFRQVLGHUVVHFXULQJDFRPSDQ\DVDUHZDUGLQJDFWLYLW\HJE\YLHZLQJORVVSUHYHQWLRQZLWK
VHFXULW\FRQWUROVDVJDLQVUHODWLYHWRDEDVHOLQHZLWKRXWWKHP6XFKDFWLYLW\UHTXLUHVVRPHUHVRXUFHVDQGOHDGVWR
SRWHQWLDOO\ SUHYHQWLRQ RI VHULRXV ORVV HJ LQ FDVH LI KLJKO\ LPSUREDEOH EXW YHU\ GDPDJLQJ QHZ W\SH RI DWWDFN LV
SUHYHQWHGVDYLQJWKHFRPSDQ\IURPKLJKORVVHVRUHYHQEDQNUXSWF\:HEHOLHYHWKDWWKLVYLHZSRLQWZLOOKHOSPDQDJHUV
ZKHQDOORFDWLQJVHFXULW\EXGJHWDQGILQGVHFXULW\LQYHVWPHQWDVSRWHQWLDOO\SURILWDEOH+HQFHLQWKHVHVHWWLQJVWKHUH
ZLOODOZD\VEHVRPHVHFXULW\EXGJHWWKDWWKHFRPSDQ\ZDQWVWRVSHQGIRUVHFXULW\+RZHYHUWKHUHZLOOVWLOOEHWKH
TXHVWLRQZKLFKLVWKHEHVWYDOXHIRULWWDNLQJLQWRDFFRXQWVL]HRIWKHFRPSDQ\LWVDFWLYLW\KRZPXFKWKHFRPSDQ\
LQYHVWHG LQWRVHFXULW\EHIRUHDQGKRZ PXFK LW ZDQWV WR VSHQG IRUXSGDWLQJROGDQGEX\LQJQHZ VHFXULW\ FRQWUROV
&XUUHQWO\PRVW&,62VPDQDJHUVORRNDWRWKHUFRPSDQLHVDQGLPSOHPHQWVLPLODUWRFRPSHWLWRUV¶VHFXULW\PHDVXUHV
>@,WLVDOVREHOLHYHGWKDWLWLVHQRXJKWREHSURWHFWHGVOLJKWO\EHWWHUWKDQFRPSHWLWRUVWREHRXWRIWKHDWWDFNHUVIRFXV
7KHUHPLJKWEHFRQIOLFWVRIRSLQLRQVEHWZHHQGLIIHUHQWPDQDJHUVDQGRU&,62ZKLFKPDNHDJUHHLQJDERXWWKH
EXGJHWRIWKHFRPSDQ\GLIILFXOW6ROXWLRQVIRUWKLVSUREOHPFDQEHIRXQGZLWKWKHKHOSRIJURXSGHFLVLRQPDNLQJ
DSSURDFKHVVHHHJ>@$IWHUWKHEXGJHWIRUSURWHFWLQJFRPSDQ\IURPSRWHQWLDODWWDFNVLVFKRVHQE\WRSPDQDJHUV
&,62KDVWRPDNHGHFLVLRQVDERXWKRZWRVSHQGWKHDOORFDWHGEXGJHWZLVHO\
2.2. Traditional security risk
$ODUJHQXPEHURISRWHQWLDOWKUHDWVH[LVWWKDWPLJKWKDSSHQZLWKVRPHSUREDELOLW\WRDQ\FRPSDQ\JRYHUQPHQWDO
RUJDQL]DWLRQ RU LQGLYLGXDOV6HFXULW\ H[SHUWV FDQ VXEMHFWLYHO\HYDOXDWH WKH SUREDELOLW\ RU OLNHOLKRRG RI HDFK WKUHDW
EDVHGRQWKHLUH[SHULHQFHDQGNQRZOHGJHRIUHFHQWWKUHDWVDQGDWWDFNVE\DQDO\]LQJH[LVWLQJYXOQHUDELOLWLHVRIYDOXDEOH
FRPSDQ\¶VDVVHWV,QDGGLWLRQWRWKHSUREDELOLW\OLNHOLKRRGRIDWKUHDWDW\SLFDOULVNDVVHVVPHQWSURFHGXUHZLOOWDNH
LQWRDFFRXQWWKHLPSDFWRIH[SORLWDWLRQ
7KHPRVWFRPPRQZD\&,62VWDNHWRSHUIRUPULVNDVVHVVPHQWRIWKHFRPSDQ\LVE\DVVHVVLQJH[SHFWHGORVVYDOXH
7KHLQLWLDOORVVYDOXHLZKHQQRVHFXULW\FRQWUROVDUHDSSOLHGFDQEHFRPSXWHGHJVLPLODUO\WR>@E\DQDO\]LQJ
H[LVWLQJ YXOQHUDELOLWLHV RI WKH FRPSDQ\¶V DVVHWV Vi
^` HVWLPDWLQJ SUREDELOLWLHVOLNHOLKRRG pij
>@ RIH[SORLWLQJYXOQHUDELOLWLHVViYLDSRWHQWLDOWKUHDWVTj
^`DQGLPSDFWRIVXFKH[SORLWDWLRQVIi
^`ZKHUHi={1,…,n}DQGj={1,…,m}LQGLFDWHYXOQHUDELOLWLHVDQGWKUHDWVUHVSHFWLYHO\
L p
ijV
i
i n
¦
j m
¦ Ii
,QYHVWPHQWLQWKHVHFXULW\EXGJHWVKRXOGEHGRQHLQVXFKDZD\WRPLQLPL]HSRWHQWLDOORVVHV7RVSHQGWKHDYDLODEOH
EXGJHWBIURPDOODYDLODEOHFRQWUROVl={1,…,k}VRPHVKRXOGEHVHOHFWHGWREHERXJKWxl
^`ZKHUHVWDQGVIRUVHOHFWLQJlWKFRQWUROWREHERXJKWDQGIRUQRWVHOHFWLQJDQGOHDGLQJWRLQWHJHUIRUPXODWLRQRIWKHSRUWIROLRVHOHFWLRQ
SUREOHP ZKHQ FRPSDUHG WR VWDQGDUG FRQWLQXRXV /HW x GHQRWH WKH FKRLFH RI VXEVHW RI FRQWUROV HJ
x
TPHDQVWKDWx2DQGx5FRQWUROVDUHVHOHFWHGERXJKW)RUWKLVWKH&,62KDVWRHYDOXDWHKRZZHOOHDFKFRQWUROxlSURWHFWVHDFKYXOQHUDELOLW\Vi.6HH7DEOHIRUVXFKYDOXHV
tli
^`DVVXJJHVWHGLQ>@1RWHWKDWQHJDWLYHYDOXHVRItliVKRZWKDWQHZULVNVDUHLQWURGXFHGE\XVLQJFRQWUROtli LIFRQWUROxlLVQRWFRYHULQJYXOQHUDELOLW\Vi,DQGFRPSOHWHFRYHUZLWKtli
P x p
ijV
i I
i t
li x
l jn
¦
j m
¦
k l
¦
7KHWRWDOFRVWCLVXVXDOO\FRPSRVHGIURPGLUHFWDQGLQGLUHFWFRVWVRIVHFXULW\FRQWUROVIRUEX\LQJDQGPDLQWDLQLQJ
WKHPUHVSHFWLYHO\ZKHUHclLVWKHFRVWRIWKHVHFXULW\FRQWURO xl
C x x
l c
l lk
¦
7KHQVXFKVXEVHWRIVHFXULW\FRQWUROVKDVWREHVHOHFWHGWKDWPLQLPL]HVWKHWRWDOORVVULVNDIWHUDSSO\LQJFRQWUROV
Rx L Px
WDNLQJLQWRDFFRXQWFRQVWUDLQHGEXGJHWB
PLQ
xlRx stCx d B
+RZHYHULWLVQRWDOZD\VSRVVLEOHWRHYDOXDWHVHFXULW\LQWHUPVRIUHGXFLQJULVNRISRWHQWLDOORVVHVDQGYLHZWKHVHORVVHVLQGHSHQGHQWO\IURPHDFKRWKHU+HUHZHVXJJHVWDQDOWHUQDWLYHYLHZWKDWFRQVLGHUVSUHYHQWLRQRIORVVHV
DVJDLQVUHODWLYHWRWKHEDVHOLQHRIQRWLQYHVWLQJLQVHFXULW\7KLVFKDQJHRIYLHZDOORZVXVWRFRQVLGHUWKHVHOHFWLRQ
RIVHFXULW\FRQWUROVDVZHOODVWKHEXGJHWDOORFDWLRQSUREOHPDVDQLQYHVWPHQWSRUWIROLRRSWLPL]DWLRQSUREOHPZLWK
SRVLWLYHUHWXUQRQLQYHVWPHQWDQGYDULDQFHRIUHWXUQRQLQYHVWPHQWV
2.3. Security risk vs. rewarding security
:HSURSRVHWRDSSURDFKLQYHVWPHQWLQWRVHFXULW\DVDSURILWDEOHDFWLYLW\WKDWZRXOGHQFRXUDJHPDQDJHUVWRLQYHVW
LQWR$QH[DPSOHRISURILWDEOHLQYHVWPHQWLQWRVHFXULW\FDQEHFRQVLGHUHGZKHQDQDWWDFNKDVEHHQSUHYHQWHGE\RQH
RIFRPSDQ\¶VHPSOR\HHVVXFKSUHYHQWLRQFDQDOVREHVHHQDVDJDLQIRUWKHFRPSDQ\VLQFHELJORVVKDVEHHQSUHYHQWHG
7KHQLQYHVWLQJWLPHHIIRUWDQGRWKHUUHVRXUFHVQHHGHGIRUGHWHFWLRQDQGSUHYHQWLRQRIDQDWWDFNLVVHHQDVQHFHVVDU\
VSHQGLQJLQYHVWPHQWIRUDYRLGLQJSRWHQWLDOO\ELJORVVHV
,Q WKH DERYHGLVFXVVHG VHWWLQJV &,62 LV LQWHUHVWHG LQ DOORFDWLQJ WKH DYDLODEOH EXGJHW LQWR EHVW FRQWUROV LH WKH
FRQWUROVZLWKPD[LPDOWRWDOHIILFLHQF\RISURWHFWLQJWKHFRPSDQ\DJDLQVWDVPDQ\DVSRVVLEOHNQRZQDQGGHVLUDEO\
XQNQRZQSRWHQWLDOWKUHDWV7KLVZLOOPD[LPL]HWKHH[SHFWHGUHWXUQRUJDLQIURPWKHLQYHVWPHQW1RWHWKDWFRQWUROV
ZLWK KLJK SURWHFWLRQ HIILFLHQF\ DJDLQVW SRWHQWLDOO\ DV PDQ\ WKUHDWV DV SRVVLEOH DUH SUHIHUUHG WR WKRVH ZLWK ORZ
SURWHFWLRQHIILFLHQF\DJDLQVWVPDOOHUQXPEHURIWKUHDWV+HQFHFRYHUDJHRIDVPDQ\DVSRVVLEOHWKUHDWVLVHQFRXUDJHG
LQWULQVLFDOO\ZLWKLQLQGLYLGXDOFRQWUROV¶HIILFLHQF\E\FRYHULQJPDQ\WKUHDWV7KHQH[SHFWHGUHWXUQZKLFKLVQRW
QHFHVVDU\ PRQHWDU\RI D VHWRI VHFXULW\ FRQWUROV FDQEH FRPSXWHG DV WKH GLIIHUHQFHEHWZHHQ JDLQVREWDLQHGIURP
LPSOHPHQWLQJFRQWUROVDQGWKHLUFRVWV
E x Gx Cx
7KHUHDUHGLIIHUHQWZD\VWRGHILQHJDLQ)RULQVWDQFHLWFDQEHWDNHQDVP(x)GHILQHGE\7KHODUJHUWKHYDOXHRI
WKHH[SHFWHGJDLQWKHEHWWHUWKHFRPSDQ\LVSURWHFWHGIURPSRWHQWLDOWKUHDWVDQGDVXEVHWRIVHFXULW\FRQWUROVxlZKLFK
PD[LPL]HVJDLQVKRXOGEHVHOHFWHG
2.4. Diverse controls selection
$WWKHVDPHWLPHWKUHDWVFRYHUDJHFDQDOVREHWDNHQLQWRDFFRXQWH[WULQVLFDOO\E\FRPSDULQJKRZGLIIHUHQWVHWVRI
FRQWUROVFRYHUVHWVRIWKUHDWV7UDGLWLRQDOO\LQILQDQFLDOZRUOGLQYHVWLQJLQWRVLPLODUILQDQFLDODVVHWVLVULVN\>@VLQFH
VLPLODUDVVHWVRULQGXVWULHVPLJKWORRVHWKHLUYDOXHIRUWKHVDPHUHDVRQVHJRLODQGJDVEHFRPHVFKHDSHUGXHWRQHZ
W\SHVRIHQHUJ\SURGXFWLRQDGYDQFHVVRLQYHVWLQJLQRQO\WKRVHWZRLQGXVWULHVLVULVN\6LPLODUO\ZKHQVHOHFWLQJVHYHUDO
VSHFLHV RI ELRORJLFDO SRSXODWLRQ IRU IXWXUH SUHVHUYDWLRQ HJ VHYHUDO SODQWV VSHFLHV IRU WKHLU SRWHQWLDO IXWXUH \HW
XQNQRZQSKDUPDFHXWLFDOEHQHILWLWLVLPSRUWDQWWRVHOHFWDVGLYHUVHVSHFLHVDVSRVVLEOH>@
,QVHFXULW\WRDFFRXQWIRUGLYHUVLW\LWLVDVVXPHGWKDWFRQWUROVRIWKHVDPHW\SHNLQGZRXOGSURYLGHSURWHFWLRQ
DJDLQVWVLPLODUW\SHRIWKUHDWV7KHQLQRUGHUWRSURWHFWDFRPSDQ\IURPYDULRXVWKUHDWVYDULRXVRUGLYHUVHW\SHVRI
FRQWUROVVKRXOGEHVHOHFWHGDQGVHOHFWLQJVLPLODURQHVLVFRQVLGHUHGWREHULVN\)ROORZLQJWKHFODVVLFDOILQDQFLDOPRGHO
RI0DUNRZLW]>@WKHULVN
V x
FDQEHH[SUHVVHGLQWHUPVRIWKHFRYDULDQFHPDWUL[QDVIROORZV¦¦¦
k
l k
s m
i
s lsi
l
q x
x x
V
$VDERYHxGHQRWHVWKHFKRLFHRIVXEVHWRIFRQWUROV(DFKHOHPHQWqlsiRIPDWUL[QUHSUHVHQWVKRZVLPLODUDUHWZR
FRQWUROVxlDQGxRQYXOQHUDELOLW\Vi,WVKRXOGEHSRVVLEOHIRU&,62WRHYDOXDWHFRYDULDQFHVLPLODULW\YDOXHVqlsi EDVHGRQSDLUZLVHFRPSDULVRQRIFRQWUROV1RWHWKDWQHJDWLYHFRYDULDQFHHJqlsi ±VKRZVGLVVLPLODULW\EHWZHHQ
FRQWUROVDQGLVSUHIHUDEOHFRQWUDU\WRSRVLWLYHFRYDULDQFHHJqlsi ZKLFKVKRXOGEHDYRLGHGDQGULVNWHUP
V x
LVWREHPLQLPL]HG7KHQ VXFK D VXEVHW RI VHFXULW\ FRQWUROV KDV WR EH VHOHFWHG WKDW PD[LPL]HV WKH H[SHFWHG UHWXUQ IURP DSSO\LQJ
VHOHFWHGFRQWUROV DQGPLQLPL]HVULVNRIVHOHFWLQJVLPLODUFRQWUROV VLPXOWDQHRXVO\WDNLQJLQWRDFFRXQW
OLPLWHGEXGJHW
B x C t s x and
x
E PLQ d
PD[ V
1RWHWKDWWKHUHPD\EHVHYHUDORIVXFKRSWLPDOVXEVHWVVHOHFWLQJRQHDPRQJZKLFKLVQRWWULYLDO
2.5. Risk-to-Return trade-offs for different budgets
2SWLPL]LQJOHDGVWRILQGLQJQRWDVLQJOHEXWPXOWLSOHVRFDOOHG3DUHWRRSWLPDOVXEVHWVRIFRQWUROVHDFKRIZKLFK
LVEHWWHURQDWOHDVWRQHRIWKHREMHFWLYHVUHWXUQRUULVNDQGQRWZRUVHRQWKHUHVWRIREMHFWLYHV7RVHOHFWRQHVROXWLRQ
DPRQJPDQ\YDULRXVDSSURDFKHVFDQEHWDNHQIRULQVWDQFHRQHRIWKHPLVWRILQGDQRSWLPDOUDWLREHWZHHQULVNDQG
UHWXUQVXEMHFWWREXGJHWFRQVWUDLQW)RULQVWDQFHUHWXUQWRULVN6KDUSHUDWLRZHOONQRZQLQILQDQFLDOOLWHUDWXUH>@FDQ
EHXVHGKHUH
B x C t x s x x E
Sh d
PD[ V
7KHPD[LPL]DWLRQRIWKH6KDUSUDWLRW\SLFDOO\OHDGVWRDVRFDOOHGNQHHSRLQWVROXWLRQRQWKH3DUHWRIURQWZKLFKLV
DSRLQWLQZKLFKWKHORVVHVDVFRPSDUHGWRWKHEHVWDWWDLQDEOHYDOXHIRUERWKREMHFWLYHVKHUHH[SHFWHGUHWXUQDQG
VWDQGDUGGHYLDWLRQDUHVPDOO4XDGUDWLFSURJUDPPLQJWHFKQLTXHVFDQEHXVHGWRGHWHUPLQHSRLQWVRQWKH3DUHWRIURQW
$PRQJ WKHVH SRLQWV WKH SRLQW ZLWK PD[LPDO 6KDUSH UDWLR FDQ EH IRXQG HLWKHU E\ HQXPHUDWLRQ RU E\ JHRPHWULFDO
FRQVWUXFWLRQ)RUWKHODWWHULQGLIIHUHQFHOLQHVFDQEHFRQVWUXFWHGDQGDPRQJWKHPWKHOLQHWDQJHQWLDOWRWKH3DUHWR
IURQWLHUWKHVRFDOOHG&DSLWDO$OORFDWLRQ/LQH&$/GHWHUPLQHVWKHSRLQWZLWKRSWLPDO6KDUSUDWLRRQWKH3DUHWR
IURQW
([SHULPHQWDOUHVXOWV
1H[WZHH[HPSOLI\WKLVVWUDWHJ\E\PHDQVRIDUHDOLVWLFH[DPSOH7KHVFHQDULRDQGGDWDDUHWDNHQIURP>@
SRVVLEOHVHFXULW\FRQWUROVFDQEHDSSOLHGDOORIZKLFKZLWKDVSHFLILFFRVWDQGSURWHFWLQJPRUHRUOHVVHIIHFWLYHO\IRU
DFHUWDLQVHWRIVHFXULW\YXOQHUDELOLWLHV0RUHRYHULQVRPHFDVHVWKH\KDYHDQDYHUVHHIIHFWRQWKHSURWHFWLRQHJ
ZKLOHSURWHFWLQJIRURQHW\SHRIYXOQHUDELOLW\RSHQLQJXSWKHSRVVLELOLW\RIFHUWDLQRWKHUW\SHVRIYXOQHUDELOLWLHV
$VVWDWHGDERYHWKHVHOHFWLRQRIFRQWUROVLVPRGHOHGE\PHDQVRIDELQDU\GHFLVLRQYHFWRUDQGWKHDLPLVWRILQG
WKHRSWLPDOVHOHFWLRQZLWKUHVSHFWWRWKH6KDUSHUDWLR5HFDOOWKHH[SHFWHGUHWXUQE(x)LVWKHH[SHFWHGJDLQG(x)PLQXV
FRVWC(x),QWKLVH[DPSOHDVLPSOLILHGYHUVLRQRIJDLQLVFRQVLGHUHG,WLVDVVXPHGWKDWLIFRQWUROxlLVVHOHFWHGWKHJDLQ
ZLOOEHWKHVXPRIDOOYXOQHUDELOLW\LPSDFWVIiWLPHVWKHHIIHFWLYHQHVVtilPDWFKLQJRIFRQWUROxlRQYXOQHUDELOLW\Vi
7KHSUHFLVHGDWDFDQEHREWDLQHGIURP7DEOHV
Ex V x
7DEOH,PSDFWRI9XOQHUDELOLWLHV
9XOQHUDELOLW\ ͳ ʹ ͵ Ͷ ͷ ͺ ͻ ͳͲ
,PSDFWRQ&,$ 333 333 &&& 333 333 113 333 &&& 333 &&&
,PSDFWIi
7DEOH&RVWVRIFRQWUROVFRXQWHUPHDVXUHV
&RQWURO[O x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12
&RVW
&RQWUROݔ x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24
&RVW
7DEOH(IIHFWLYHQHVVRIVHFXULW\FRQWUROV¶SURWHFWLRQRIYXOQHUDELOLWLHV
9XOQHUDELOLWLHVVi
&RQWUROV
xl
tli V1 V2 V3 V4 V5 V6 V7 V8 V9 V10
x1
x2
x3
x4
x5
x6
x7
x8
x9
x10
x11
x12
x13
x14
x15
x16
x17
x18
x19
x20
x21
x22
x23
x24
1RZ
Ex Gx Cx
ZLWKGx t
li I
ii
ª ¦
¬ « º
¼ »
l
¦ xlCx C
l
l
¦ x
lǤ 7KH UHWXUQ RI D VLQJOHFRQWUROLVJLYHQE\
r
lt
li I
ii
ª ¦
¬ « º
¼ » C
lQGWRWDOH[SHFWHGUHWXUQLVEx rrxǤ7KHFRYDULDQFHRIWKHUHWXUQFDQEHFRPSXWHGDV
Q
lsCov t
l I
C
lt
l I
C
lt
s I
C
st
s I
C
sZKLFKLVHTXLYDOHQWWR
Q
lsn
s
¦
l
¦ t
li I
iC
lt
si I
iC
st
lz I
zC
lt
sz I
zC
s*LYHQDPD[LPDOEXGJHWBWKDWFDQEHVSHQWRQFRQWUROVZHFDQVROYHWKH6KDUSHLQGH[RSWLPL]DWLRQSUREOHP
Shx Gx Cx r
V
x o PD[ s t C
ll
¦ xl d B
ZKHUHr0LVULVNIUHHUHWXUQZKLFKZHDVVXPHKHUHWREHHTXDOWRLHr0
)RUVROYLQJWKHIRUPXODWLRQZLWKLQWHJHUYDULDEOHVxl
^`KHUH0$7/$%TXDGUDWLFVROYHULVXVHG>@7KHUHVXOWVDUHVKRZQLQ)LJXUHOHIWDQGULJKW+HUHZHLOOXVWUDWHUHWXUQWRYDULDQFH3DUHWRIURQWDQG0D[LPDO
6KDUSHUDWLRIRUGLIIHUHQWYDULDQFHUHVSHFWLYHO\
)LJXUH3DUHWRIURQWRIVHFXULW\FRQWUROSRUWIROLRVDQGPD[LPDO6KDUSHUDWLRV
)LJXUH3DUHWRIURQWRIEXGJHWVYVPD[LPDO6KDUSHUDWLRV
)LJXUHOHIWVKRZVDOVRWKH&DSLWDO$OORFDWLRQ/LQH&$/ZKLFKLVWDQJHQWLDOWRWKH3DUHWRIURQWLQWKHSRLQW
RIWKHPD[LPDO6KDUSHUDWLR7KLVLVFRQILUPHGE\)LJXUHULJKWZKHUHDWDYDOXHRIDERXW =WKHFXUYH
UHDFKHVWKHPD[LPDOYDOXHRI6KDUSHUDWLR
$QDGYDQWDJHRIDVLQJOHQXPEHUSHUIRUPDQFHLQGH[IRUDEXGJHWDOORFDWLRQDVLWLVSURYLGHGZLWKWKH6KDUSHUDWLR
LVWKDWLWFDQEHXVHGIRUVXSSRUWLQJWRSOHYHOGHFLVLRQPDNLQJXVLQJWHFKQLTXHVIURPPXOWLFULWHULDGHFLVLRQPDNLQJ
)RUWKLVZHSURSRVHWRFRPSXWHWKH3DUHWRIURQWRIEXGJHWVDQGRSWLPDO6KDUSHUDWLRVWKDWFDQEHDFKLHYHGIRUWKHVH
EXGJHWVDQGSUHVHQWWKLVWRWKHWRSOHYHOGHFLVLRQPDNHU+HUH0$7/$%VROYHUZDVXVHGWRFRPSXWH3DUHWRIURQW
>@DOWHUQDWLYHH[DFWVROYHUVFRXOGEHXVHG>@7KHSUREOHPFDQEHVROYHGHIILFLHQWO\DVEXGJHWLVDFRQVWDQWDQG
GLIIHUHQWYDOXHVRILWFDQEHFKRVHQLQDQLQWHUYDOIURPWRWKHPD[LPDOSRVVLEOHEXGJHW7KHUHDIWHUIRUHDFKEXGJHW
WKHPD[LPDO6KDUSHUDWLRLVFRPSXWHGZKLFKJLYHVULVHWRDQDSSUR[LPDWLRQRIWKH3DUHWRIURQW7KHUHVXOWVIRUWKH
H[DPSOHDUHVKRZQLQ)LJXUH
V x
&OHDUO\EXGJHWVDERYH GRQRWLPSURYHDQ\PRUHWKHSHUIRUPDQFHPHDVXUHGE\6KDUSHUDWLR$VKDUSGURS
LQSHUIRUPDQFHLVREVHUYHGIRUYDOXHVEHORZ 7KHDGYLFHZRXOGEHWKDWLQYHVWPHQWVEHORZWKLVYDOXHZRXOG
GHWHULRUDWHVHFXULW\SHUIRUPDQFHVLJQLILFDQWO\7KHNQHHSRLQWUHJLRQRQWKH3DUHWRIURQWEHWZHHQ WRFLUFD
UHSUHVHQWVJRRGFKRLFHVRIVHFXULW\EXGJHWV
&RQFOXVLRQ
,Q WKLV UHVHDUFK ZH GLVFXVV WKH SUREOHP RI VHFXULW\ FRQWUROV VHOHFWLRQ IURP D PDQDJHULDO SRLQW RI YLHZ ,W LV
DGYRFDWHGWRYLHZWKHLPSOHPHQWDWLRQRIVHFXULW\FRQWUROVDVDSURILWDEOHLQYHVWPHQW%\YLHZLQJWKHVFHQDULRRIQRW
XVLQJDQ\VHFXULW\FRQWUROVDVWKHEDVHOLQHVFHQDULRLWLVSRVVLEOHWRDVVLJQSRVLWLYHJDLQVWRVHFXULW\LQYHVWPHQWV
ZKLFKSXWVXVLQWRWKHSRVLWLRQWRDSSO\FODVVLFDODQGZHOOHVWDEOLVKHGWRROVIURPILQDQFLDOLQYHVWPHQWWKHRU\WRWKH
SUREOHPRIVHOHFWLQJVHFXULW\FRQWUROV7KHVHWRROVEDODQFHULVNDQGUHWXUQLQDQRSWLPDOZD\HJE\PD[LPL]LQJWKH
6KDUSH UDWLR )URP RXU H[DPSOH LW EHFRPHV FOHDU WKDW WKH VWUDWHJ\ FDQ EH LPSOHPHQWHG EDVHG RQ UHDOLVWLF GDWD
0RUHRYHU LW LV HIILFLHQW WR FRPSXWH VXFKSRUWIROLRV DQG LWDOORZV IRU D ZHOOLQIRUPHG PXOWLFULWHULD DVVHVVPHQW RI
DOWHUQDWLYHV%HVLGHVRIIHULQJDPHWKRGIRU&,62VWRDOORFDWHDJLYHQEXGJHWWKH3DUHWRIURQWRIWKH6KDUSHUDWLRWR
EHPD[LPL]HGWRWKHVHFXULW\EXGJHWWREHPLQLPL]HGFDQEHXVHGWRPDNHGHFLVLRQVRQWKHULJKWEXGJHWDVVLJQHG
WRVHFXULW\LQDFRPSDQ\
5HIHUHQFHV
,QIRUPDWLRQ VHFXULW\ EUHDFKHV VXUYH\ 3XEOLVKHG LQ 0DUFK E\ 3:& LQ DVVRFLDWLRQ ZLWK ,QIR6HFXULW\ (XURSH
KWWSVZZZSZFFRXNDVVHWVSGILVEVWHFKQLFDOUHSRUWEOXHSGI
&RVWRI&\EHU&ULPH6WXG\8QLWHG6WDWHV3XEOLVKHGLQ2FWREHUE\3RQHPRQ,QVWLWXWHKWWSZZZSRQHPRQRUJOLEUDU\FRVWRI
F\EHUFULPHXQLWHGVWDWHV
+XEHU0%XWWHUPDQQ$7ULJR/'0|OOHU0'RUQEXVFK3=XQGW0HGLWRUV,7VHFXULW\LQJOREDOFRUSRUDWHQHWZRUNV7UHQGUHSRUW
&HQWHUIRU'LJLWDO7HFKQRORJ\ 0DUNHW
6WHSV WR F\EHU VHFXULW\ H[HFXWLYH FRPSDQLRQ %,6 3XEOLVKHG RQ 6HSWHPEHU
KWWSVZZZJRYXNJRYHUQPHQWSXEOLFDWLRQVF\EHUULVNPDQDJHPHQWDERDUGOHYHOUHVSRQVLELOLW\
0RELOH 'HYLFHV *XLGH IRU ,PSOHPHQWHUV 3XEOLVKHG LQ )HEUXDU\ 0:5 ,QIR6HFXULW\
KWWSVZZZFSQLJRYXN'RFXPHQWV3XEOLFDWLRQV1RQ&31,BSXEVPRELOHBGHYLFHVBJXLGHBIRUBLPSOHPHQWHUVSGI
,62,(& ,QIRUPDWLRQ 7HFKQRORJ\ ± 6HFXULW\ 7HFKQLTXHV ± &RGH RI SUDFWLFH IRU LQIRUPDWLRQ VHFXULW\ PDQDJHPHQW
KWWSZZZLVRRUJLVRFDWDORJXHBGHWDLO"FVQXPEHU
1,67 1DWLRQDO YXOQHUDELOLW\ GDWDEDVH DXWRPDWLQJ YXOQHUDELOLW\ PDQDJHPHQW VHFXULW\ PHDVXUHPHQW DQG FRPSOLDQFH FKHFNLQJ
KWWSQYGQLVWJRYKRPHFIP
7KRPDV/1RUPDQ5LVN$QDO\VLVDQG6HFXULW\&RXQWHUPHDVXUH6HOHFWLRQQGHG%RFD5DWRQ&5&3UHVV7D\ORUDQG)UDQFLV*URXS
0DUNRZLW]+3RUWIROLRVHOHFWLRQJournal of Finance
6RORZ$3RODVN\60HDVXULQJELRORJLFDOGLYHUVLW\Environmental and Ecological Statistics
6DZLN76HOHFWLRQRIRSWLPDOFRXQWHUPHDVXUHSRUWIROLRLQ,7VHFXULW\SODQQLQJDecision Support Systems
9LGXWR 9 0DSOH & +XDQJ : /ySH]3HUp] ' $ QRYHO ULVN DVVHVVPHQW DQG RSWLPLVDWLRQ PRGHO IRU D PXOWLREMHFWLYH QHWZRUN VHFXULW\
FRXQWHUPHDVXUHVHOHFWLRQSUREOHPDecision Support Systems
6KDUSH:)7KH6KDUSHUDWLRThe journal of portfolio management
%HOWRQ96WHZDUW70XOWLSOH&ULWHULD'HFLVLRQ$QDO\VLV$Q,QWHJUDWHG$SSURDFK.OXZHU$FDGHPLF3XEOLVKHUV'RUGUHFKW
5DNHV75'HDQH-.5HHV/3,7VHFXULW\SODQQLQJXQGHUXQFHUWDLQW\IRUKLJKLPSDFWHYHQWVOmega
6PHUDOGL)0DODFDULD3+RZWRVSHQGLWRSWLPDOLQYHVWPHQWIRUF\EHUVHFXULW\,Q3URFHHGLQJVRIWKHVW,QWHUQDWLRQDO:RUNVKRSRQ$JHQWV
DQG&\EHU6HFXULW\$&\6($&01HZ<RUN1<86$0D\WK
)LHOGHU$3DQDRXVLV( 0DODFDULD3+DQNLQ3 6PHUDOGL)'HFLVLRQVXSSRUWDSSURDFKHVIRUF\EHUVHFXULW\LQYHVWPHQWDecision Support Systems
<HYVH\HYD,%DVWR)HUQDQGHV9(PPHULFK070YDQ0RRUVHO$6HOHFWLQJ2SWLPDO6XEVHWRI6HFXULW\&RQWUROV3URFHGLD&RPSXWHU6FLHQFH
0DVLQ0%XNFKLQ<'LYHUVLW\PD[LPL]DWLRQDSSURDFKIRUPXOWLREMHFWLYHRSWLPL]DWLRQ2SHUDWLRQV5HVHDUFK
0$7/$%YHUVLRQ5E7KH0DWK:RUNV,QF1DWLFN0DVVDFKXVHWWV