Modern security mangaement should be based upon economic principles. For this purpose organisations need data, tools and techniques for the cost-benefit-analysis of security investments as well as methods to integrate the results of that kind of analysis into their overall information security management systems. Our research in this area has three main goals:

1. Identifying methods for providing organisations with accurate data for evaluating security investments and building a system for the sharing of information security relevant data among organisations.

2. Evaluation and development of metrics, tools and techniques for an economically oriented security management.

3. Integrating economic principles into information security management and building a new process model for information security management.