Mathematical Integer Linear Programming Model for Optimal Placement of Security Controls in Tourism Information Systems

Tourism information systems process large volumes of sensitive personal, financial, and operational data, which makes them attractive targets for a wide range of cyber attacks. Putting different types of security measures in the best possible places when money is limited is a classic problem in combinatorial optimization. However, the tourism field still mainly relies on qualitative risk charts and expert opinions for identifying risks. The goal is to pick up the best possible security coverage counting risks, while also next limits on money, compatibility issues, claiming backup systems, and minimum security requirements. Risk weights are deliberately predicated on how important an asset is and how likely it is to be attacked. Coverage coefficients exhibit how much each control assists in defending a specific part of a system. The formula is simple, easy to deduce for people without specialized knowledge, and can be solved to the best possible solution using modern branch-and-cut methods. A detailed numerical case study, applied to a mid-sized mountain tourism business that holds twelve system parts and eight types of control, communicates how the method applies to real situations. Analysis of the programme's value function shows that the marginal value of additional security spending diminishes once the most costeffective control-component pairs have been selected, and the properties of the formulation are used to assess the robustness of the recommended portfolio to error in the elicited parameters. The proposed framework offers a rigorous, reproducible and auditable basis for cybersecurity resource allocation in the tourism sector, and it extends naturally to destination-level coordination between independent enterprises.