Increasing importance of information and communication technologies (ICT), new regulatory obligations (e.g. Basel II) and growing external risks (e.g. hacker attacks) put Security Risks in the management focus of banking companies. The management has to decide whether to accept Expected Losses or to invest into Technical Security Mechanisms in order to decrease the frequency of events or to invest in Insurance Policies in order to lower the severity of events. This paper contributes to the development of an optimization model that aims to determine the optimal amount to be invested in technical Security Mechanisms and Insurance Policies. Furthermore the model considers budget and risk limits as constraints and is supposed to help practitioners in controlling Security Risks.