This study investigates the effect of information sharing and deferral option on a firm’s information security investment strategies by considering strategic interactions between a firm and an attacker. We find that 1) information sharing decreases a firm’s security investment rate. 2) If a deferral decision is possible, the firm will decrease its immediate investment, and avoid non-investment. 3) After information sharing, the probability of a firm’s deferral decision increases for low-benefit information (SL) but decreases for high-benefit information (SH). 4) When information sharing accuracy is low, a firm only defers decisions in a fraction of SL; when information sharing accuracy is high, the firm defers its decisions in all SL and a fraction of SH. 5) Information sharing can improve the effect of deferral decision when accuracy is low but weaken it when accuracy is high. These results contradict the literature, wherein information sharing reduces a firm’s uncertainty on cybersecurity investment and decreases deferment options associated with investment.

No abstract

The spread of network attacks is extremely harmful, which poses a great threat to the assets and reputation of firms. Therefore, making a scientific information security strategy is an important task for the continued and stable development of the firms. This paper develops the SIR model of hacker intrusion propagation and then analyzes the evolution trend of hacker intrusion propagation and the conditions of strategy transfer. The research shows that when immune failure and strategy transfer are not considered, the threshold of hacker intrusion propagation is negatively correlated with the probability of invasion, whereas it is positively correlated with the probability of defense success and the externality during outsourcing. In the case of immune failure, there will always be infected firms in the network, where the threshold of hacker intrusion propagation is affected by the proportion of the infected state and the probability of immune failure. When immune failure and strategy transfer occur simultaneously if the externality is positive and high, information security outsourcing can improve firms’ security benefits; if the externality is negative, the firms should stop cooperating with the managed security service provider (MSSP).

In order to effectively alleviate the principal-agent problem caused by information asymmetry in the process of enterprise information security outsourcing, based on the idea of multi-agent, this paper constructs a calculation experimental model to classify and evaluate the business and pay on schedule, and introduces double incentive mechanism and simulation exploration into the information security outsourcing strategy. Help the entrusting enterprise reasonably set the important parameters involved in the outsourcing incentive mechanism. The research results show that if enterprises only rely on incentive intensity, it will lead to the marginal decline of incentive efficiency; At the same time, the incentive mode of adding benefit sharing ratio can make MSSP and enterprises become a community of interests, and promote the result of win-win cooperation to a greater extent; It is very important to choose an appropriate interval or value for the incentive intensity and benefit sharing ratio of enterprises.