A game-theoretic analysis of information security investment for multiple firms in a network

Abstract

The application of Internet of Things promotes the cooperation among firms, and it also introduces some information security issues. Due to the vulnerability of the communication network, firms need to invest in information security technologies to protect their confidential information. In this paper, considering the multiple-step propagation of a security breach in a fully connected network, an information security investment game among n firms is investigated. We make meticulous theoretic and experimental analyses on both the Nash equilibrium solution and the optimal solution. The results show that a larger network size (n) or a larger one-step propagation probability (q) has a negative effect on the Nash equilibrium investment. The optimal investment does not necessarily increase in n or q, and its variation trend depends on the concrete conditions. A compensation mechanism is proposed to encourage firms to coordinate their strategies and invest a higher amount equal to the optimal investment when they make decisions individually. At last, our model is extended by considering another direct breach probability function and another network structure, respectively. We find that a higher connection density of the network will result in a greater expected cost for each firm.

Ulaganje u kibernetičku sigurnost

“…Nadalje, unutar modela izostaje pretpostavka kako napad, bez obzira je li riječ o ciljanom ili oportunističkom napadu, može nastupiti simultano. Qian et al (2017), vodeći se pretpostavkom kako ulaganje poslovne organizacije u sigurnost ne doprinosi isključivo sigurnosti vlastitog sustava, nego i sigurnosti sustava drugih poslovnih organizacija, razmatraju Nash-ovu ravnotežu. Potonja otkriva kako povećanje broja poslovnih organizacija u okružju, usprkos činjenici što isto povećava kibernetičku ranjivost, potiče poslovne organizacije na smanjeno ulaganje u sigurnost iz razloga što se u okružju pojavljuju "slobodni jahači".…”

Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

“…The cybersecurity problem among interconnected firms could be seen as the typical interdependent security (IDS) problem, proposed firstly by Kunreuther and Heal [29], who conducted a case study of security investment behaviors among firms in airline security and found that there is a "free-riding problem" of firms' security investment, also denoted as negative externality. Later, some research committed to solving such a negative external issue [10,17,30,31]. For example, Zhao, Xue, and Whinston [9] explored the effects of three risk management methods including cyberinsurance, managed security services (MSSs), and risk pooling arrangements (RPAs) in addressing the investment inefficiency, and the results showed that MSSs has the best effect on security risk management, followed by RPAs and cyberinsurance.…”

“…Sharing computer security vulnerabilities, breaches, intrusions, and technological solutions is an effective way to help organizations prevent, detect and correct security breaches proactively. Studies have also pointed out that security information sharing could reduce the uncertainty of network security investment to a certain extent, and thus depress the value of deferred options related to the investment [24,25,30]. President Obama signed the Cybersecurity Information Sharing Act (CISA) in 2015 to improve the level of cybersecurity in the United States.…”

Information security investments: An exploratory multiple case study on decision-making, evaluation and learning

“…Proposition 2 notes that standardized decision processes are not applied. The academic literature has proposed various analyses to address information security investment decision-making (Bojanc & Jerman-Blažic 2012;Bojanc & Jerman-Blažic 2008;Huang & Behara 2013;Huang et al 2014;Qian et al 2017). While these approaches provide crucial input to determine the optimal amount, time and allocation of investments, the embedding within an organization's decision process is not carried out.…”