A Strategic Analysis of Information Sharing Among Cyber Attackers

Abstract

We build a game theory model where the market design is such that one firm invests in security to defend against cyber attacks by two hackers. The firm has an asset, which is allocated between the three market participants dependent on their contest success. Each hacker chooses an optimal attack, and they share information with each other about the firm's vulnerabilities. Each hacker prefers to receive information, but delivering information gives competitive advantage to the other hacker. We find that each hacker's attack and information sharing are strategic complements while one hacker's attack and the other hacker's information sharing are strategic substitutes. As the firm's unit defense cost increases, the attack is inverse U-shaped and reaches zero, while the firm's defense and profit decrease, and the hackers' information sharing and profit increase. The firm's profit increases in the hackers' unit cost of attack, while the hackers' information sharing and profit decrease. Our analysis also reveals the interesting result that the cumulative attack level of the hackers is not affected by the effectiveness of information sharing between them and, moreover, is also unaffected by the intensity of joint information sharing. We also find that as the effectiveness of information sharing between hackers increases relative to the investment in attack, the firm's investment in cyber security defense and profit are constant, the hackers' investments in attacks decrease, and information sharing levels and hacker profits increase. In contrast, as the intensity of joint information sharing increases, while the firm's investment in cyber security defense and profit remain constant, the hackers' investments in attacks increase, and the hackers' information sharing levels and profits decrease. Increasing the firm's asset causes all the variables to increase linearly, except information sharing which is constant. We extend our analysis to endogenize the firm's asset and this analysis largely confirms the preceding analysis with a fixed asset. We use the software Mathematica 10.1 (www.wolfram.com) to program the model mathematically with equilibrium constraints, and perform numerical analysis illustrated graphically.

Cyber Peace

“…The 2016 Guide to Cyber Threat Information Sharing, published by the US National Institute of Standards and Technology (NIST), describes the advantages of IS measures for improving cybersecurity 6 as follows: 5 Of course, hostile cyber actors also engage in IS, an interesting issue beyond the present scope. See Hausken (2015). 6 "Cybersecurity" describes the process of applying a "range of actions for the prevention, mitigation, investigation and handling of cyber threats and incidents, and for the reduction of their effects and of the damage caused by them prior, during and after their occurrence."…”

A Two-Period Game Theoretic Model of Zero-Day Attacks with Stockpiling

“…Within information security, game theoretic research has focused on data survivability versus security in information systems [27], substitution and interdependence [28][29][30], returns on information security investment [31,32], and information sharing to prevent attacks [33][34][35][36][37]. See Do et al [38], Hausken and Levitin [39], and Roy et al [40] for reviews on game theoretic cybersecurity research.…”

Perspectives on Cybersecurity Information Sharing among Multiple Stakeholders Using a Decision‐Theoretic Approach

“…(2007) study the investment strategies in defense among defenders in interdependent security scenarios; Ghose et al . study information sharing linked to competition between cyber attackers; Nikoofal and Zhuang (2015), Zhuang et al . (2010), Zhuang et al .…”

“…As we discussed, the main inhibitor preventing the private sectors from actively participating in an information sharing system is the concern of information leakage. Interestingly, when it turns to information sharing among cyber hackers, according to Hausken, “an important difference is that whereas two firms incur information leakage costs when sharing information about their vulnerabilities and security breaches, two hackers sharing information about a firm's vulnerabilities do not incur costs in the same manner.” Hausken also suggests that defenders compartmentalize the interaction of hackers with each other or design incentives to isolate them from each other since “hackers may cooperate through sharing information with each other about a firm's vulnerabilities.”…”