Game of information security investment: Impact of attack types and network vulnerability

Wu, Yong; Feng, Gengzhong; Wang, Nengmin; Liang, Huigang

doi:10.1016/j.eswa.2015.03.033

Cited by 55 publications

(34 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The cybersecurity problem among interconnected firms could be seen as the typical interdependent security (IDS) problem, proposed firstly by Kunreuther and Heal [29], who conducted a case study of security investment behaviors among firms in airline security and found that there is a "free-riding problem" of firms' security investment, also denoted as negative externality. Later, some research committed to solving such a negative external issue [10,17,30,31]. For example, Zhao, Xue, and Whinston [9] explored the effects of three risk management methods including cyberinsurance, managed security services (MSSs), and risk pooling arrangements (RPAs) in addressing the investment inefficiency, and the results showed that MSSs has the best effect on security risk management, followed by RPAs and cyberinsurance.…”

Section: Interdependent Cybersecurity Investmentmentioning

confidence: 99%

“…For example, Zhao, Xue, and Whinston [9] explored the effects of three risk management methods including cyberinsurance, managed security services (MSSs), and risk pooling arrangements (RPAs) in addressing the investment inefficiency, and the results showed that MSSs has the best effect on security risk management, followed by RPAs and cyberinsurance. Wu et al [17] focused on the impacts of attack types and network vulnerabilities on security investments, and examined three economic incentives for solving security underinvestment among interconnected firms. A differential game model was established to study the impact of interdependence of security investments between firms and strategic attackers [32].…”

Section: Interdependent Cybersecurity Investmentmentioning

confidence: 99%

“…Previous studies mainly focused on optimizing security investment in terms of system interconnection and information sharing among homogeneous firms [5,11,17]. Considering the fact that there are limited budgets on security investment which are often at a disadvantage when competing with that on other investment projects [18], one must allocate optimally the limited budgets to all branches including headquarters to achieve the highest cybersecurity gains, which, as authors known, is rarely mentioned in previous studies.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

2019

Mathematics

View full text Add to dashboard Cite

Network interconnection and information sharing among firms and their departments expose them to cybersecurity breaches. Traditional cybersecurity studies have paid little attention to the reallocation of security investment within firms. This paper proposes a mathematical model for optimal allocation of cybersecurity investment among headquarters and branches with budget constraints. The differences in size of information sets and system interconnection have been taken into account. The responses of optimal allocation to internal and external factors, such as the portion of branch information set, the propagation probability, the budget constraints, and the intrinsic vulnerability, have been studied in deep both theoretically and numerically. Analysis results indicate that the group will give priority to protecting headquarters when the total budget is small and intrinsic vulnerability is high. The security investment allocated to each branch increases with budget, propagation probability and portion of information set, but never exceeds 1 / ( n + 1 ) of total budget. Numerical simulations also verify that security information sharing among headquarters and branches can help improve the efficiency of security investment in the whole system. Furthermore, the findings of this paper will draw attention to the reallocation of cybersecurity investment within a business group and help cybersecurity managers to develop investment allocation strategies and policies.

show abstract

Section: Interdependent Cybersecurity Investmentmentioning

confidence: 99%

Section: Interdependent Cybersecurity Investmentmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

2019

Mathematics

View full text Add to dashboard Cite

show abstract

“…The researches in [12][13] [14][15][2] [16] analyze information sharing in the context of cybersecurity. Those papers show that multiple factors impact cyber threat information sharing including competition [14], free riding [2], interconnection [17], and the possibility to exploit vulnerabilities for cyber war [16]. However, none of those work look into sharing cybersecurity information in cloud computing.…”

Section: Background On Cloud Computing Security and Information Smentioning

confidence: 99%

“…Wu et al [17] use game theory to model the cybersecurity investment of interconnected firms. When a firm's information systems are difficult to breach, the hackers chose to attack the less secure firm's information systems that are connected and easier to breach.…”

Section: Background On Cloud Computing Security and Information Smentioning

confidence: 99%

Cyber-Threats Information Sharing in Cloud Computing: A Game Theoretic Approach

Kamhoua

Martin

Tosh

et al. 2015

2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing

View full text Add to dashboard Cite

Cybersecurity is among the highest priorities in industries, academia and governments. Cyber-threats information sharing among different organizations has the potential to maximize vulnerabilities discovery at a minimum cost. Cyberthreats information sharing has several advantages. First, it diminishes the chance that an attacker exploits the same vulnerability to launch multiple attacks in different organizations. Second, it reduces the likelihood an attacker can compromise an organization and collect data that will help him launch an attack on other organizations. Cyberspace has numerous interconnections and critical infrastructure owners are dependent on each other's service. This well-known problem of cyber interdependency is aggravated in a public cloud computing platform. The collaborative effort of organizations in developing a countermeasure for a cyber-breach reduces each firm's cost of investment in cyber defense.Despite its multiple advantages, there are costs and risks associated with cyber-threats information sharing. When a firm shares its vulnerabilities with others there is a risk that these vulnerabilities are leaked to the public (or to attackers) resulting in loss of reputation, market share and revenue. Therefore, in this strategic environment the firms committed to share cyberthreats information might not truthfully share information due to their own self-interests. Moreover, some firms acting selfishly may rationally limit their cybersecurity investment and rely on information shared by others to protect themselves. This can result in under investment in cybersecurity if all participants adopt the same strategy. This paper will use game theory to investigate when multiple self-interested firms can invest in vulnerability discovery and share their cyber-threat information. We will apply our algorithm to a public cloud computing platform as one of the fastest growing segments of the cyberspace.

show abstract

An economic analysis of information security investment decision making for substitutable enterprises

Xue

2021

Manage Decis Econ

View full text Add to dashboard Cite

As the competition among enterprises is increasingly fierce, the substitution of information assets makes the behavior of hackers and enterprises more complicated in the information security investment decision‐making process. In this paper, a game model of substitutable enterprise information security investment decision making is constructed by considering the influencing of substitution rate among enterprises, enterprise quantity, and probability of hacker invasion, and the optimal investment level is analyzed among substitutable enterprises under individual decision and joint decision based on game theory, optimization theory, and synergy theory. This research provides a new solution of information security investment decision making among substitutable enterprises.

show abstract

Game of information security investment: Impact of attack types and network vulnerability

Cited by 55 publications

References 25 publications

Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

Cybersecurity Investment Allocation for a Multi-Branch Firm: Modeling and Optimization

Cyber-Threats Information Sharing in Cloud Computing: A Game Theoretic Approach

An economic analysis of information security investment decision making for substitutable enterprises

Contact Info

Product

Resources

About