Interdependent Security

Abstract

Do firms have adequate incentives to invest in protection against a risk whose magnitude depends in the actions of others? This paper characterizes the Nash equilibria for this type of interaction between agents, which we call the interdependent security (IDS) problem. When agents are identical, there are two Nash equilibria for a wide range of cost and risk parameters ---either everyone invests in protection or no one does. In some situations the incentive to invest in protection approaches zero as the number of unprotected agents increases. We develop an IDS model by first focusing on airline security and comparing the structure of this problem with other IDS examples such as computer security, fire protection, vaccinations, protection against bankruptcy, and theft protection. The paper also examines the roles of insurance, liability, fines and subsidies, third party inspections, regulations and coordinating mechanisms for internalizing the negative externalities characteristic of these problems. The concluding section suggests directions for future theoretical and empirical research.

Subsidization to induce tipping

“…Note that (t) = U (0; t) U (1; t) which is exactly enough to induce this agent to choose 1. 4 Thus, this agent prefers to play 1, eliminating a 0 as an equilibrium. S is therefore su¢ cient to eliminate all equilibria except a 1 .…”

“…Examples of these games from Thomas Schelling's (1978) well known work on this topic include urban segregation, faculty seminar participation, and the use of helmets in professional hockey. Other examples include interdependent security (Heal and Kunreuther, 2003), poverty traps (Azariadas, 1996), urban development (Rauch, 1993), and some examples of public good provision. The possibility for tipping arises in games which exhibit supermodularity, as shown by Kunreuther and Heal (2010), who characterize the minimal tipping set needed to lead agents from one equilibrium to another.…”

“…In Section 3, we specifically apply our results to the interdependent security problem from Kunreuther and Heal (2003), although this example is not meant to exclude other possible applications.…”

Information Risk in Financial Institutions: Field Study and Research Roadmap

“…Thus far, we have examined characteristics that can affect information security in financial institutions; we know that large firms are particularly challenged by having thousands of employees performing diverse tasks across the globe, and also because these overarching organizations are usually composed of many independent business units facing interdependent security risks [8,9]. Furthermore, we have examined elements of the culture at this specific firm and customs that directly impact the development and deployment of security technology, noting the "build or buy" policy, the financial and operational freedom provided for the establishment of secure systems, the company's relationship with software vendors, and⎯perhaps most significantly⎯the unique structure and philosophy of the technology risk group.…”

Blue versus Red: Towards a Model of Distributed Security Attacks

“…In particular, we want to provide a mathematical framework with enough nuanced structure (e.g., different threat models) to enable stronger and more intuitive statements about characteristics of cyber attack equilibria [12]. We add to the literature on game-theoretic models that have often exclusively focused on the strategic aspects of offensive [34] or defensive [18,23,26,38] actions, respectively. 1 We closely follow and expand on this prior work.…”