The Economic Incentives for Sharing Security Information

Abstract

Given that information technology (IT) security has emerged as an important issue in the last few years, the subject of security information sharing among firms, as a tool to minimize security breaches, has gained the interest of practitioners and academics. To promote the disclosure and sharing of cyber security information among firms, the U.S. federal government has encouraged the establishment of many industry-based Information Sharing and Analysis Centers (ISACs) under Presidential Decision Directive (PDD) 63. Sharing security vulnerabilities and technological solutions related to methods for preventing, detecting, and correcting security breaches is the fundamental goal of the ISACs. However, there are a number of interesting economic issues that will affect the achievement of this goal. Using game theory, we develop an analytical framework to investigate the competitive implications of sharing security information and investments in security technologies. We find that security technology investments and security information sharing act as "strategic complements" in equilibrium. Our results suggest that information sharing is more valuable when product substitutability is higher, implying that such sharing alliances yield greater benefits in more competitive industries. We also highlight that the benefits from such information-sharing alliances increase with the size of the firm. We compare the levels of information sharing and technology investments obtained when firms behave independently (Bertrand-Nash) to those selected by an ISAC, which maximizes social welfare or joint industry profits. Our results help us predict the consequences of establishing organizations such as ISACs, Computer Emergency Response Team (CERT), or InfraGard by the federal government.

Market for Software Vulnerabilities? Think Again

“…In their paper, they also provide an overview for developing economic models to study issues such as free-riding, which Varian (2002) has recognized as an important element in the information security space. Two other papers- Gordon et al (2003) and Gal-Or and Ghose (2003)-have followed up on this idea and developed game-theoretic models to study the economic consequences of sharing security information in ISACs. The focus of Gordon et al (2003) is on how information sharing affects the overall level of information security by examining the effect of security investment on expected security costs.…”

“…The focus of Gordon et al (2003) is on how information sharing affects the overall level of information security by examining the effect of security investment on expected security costs. Gordon et al (2003) focus on the cost-side, and Gal-Or and Ghose (2003) focus on the demand side effects of security breaches and information sharing.…”

A Strategic Analysis of Information Sharing Among Cyber Attackers

“…Previous relevant work includes in the literature on oligopolies, cooperative relationships, joint ventures, and trade associations (Gal-Or 1986, Kirby 1988, Novshek and Sonnenschein 1982, Shapiro 1986, Vives 1990). More recently, information sharing among firms to defend against cyber attacks has been analyzed by Gordon, Loeb and Lucyshyn (2003), Gal-Or and Ghose (2005), and Hausken (2007Hausken ( , 2009). The focus of is on how information sharing affects the overall level of information security.…”

“…They highlight the tradeoff that firms face between improved information security and the potential for free riding, which can lead to under-investment in security expenditures. While focus on the cost side effects of security breaches and information sharing, Gal-or and Ghose (2005) focus on the demand side effects and highlight the strategic implication of competition in the product market on information sharing and security technology investment levels. Hausken (2007) sharing and security investment for two firms are inverse U shaped in the aggregate attack, and interlinked through the interdependence between firms and the firm's unit cost of security investment.…”

The Price of Uncertainty in Security Games

“…Past work has, for example, considered the role of intermediaries such as Information Sharing & Analysis Centers to create incentives for exchanging and disclosing data between companies. Researchers investigated under which conditions organizations are willing to contribute to an information pool about security breaches and investments when (negative) competitive effects may result from this cooperation [9,12]. In different contexts disclosure is not always voluntary and companies may question how much profit they squander when undesirable information is released.…”