The Effect of Liability and Patch Release on Software Security: The Monopoly Case

Abstract

An abundance of flawed software has been identified as the main cause of the poor security of computer networks because major viruses and worms exploit the vulnerabilities of such software. As an incentive mechanism for software security quality improvement, software liability has been intensely discussed among both academics and practitioners for a long time. An alternative approach to managing software security is patch release, which has been widely adopted in practice. In this paper, we examine these two different ways of mitigating customer risk in the software market: liability and patch release. We study the impact of both mechanisms on a monopolistic software vendor's decision on security quality. We find the conditions under which each mechanism is effective in terms of improving security quality and increasing social surplus. The heterogeneous nature of loss is identified to be a key factor for the effectiveness of the liability mechanism. On the other hand, patch release can be effective and welfare‐enhancing regardless of the nature of loss as long as customers incur low patching cost, and/or the vendor incurs low patch development cost. We also examine the impact of customer misperception of the outcome from vulnerable software on the effectiveness of liability.

Panel Summary

“…Other refinements for software liability have been suggested [5,2,3,23,4]. These works suggest various types of liability, applied to various parties within the software deployment/development chain.…”

“…A European Union working group further suggested that software vendors have upper and lower limited liability thresholds based on the potential harm or criticality of software [4]. Models for liability have examined the effectiveness of different liability policies, finding that their effectiveness can be highly variable depending on the probability of zero-day exploits, the cost of patch deployment, the nature of loss, and whether a software vendor holds a monopoly [3,23].…”

Information Security Outsourcing with System Interdependency and Mandatory Security Requirement

“…Our setting, where the MSSP's protection effort is related to security breach probability, and the fact that the MSSP is liable for the client's damage when protection fails, is commonly seen in the product failure and insurance literature (e.g., [46, Downloaded by [University of Otago] at 06:09 24 July 2015 51,52]). Also, the use of software or system liability as an incentive mechanism in managing security risks has been widely proposed (e.g., [4,31,47]). For example, August and Tunca [6] analyze the impact of different liability policies on software vulnerability and derive the conditions under which loss liability and patch liability can be effective.…”

Managing Enterprise Risks of Technological Systems: An Exploratory Empirical Analysis of Vulnerability Characteristics as Drivers of Exploit Publication*

“…Risk , defined as “uncertainty inherent in doing business” (Straub & Welke, , p. 442), is further divided into business risks of “systems for delivering goods/services to a customer” or systems risk , defined as “the likelihood that the firm's information systems are insufficiently protected against certain kinds of damage or loss” (Straub & Welke, , p. 441–442). The wide application of technology to create business processes blurs these risk categories; business risks are now often systems risks (O'Donnell, ; Ransbotham & Mitra, ; Kim, Chen, & Mukhopadhyay, ). Outside of natural disasters and innate process failures, these risks arise from abuse of vulnerabilities via three enterprise conduits: organizational environment, internal enterprise systems, and the knowledge of individual actors about enterprise systems and their embedded risks (Straub & Welke, ).…”

“…ERM strives to catalog a firm's risks, aggregate similar risks, identify correlated risks, and carefully estimate their potential costs to an organization, as inputs to monitor and optimize a firm's actions across a risk portfolio (Nocco & Stulz, ; Wu & Olson, ). Doing so can lessen a firm's exposure to operational risks that can be managed by patching technologies and processes (Nocco & Stulz, ), versus by vendor contract liability clauses (Kim et al., ; August & Tunca, ), insurance, markets, or financial hedging (Anderson & Moore, ; Nocco & Stulz, ). The objective is to generate decision models managers can use to manage risks systematically (Wu & Olson, ), limiting harmful events by internally managing risks for which they have a comparative managerial advantage (Nocco & Stulz, ).…”