The impact of regulatory mechanisms on vulnerability disclosure behavior during crowdsourcing cybersecurity testing

Abstract

<abstract><p>There are various regulatory mechanisms to coordinate vulnerability disclosure behaviors during crowdsourcing cybersecurity testing. However, in the case of unclear regulatory effectiveness, enterprises cannot obtain sufficient vulnerability information, third-party crowdsourcing cybersecurity testing platforms fail to provide trusted services, and the government lacks strong credibility. We have constructed a tripartite evolutionary game model to analyze the evolutionary process of the equilibrium of {legal disclosure, active operation, strict regulation}, and the paper reveals the impact of three regulatory mechanisms. We find that these participants' positive behaviors are in a stable state. Higher initial willingness accelerates the speed of reaching the evolutionary stability of the system, and this equilibrium is satisfied only if the governmental regulatory benefits are sufficiently high. Regarding the punishment mechanism, increased punishment for enterprises causes them to adopt positive behaviors faster, while the opposite occurs for platforms; increased punishment for platforms drives both participants to adopt positive behaviors faster. Concerning the subsidy mechanism, increased subsidy to enterprises causes them to adopt legal disclosure behaviors faster, while platforms remain unresponsive; increased subsidy to platforms motivates both players to choose their own positive behaviors. In terms of the collaborative disclosure mechanism, excessive collaborative costs reduce the platforms' willingness to operate actively, which decreases the enterprises' incentives to disclose vulnerability legally. These findings guide the government to establish suitable mechanisms to regulate the participants' behavior and promote the healthy development of the cybersecurity crowdsourcing industry.</p></abstract>

Regulatory mechanism of vulnerability disclosure behavior considering security crowd-testing: An evolutionary game analysis

“…Chen et al [ 50 ] constructed a similar evolutionary game model for government subsidies, which also concluded that excessive government subsidies are detrimental to reaching the system’s steady state. Thirdly, in terms of the government’s incentive mechanisms for security researchers, different from the findings of Zhao et al [ 56 ], we find that compared to incentive mechanisms for SRCs, the government’s increasing punishments for security researchers are more effective, which can encourage SRCs to adopt cooperative strategies by regulating security researchers’ behaviors. Fourthly, in terms of SRCs’ incentive mechanisms for security researchers, while SRCs’ increasing punishments for security researchers may decelerate the government reaching a stable state, it can compensate for the government’s deficiencies in sole regulation by forming a society-wide co-regulatory system as mentioned by Chen et al [ 53 ], but excessive punishments should be avoided.…”

“…With reference to the parameter setting method of Liu et al [ 54 ], the parameter values in this study are mainly determined by two methods. Firstly, based on real cases and literature references, we refer to parameter values and research results from Walshe et al [ 55 ] and Zhao et al [ 56 ], setting: P 1 = 20, P 2 = 50, C 2 = 20, L 1 = 60, L 3 = 100. Based on the policy text analysis of the “Cyber Security Law of the People’s Republic of China”, setting: R = 100, C 3 = 50, A = 20, K 1 = 15, K 2 = 35.…”