|
Archive@NYU >
Stern School of Business >
CeDER Published Papers >
Please use this identifier to cite or link to this item:
http://hdl.handle.net/2451/27739
|
| Title: | The Economic Incentives for Sharing Security Information |
| Authors: | Ghose, Anindya
Gal-Or, Esther |
| Keywords: | security technology investment
information sharing
security breaches
externality benefit
social welfare
spillover effect |
| Issue Date: | Jun-2006 |
| Publisher: | Information Systems Research |
| Series/Report no.: | CeDER-PP-2006-01 |
| Abstract: | Given that information technology (IT) security has emerged as an
important issue in the last few years, the subject of security
information sharing among firms, as a tool to minimize security
breaches, has gained the interest of practitioners and academics. To
promote the disclosure and sharing of cyber security information among
firms, the U.S. federal government has encouraged the establishment of
many industry-based Information Sharing and Analysis Centers (ISACs)
under Presidential Decision Directive (PDD) 63. Sharing security
vulnerabilities and technological solutions related to methods for
preventing, detecting, and correcting security breaches is the
fundamental goal of the ISACs. However, there are a number of
interesting economic issues that will affect the achievement of this
goal. Using game theory, we develop an analytical framework to
investigate the competitive implications of sharing security information
and investments in security technologies. We find that security
technology investments and security information sharing act as
“strategic complements” in equilibrium. Our results suggest
that information sharing is more valuable when product substitutability
is higher, implying that such sharing alliances yield greater benefits
in more competitive industries. We also highlight that the benefits from
such information-sharing alliances increase with the size of the firm.
We compare the levels of information sharing and technology investments
obtained when firms behave independently (Bertrand-Nash) to those
selected by an ISAC, which maximizes social welfare or joint industry
profits. Our results help us predict the consequences of establishing
organizations such as ISACs, Computer Emergency Response Team (CERT), or
InfraGard by the federal government. |
| URI: | http://hdl.handle.net/2451/27739 |
| Appears in Collections: | CeDER Published Papers
|
All items in Faculty Digital Archive are protected by copyright, with all rights reserved.
|
