Abstract:Patch management is a crucial component of information security management. An important problem within this context from a vendor's perspective is to determine how to release patches to fix vulnerabilities in its software. From a firm's perspective, the issue is how to update vulnerable systems with available patches. In this paper, we develop a game-theoretic model to study the strategic interaction between a vendor and a firm in balancing the costs and benefits of patch management. Our objective is to examine the consequences of time-driven release and update policies. We first study a centralized system in a benchmark scenario to find the socially optimal time-driven patch management. We show that the social loss is minimized when patch-release and update cycles are synchronized. Next, we consider a decentralized system in which the vendor determines its patch-release policy and the firm selects its patch-update policy in a Stackelberg framework, assuming that release and update policies are either time driven or event driven. We develop a sufficient condition that guarantees that a time-driven release by the vendor and a time-driven update by the firm is the equilibrium outcome for patch management. However, in this equilibrium, the patch-update cycle of the firm may not be synchronized with the patch-release cycle of the vendor, making it impossible to achieve the socially optimal patch management in the decentralized system. Therefore, we next examine cost sharing and liability as possible coordination mechanisms. Our analysis shows that cost sharing itself may achieve synchronization and social optimality However, liability by itself cannot achieve social optimality unless patch-release and update cycles are already synchronized without introducing any liability. Our results also demonstrate that cost sharing and liability neither complement nor substitute each other. Finally, we show that an incentive-compatible contract on cost sharing can be designed to achieve coordination in case of information asymmetry.

Evaluating Security and Availability of Multiple Redundancy Designs when Applying Security Patches

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Redundancy analysis for repairable multi-state system by using combined stochastic processes methods and universal generating function technique

Redundancy Analysis for Multi-state System: Reliability and Financial Assessment

Redundancy Design and Preventive Maintenance for a Load-Sharing Multiasset System Considering Uncertain Environmental Conditions

Redundancy Allocation for Multistate Systems with Component Dependencies and Load Sharing

Assessing Physical Network Vulnerability under Random Line-Segment Failure Model

Optimal Loading and Protection of Multi-State Systems Considering Performance Sharing Mechanism.

Distributionally Robust Design for Redundancy Allocation.

Assessing network vulnerability under probabilistic region failure model

Unveiling the Strategic Defense Mechanisms in Dynamic Heterogeneous Redundancy Architecture

Economics of Security Patch Management.

Security Capability Analysis of Software-Based Heterogeneous Redundant Execution System

A Joint Redundancy and Imperfect Maintenance Strategy Optimization for Multi-State Systems

Security Patch Management: Share The Burden Or Share The Damage?

Testing-Resource Allocation for Redundant Software Systems.

Optimal Redundancy Strategy of Defense Resource Allocation for Power Grid System Based on Game Theory Analysis

Combined Redundancy Allocation and Maintenance Planning Using a Two-Stage Stochastic Programming Model for Multiple Component Systems

Markov-based reliability model for a mixed redundant system and parallel genetic algorithm with knowledge archives for a redundancy allocation problem

Reliability and Modeling of Auxiliary Power Supply on Nuclear Power Plant

Performance modeling for condition-based activation of the redundant safety system subject to harmful tests