Abstract:Patch management is a crucial component of information security management. An important problem within this context from a vendor's perspective is to determine how to release patches to fix vulnerabilities in its software. From a firm's perspective, the issue is how to update vulnerable systems with available patches. In this paper, we develop a game-theoretic model to study the strategic interaction between a vendor and a firm in balancing the costs and benefits of patch management. Our objective is to examine the consequences of time-driven release and update policies. We first study a centralized system in a benchmark scenario to find the socially optimal time-driven patch management. We show that the social loss is minimized when patch-release and update cycles are synchronized. Next, we consider a decentralized system in which the vendor determines its patch-release policy and the firm selects its patch-update policy in a Stackelberg framework, assuming that release and update policies are either time driven or event driven. We develop a sufficient condition that guarantees that a time-driven release by the vendor and a time-driven update by the firm is the equilibrium outcome for patch management. However, in this equilibrium, the patch-update cycle of the firm may not be synchronized with the patch-release cycle of the vendor, making it impossible to achieve the socially optimal patch management in the decentralized system. Therefore, we next examine cost sharing and liability as possible coordination mechanisms. Our analysis shows that cost sharing itself may achieve synchronization and social optimality However, liability by itself cannot achieve social optimality unless patch-release and update cycles are already synchronized without introducing any liability. Our results also demonstrate that cost sharing and liability neither complement nor substitute each other. Finally, we show that an incentive-compatible contract on cost sharing can be designed to achieve coordination in case of information asymmetry.

Economics of Security Patch Management.

Security Patch Management: Share The Burden Or Share The Damage?

Information Security Problem Research Based on Game Theory

A Game-Theoretic Method for Cross-Layer Stochastic Resilient Control Design in CPS.

Update/Patch Management Systems: A Protocol Taxonomy With Security Implications

To Patch, or not To Patch? That is the Question: A Case Study of System Administrators' Online Collaborative Behaviour

Optimal Dissemination Strategy of Security Patch Based on Differential Game in Social Network

Testing effort based modeling to determine optimal release and patching time of software

A Grounded Theory of the Role of Coordination in Software Security Patch Management

Evaluating Security and Availability of Multiple Redundancy Designs when Applying Security Patches

A Quantal Response Analysis of Human Decision-Making in Interdependent Security Games Modeled by Attack Graphs

Understanding the Practice of Security Patch Management Across Multiple Branches in OSS Projects

Computing Optimal Security Strategies for Interdependent Assets

Understanding the Inefficiency of Security-Constrained Economic Dispatch

Game-Theoretic Model for Optimal Cyber-Attack Defensive Decision-Making in Cyber-Physical Power Systems

A Game Theory-Based Approach For Vulnerability Analysis Of A Cyber-Physical Power System

Playing Bayesian Stackelberg game model for optimizing the vulnerability level of security incident system in petrochemical plants

Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector

Information security investment with budget constraint and security information sharing in resource-sharing environments

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

Joint Security-vs-QoS Game Theoretical Optimization for Intrusion Response Mechanisms for Future Network Systems