Abstract:We study the relationship between decisions made by two similar firms pertaining to knowledge sharing and investment in information security. The analysis shows that the nature of information assets possessed by the two firms, either complementary or substitutable, plays a crucial role in influencing these decisions. In the complementary case, we show that the firms have a natural incentive to share security knowledge and no external influence to induce sharing is needed. However, the investment levels chosen in equilibrium are lower than optimal, an aberration that can be corrected using coordination mechanisms that reward the firms for increasing their investment levels. In the substitutable case, the firms fall into a Prisoners' Dilemma trap where they do not share security knowledge in equilibrium, despite the fact that it is beneficial for both of them to do so. Here, the beneficial role of a social planner to encourage the firms to share is indicated. However, even when the firms share in accordance to the recommendations of a social planner, the level of investment chosen by the firms is sub-optimal. The firms either enter into an ''arms race'' where they over-invest or reenact the under-investment behavior found in the complementary case. Once again, this sub-optimal behavior can be corrected using incentive mechanisms that penalize for over-investment and reward for increasing the investment level in regions of under-investment. The proposed coordination schemes, with some modifications, achieve the socially optimal outcome even when the firms are risk-averse. Implications for information security vendors, firms, and social planner are discussed.

Comparison of Information Security Decisions under Different Security and Business Environments

Information Security Problem Research Based on Game Theory

The Equilibrium Analysis of Organization Information Security Investment Game

Information Security Game Analysis with Penalty Parameter

Information Security Investment Game with Penalty Parameter

Information security investment with budget constraint and security information sharing in resource-sharing environments

Understanding the Cost associated with Data Security Breaches.

Differential Market Reaction to Data Security Breaches: A Screening Perspective

Decision making of optimal investment in information security for complementary enterprises based on game theory

Information security investment for complementary and substitutable firms: The role of technology similarity

Comparing Decision Support Approaches for Cyber Security Investment

Knowledge sharing and investment decisions in information security

Information Security Investment with Different Information Types: A Two-Firm Analysis.

A game-theoretic analysis of information security investment for multiple firms in a network

Information security breaches and IT security investments: Impacts on competitors

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Information Security Strategies for Information-Sharing Firms Considering a Strategic Hacker

Where is IT in Information Security? The Interrelationship among IT Investment, Security Awareness, and Data Breaches

The best laid plans or lack thereof: Security decision-making of different stakeholder groups

Dynamic Competition in It Security: A Differential Games Approach

Dynamics and Endogeny for recursive processes on trees