Abstract:The level of firms' information security investment has recently become a critical issue in the management of IT infrastructure. Prior studies have not considered attack types and firms interconnection simultaneously when investigating the optimisation of such investment. Using game theory, we demonstrate that the optimal security investment level of an interconnected firm against targeted attacks is different from that against opportunistic attacks. Our model shows that not all information security risks are worth fighting against. As the potential loss increases, it is unadvisable to increase the security investment proportionately. Firms should increase investments with intrinsic vulnerability when facing target attacks, but focus on those systems that fall into the midrange of intrinsic vulnerability when facing opportunistic attacks. Firms are unwilling to invest in security and often offload reliability problems onto others when the trusted interdependence relationship becomes tighter in the absence of economic incentives. Thus we also discuss two economic incentives to motivate firms: liability and security information sharing. We find-that if the rules are set properly, both economic incentives are effective to not only internalise the negative externality and improve a firm's security level, but also reduce the total expected cost. We show that firms' optimal investments of liability always increase with the increasing number of firms, but the optimal investments on security information sharing increase only when the number of firms is large enough. These insights draw attention to many trade-offs firms often face and the importance of accurate assessment of firms' security environment. Future research directions are discussed based on the limitations and possible extensions of this study. (C) 2015 Elsevier Ltd. All rights reserved.

Evolutionary Dynamics of the Interdependent Security Games on Complex Network.

Stackelberg Interdependent Security Game in Distributed and Hierarchical Cyber-Physical Systems

Tripartite evolutionary game in the process of network attack and defense

An Analysis of Games of Information Security Investment Based on Interdependent Security

Research on Evolutionary Game Model of Network Attack and Defense Based on Incentive Mechanism

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Evolutionary dynamics of cooperation on interdependent networks with Prisoner's Dilemma and Snowdrift Game

Evolutionary Dynamics of Cooperation on Interdependent Networks with the Prisoner's Dilemma and Snowdrift Game

Evolution Game Model of Offense-Defense for Network Security Based on System Dynamics

Game of Information Security Investment: Impact of Attack Types and Network Vulnerability.

Research on Decision of Cyber Security Investment Based on Evolutionary Game Model

Multi-Player Evolutionary Game of Network Attack and Defense Based on System Dynamics

Study on Stochastic Differential Game Model in Network Attack and Defense

A game-theoretic analysis of information security investment for multiple firms in a network

Evolutionary Cooperation in Networked Public Goods Game with Dependency Groups.

A Security Differential Game Model for Sensor Networks in Context of the Internet of Things

Spontaneous Symmetry Breaking in Interdependent Networked Game

Optimal information security investment analyses with the consideration of the benefits of investment and using evolutionary game theory

Randomly Biased Investments and the Evolution of Public Goods on Interdependent Networks

Heterogeneously Networked Evolutionary Games with Intergroup Conflicts.

Evolutionary Game Dynamics of Multiagent Systems on Multiple Community Networks.