Abstract:Patch management is a crucial component of information security management. An important problem within this context from a vendor's perspective is to determine how to release patches to fix vulnerabilities in its software. From a firm's perspective, the issue is how to update vulnerable systems with available patches. In this paper, we develop a game-theoretic model to study the strategic interaction between a vendor and a firm in balancing the costs and benefits of patch management. Our objective is to examine the consequences of time-driven release and update policies. We first study a centralized system in a benchmark scenario to find the socially optimal time-driven patch management. We show that the social loss is minimized when patch-release and update cycles are synchronized. Next, we consider a decentralized system in which the vendor determines its patch-release policy and the firm selects its patch-update policy in a Stackelberg framework, assuming that release and update policies are either time driven or event driven. We develop a sufficient condition that guarantees that a time-driven release by the vendor and a time-driven update by the firm is the equilibrium outcome for patch management. However, in this equilibrium, the patch-update cycle of the firm may not be synchronized with the patch-release cycle of the vendor, making it impossible to achieve the socially optimal patch management in the decentralized system. Therefore, we next examine cost sharing and liability as possible coordination mechanisms. Our analysis shows that cost sharing itself may achieve synchronization and social optimality However, liability by itself cannot achieve social optimality unless patch-release and update cycles are already synchronized without introducing any liability. Our results also demonstrate that cost sharing and liability neither complement nor substitute each other. Finally, we show that an incentive-compatible contract on cost sharing can be designed to achieve coordination in case of information asymmetry.

Optimal Dissemination Strategy of Security Patch Based on Differential Game in Social Network

Information Security Problem Research Based on Game Theory

Dynamic Resource Access Using Graphical Game in Asymmetric Wireless Networks.

Content-Aware Data Dissemination for Enhancing Privacy and Availability in Wireless Sensor Networks

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

Geography-aware Active Data Dissemination in Mobile Social Networks.

Sustainability of Information Security Investment in Online Social Networks: an Evolutionary Game-Theoretic Approach

Economics of Security Patch Management.

A Privacy Protection Model of Data Publication Based on Game Theory

Security Patch Management: Share The Burden Or Share The Damage?

Differential Game Approach for Attack-Defense Strategy Analysis in Internet of Things Networks

Private Information Diffusion Control in Cyber Physical Systems: A Game Theory Perspective

Study on Stochastic Differential Game Model in Network Attack and Defense

Data Transmission and Management Based on Node Communication in Opportunistic Social Networks

Vaccinating SIS Epidemics in Networks with Zero-Determinant Strategy

Application of hybrid strategies of complex network attack and defense games

Optimization of Key Predistribution Protocol Based on Supernetworks Theory in Heterogeneous WSN

Optimal Network Defense Strategy Selection Based on Bayesian Game

Optimal Online Data Dissemination for Resource Constrained Mobile Opportunistic Networks

Optimal Protection Resource Allocation: A Perspective of Network Science

A Game Theory-Based Model for the Dissemination of Privacy Information in Online Social Networks