Network Security: Vulnerabilities and Disclosure Policy
AbstractSoftware security is a major concern for vendors, consumers, and regulators since attackers that exploit vulnerabilities can cause substantial damages. When vulnerabilities are discovered after the software has been sold to consumers, the firms face a dilemma. A policy of disclosing vulnerabilities and issuing updates protects only the consumers who install updates, while the disclosure itself facilitates reverse engineering of the vulnerability by hackers. The paper develops a setting that examines the economic incentives facing software vendors and users when software is subject to vulnerabilities. We consider a firm that sells software which is subject to potential security breaches. The firm needs to set the price of the software and state whether it intends to disclose vulnerabilities and issue updates. Consumers differ in their value of the software and the potential damage that hackers may inflict and need to decide whether to purchase the software as well as whether to install updates. Prices, market shares, and profits depend on the disclosure policy of the firm. The paper analyzes the market outcome and derives the conditions under which a firm would disclose vulnerabilities. It then examines the effect of a regulatory policy that requires mandatory disclosure of vulnerabilities. The paper discusses the incentives to invest in product security by investigating how a decline in the number of vulnerabilities and an increase in the probability that the firm will identify vulnerabilities ex-post (before hackers) affect disclosure policy, price and profits.
Download InfoIf you experience problems downloading a file, check if you have the proper application to view it first. In case of further problems read the IDEAS help page. Note that these files are not on the IDEAS site. Please be patient as the files may be large.
Bibliographic InfoPaper provided by C.E.P.R. Discussion Papers in its series CEPR Discussion Papers with number 6134.
Date of creation: Feb 2007
Date of revision:
Contact details of provider:
Postal: Centre for Economic Policy Research, 77 Bastwick Street, London EC1V 3PZ.
Phone: 44 - 20 - 7183 8801
Fax: 44 - 20 - 7183 8820
Other versions of this item:
- Jay Pil Choi & Chaim Fershtman & Neil Gandal, 2010. "Network Security: Vulnerabilities And Disclosure Policy," Journal of Industrial Economics, Wiley Blackwell, vol. 58(4), pages 868-894, December.
- L10 - Industrial Organization - - Market Structure, Firm Strategy, and Market Performance - - - General
- L63 - Industrial Organization - - Industry Studies: Manufacturing - - - Microelectronics; Computers; Communications Equipment
This paper has been announced in the following NEP Reports:
You can help add them by filling out this form.
CitEc Project, subscribe to its RSS feed for this item.
- Chaim FERSHTMAN & Neil GANDAL, 2012. "Migration to the Cloud Ecosystem: Ushering in a New Generation of Platform Competition," Communications & Strategies, IDATE, Com&Strat dept., vol. 1(85), pages 109-123, 1st quart.
- Taylor J. Canann, 2013. "Software Vulnerability Analysis in Cyber Security: A Network Structure Approach," BYU Macroeconomics and Computational Laboratory Working Paper Series 2013-05, Brigham Young University, Department of Economics, BYU Macroeconomics and Computational Laboratory, revised Apr 2014.
For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: ().
If references are entirely missing, you can add them using this form.