Advanced Search
MyIDEAS: Login to save this paper or follow this series

The Economic Incentives for Sharing Security Information

Contents:

Author Info

  • Esther Gal-Or

    (Katz School, University of Pittsburgh)

  • Anindya Ghose

    (Stern School, New York University)

Abstract

Given that Information Technology (IT) security has emerged as an important issue in the last few years, the subject of security information sharing among firms, as a tool to minimize security breaches, has gained the interest of practitioners and academics. To promote the disclosure and sharing of cyber-security information among firms, the US federal government has encouraged the establishment of many industry based Information Sharing & Analysis Centers (ISACs) under Presidential Decision Directive 63. Sharing security vulnerabilities and technological solutions related to methods for preventing, detecting and correcting security breaches, is the fundamental goal of the ISACs. However, there are a number of interesting economic issues that will affect the achievement of this goal. Using game theory, we develop an analytical framework to investigate the competitive implications of sharing security information and investments in security technologies. We find that security technology investments and security information sharing act as ``strategic complements'' in equilibrium. Our results suggest that information sharing is more valuable when product substitutability is higher, implying that such sharing alliances yield greater benefits in more competitive industries. We also highlight that the benefits from such information sharing alliances increase with the size of the firm. We compare the levels of information sharing and technology investments obtained when firms behave independently (Bertrand-Nash) to those selected by an ISAC which maximizes social welfare or joint industry profits. Our results help us predict the consequences of establishing organizations such as ISACs, CERT or InfraGard by the federal government.

Download Info

If you experience problems downloading a file, check if you have the proper application to view it first. In case of further problems read the IDEAS help page. Note that these files are not on the IDEAS site. Please be patient as the files may be large.
File URL: http://128.118.178.162/eps/io/papers/0503/0503004.pdf
Download Restriction: no

Bibliographic Info

Paper provided by EconWPA in its series Industrial Organization with number 0503004.

as in new window
Length: 41 pages
Date of creation: 13 Mar 2005
Date of revision:
Handle: RePEc:wpa:wuwpio:0503004

Note: Type of Document - pdf; pages: 41
Contact details of provider:
Web page: http://128.118.178.162

Related research

Keywords: Technology Investment; Information Sharing; Security Breaches; Externality Benefit; Spillover Effect; Social Welfare;

Find related papers by JEL classification:

This paper has been announced in the following NEP Reports:

References

References listed on IDEAS
Please report citation or reference errors to , or , if you are the registered author of the cited work, log in to your RePEc Author Service profile, click on "citations" and make appropriate adjustments.:
as in new window
  1. Milgrom, Paul, 1994. "Comparing Optima: Do Simplifying Assumptions Affect Conclusions?," Journal of Political Economy, University of Chicago Press, vol. 102(3), pages 607-15, June.
  2. Shapiro, Carl, 1986. "Exchange of Cost Information in Oligopoly," Review of Economic Studies, Wiley Blackwell, vol. 53(3), pages 433-46, July.
  3. Groves, Theodore, 1973. "Incentives in Teams," Econometrica, Econometric Society, vol. 41(4), pages 617-31, July.
  4. d'Aspremont, Claude & Jacquemin, Alexis, 1988. "Cooperative and Noncooperative R&D in Duopoly with Spillovers," American Economic Review, American Economic Association, vol. 78(5), pages 1133-37, December.
  5. Myerson, Roger B. & Satterthwaite, Mark A., 1983. "Efficient mechanisms for bilateral trading," Journal of Economic Theory, Elsevier, vol. 29(2), pages 265-281, April.
  6. Myerson, Roger B, 1979. "Incentive Compatibility and the Bargaining Problem," Econometrica, Econometric Society, vol. 47(1), pages 61-73, January.
  7. Theodore Groves & Martin Loeb, 1974. "Incentives and Public Inputs," Discussion Papers 29, Northwestern University, Center for Mathematical Studies in Economics and Management Science.
  8. Narasimhan, Chakravarthi, 1988. "Competitive Promotional Strategies," The Journal of Business, University of Chicago Press, vol. 61(4), pages 427-49, October.
  9. Bulow, Jeremy I & Geanakoplos, John D & Klemperer, Paul D, 1985. "Multimarket Oligopoly: Strategic Substitutes and Complements," Journal of Political Economy, University of Chicago Press, vol. 93(3), pages 488-511, June.
  10. Timothy W. McGuire & Richard Staelin, 1983. "An Industry Equilibrium Analysis of Downstream Vertical Integration," Marketing Science, INFORMS, vol. 2(2), pages 161-191.
  11. Gordon, Lawrence A. & Loeb, Martin P. & Lucyshyn, William, 2003. "Sharing information on computer systems security: An economic analysis," Journal of Accounting and Public Policy, Elsevier, vol. 22(6), pages 461-485.
  12. Roger B. Myerson, 1978. "Optimal Auction Design," Discussion Papers 362, Northwestern University, Center for Mathematical Studies in Economics and Management Science.
  13. Gal-Or, Esther, 1985. "Information Sharing in Oligopoly," Econometrica, Econometric Society, vol. 53(2), pages 329-43, March.
Full references (including those not matched with items on IDEAS)

Citations

Blog mentions

As found by EconAcademics.org, the blog aggregator for Economics research:
  1. How can we co-operate to tackle phishing?
    by Tyler Moore in Light Blue Touchpaper on 2008-10-27 12:47:06
Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
as in new window

Cited by:
  1. Nizovtsev, Dmitri & Thursby, Marie, 2007. "To disclose or not? An analysis of software user behavior," Information Economics and Policy, Elsevier, vol. 19(1), pages 43-64, March.
  2. Fabio BISOGNI & Simona CAVALLINI & Sara DI TROCCHIO, 2011. "Cybersecurity at European Level: The Role of Information Availability," Communications & Strategies, IDATE, Com&Strat dept., vol. 1(81), pages 105-124, 1st quart.
  3. Huseyin Cavusoglu & Hasan Cavusoglu, 2007. "Assessing the Value of Network Security Technologies: The Impact of Configuration and Interaction on Value," Working Papers 07-19, NET Institute, revised Aug 2007.
  4. Alfredo Garcia & Barry Horowitz, 2007. "The potential for underinvestment in internet security: implications for regulatory policy," Journal of Regulatory Economics, Springer, vol. 31(1), pages 37-55, February.

Lists

This item is not listed on Wikipedia, on a reading list or among the top items on IDEAS.

Statistics

Access and download statistics

Corrections

When requesting a correction, please mention this item's handle: RePEc:wpa:wuwpio:0503004. See general information about how to correct material in RePEc.

For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: (EconWPA).

If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

If references are entirely missing, you can add them using this form.

If the full references list an item that is present in RePEc, but the system did not link to it, you can help with this form.

If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your profile, as there may be some citations waiting for confirmation.

Please note that corrections may take a couple of weeks to filter through the various RePEc services.