IDEAS home Printed from https://ideas.repec.org/a/inm/ormnsc/v51y2005i5p726-740.html
   My bibliography  Save this article

Market for Software Vulnerabilities? Think Again

Author

Listed:
  • Karthik Kannan

    (Krannert School of Management, Purdue University, West Lafayette, Indiana 47906)

  • Rahul Telang

    (H. John Heinz III School of Public Policy and Management, Carnegie Mellon University, Pittsburgh, Pennsylvania 15213)

Abstract

Software vulnerability disclosure has become a critical area of concern for policymakers. Traditionally, a Computer Emergency Response Team (CERT) acts as an infomediary between benign identifiers (who voluntarily report vulnerability information) and software users. After verifying a reported vulnerability, CERT sends out a public advisory so that users can safeguard their systems against potential exploits. Lately, firms such as iDefense have been implementing a new market-based approach for vulnerability information. The market-based infomediary provides monetary rewards to identifiers for each vulnerability reported. The infomediary then shares this information with its client base. Using this information, clients protect themselves against potential attacks that exploit those specific vulnerabilities. The key question addressed in our paper is whether movement toward such a market-based mechanism for vulnerability disclosure leads to a better social outcome. Our analysis demonstrates that an active unregulated market-based mechanism for vulnerabilities almost always underperforms a passive CERT-type mechanism. This counterintuitive result is attributed to the market-based infomediary's incentive to leak the vulnerability information inappropriately. If a profit-maximizing firm is not allowed to (or chooses not to) leak vulnerability information, we find that social welfare improves. Even a regulated market-based mechanism performs better than a CERT-type one, but only under certain conditions. Finally, we extend our analysis and show that a proposed mechanism---federally funded social planner---always performs better than a market-based mechanism.

Suggested Citation

  • Karthik Kannan & Rahul Telang, 2005. "Market for Software Vulnerabilities? Think Again," Management Science, INFORMS, vol. 51(5), pages 726-740, May.
  • Handle: RePEc:inm:ormnsc:v:51:y:2005:i:5:p:726-740
    DOI: 10.1287/mnsc.1040.0357
    as

    Download full text from publisher

    File URL: http://dx.doi.org/10.1287/mnsc.1040.0357
    Download Restriction: no

    File URL: https://libkey.io/10.1287/mnsc.1040.0357?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    References listed on IDEAS

    as
    1. Reinganum, Jennifer F, 1982. "A Dynamic Game of R and D: Patent Protection and Competitive Behavior," Econometrica, Econometric Society, vol. 50(3), pages 671-688, May.
    2. Bakos, Yannis & Brynjolfsson, Erik & Lichtman, Douglas, 1999. "Shared Information Goods," Journal of Law and Economics, University of Chicago Press, vol. 42(1), pages 117-155, April.
    3. Esther Gal-Or & Anindya Ghose, 2005. "The Economic Incentives for Sharing Security Information," Information Systems Research, INFORMS, vol. 16(2), pages 186-208, June.
    4. Yannis Bakos & Erik Brynjolfsson, 1999. "Bundling Information Goods: Pricing, Profits, and Efficiency," Management Science, INFORMS, vol. 45(12), pages 1613-1630, December.
    5. Partha Dasgupta & Joseph Stiglitz, 1980. "Uncertainty, Industrial Structure, and the Speed of R&D," Bell Journal of Economics, The RAND Corporation, vol. 11(1), pages 1-28, Spring.
    6. Gordon, Lawrence A. & Loeb, Martin P. & Lucyshyn, William, 2003. "Sharing information on computer systems security: An economic analysis," Journal of Accounting and Public Policy, Elsevier, vol. 22(6), pages 461-485.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Stavins, Robert & Jaffe, Adam & Newell, Richard, 2000. "Technological Change and the Environment," Working Paper Series rwp00-002, Harvard University, John F. Kennedy School of Government.
    2. Xing Gao, 2023. "A competitive analysis of software quality investment with technology diversification and security concern," Electronic Commerce Research, Springer, vol. 23(4), pages 2691-2712, December.
    3. Hausken, Kjell, 2024. "Fifty Years of Operations Research in Defense," European Journal of Operational Research, Elsevier, vol. 318(2), pages 355-368.
    4. Matros, Alexander & Smirnov, Vladimir, 2016. "Duplicative search," Games and Economic Behavior, Elsevier, vol. 99(C), pages 1-22.
    5. Kjell Hausken, 2017. "Security Investment, Hacking, and Information Sharing between Firms and between Hackers," Games, MDPI, vol. 8(2), pages 1-23, May.
    6. Huseyin Cavusoglu & Srinivasan Raghunathan & Hasan Cavusoglu, 2009. "Configuration of and Interaction Between Information Security Technologies: The Case of Firewalls and Intrusion Detection Systems," Information Systems Research, INFORMS, vol. 20(2), pages 198-217, June.
    7. Xiaotong Li, 2022. "An evolutionary game‐theoretic analysis of enterprise information security investment based on information sharing platform," Managerial and Decision Economics, John Wiley & Sons, Ltd., vol. 43(3), pages 595-606, April.
    8. Kjell Hausken, 2018. "Proactivity and Retroactivity of Firms and Information Sharing of Hackers," International Game Theory Review (IGTR), World Scientific Publishing Co. Pte. Ltd., vol. 20(01), pages 1-30, March.
    9. Levitin, Gregory & Hausken, Kjell & Taboada, Heidi A. & Coit, David W., 2012. "Data survivability vs. security in information systems," Reliability Engineering and System Safety, Elsevier, vol. 100(C), pages 19-27.
    10. Xing Gao & Weijun Zhong & Shue Mei, 2014. "A game-theoretic analysis of information sharing and security investment for complementary firms," Journal of the Operational Research Society, Palgrave Macmillan;The OR Society, vol. 65(11), pages 1682-1691, November.
    11. Mehrez, Abraham & Justman, Moshe, 2001. "On the efficiency of the parallel path R&D approach: a stochastic game analysis," Mathematics and Computers in Simulation (MATCOM), Elsevier, vol. 57(1), pages 19-28.
    12. Alessandro Fedele & Cristian Roner, 2022. "Dangerous games: A literature review on cybersecurity investments," Journal of Economic Surveys, Wiley Blackwell, vol. 36(1), pages 157-187, February.
    13. Kartik Hosanagar & John Chuang & Ramayya Krishnan & Michael D. Smith, 2008. "Service Adoption and Pricing of Content Delivery Network (CDN) Services," Management Science, INFORMS, vol. 54(9), pages 1579-1593, September.
    14. Johnson, Justin P., 2014. "Defensive publishing by a leading firm," Information Economics and Policy, Elsevier, vol. 28(C), pages 15-27.
    15. Arisian, Sobhan & Halat, Kourosh & Hafezalkotob, Ashkan & Maskey, Reenu, 2025. "Coopetitive Resilience: Integrating Cyber Threat Intelligence Platforms in Critical Supply Chains," Transportation Research Part E: Logistics and Transportation Review, Elsevier, vol. 197(C).
    16. Paul, Jomon A. & Zhang, Minjiao, 2021. "Decision support model for cybersecurity risk planning: A two-stage stochastic programming framework featuring firms, government, and attacker," European Journal of Operational Research, Elsevier, vol. 291(1), pages 349-364.
    17. Suzanne Scotchmer, 2006. "Consumption Externalities, Rental Markets and Purchase Clubs," Studies in Economic Theory, in: Christian Schultz & Karl Vind (ed.), Institutions, Equilibria and Efficiency, chapter 19, pages 351-369, Springer.
    18. Aldieri, Luigi & Aprile, Maria Carmela & Vinci, Concetto Paolo, 2015. "R&D Spillovers Effects on strategic behaviour of Large International Firms," MPRA Paper 63402, University Library of Munich, Germany.
    19. Yong Wu & Mengyao Xu & Dong Cheng & Tao Dai, 2022. "Information Security Strategies for Information-Sharing Firms Considering a Strategic Hacker," Decision Analysis, INFORMS, vol. 19(2), pages 99-122, June.
    20. Drew Fudenberg, 2015. "Tirole's Industrial Regulation and Organization Legacy in Economics," Scandinavian Journal of Economics, Wiley Blackwell, vol. 117(3), pages 771-800, July.

    More about this item

    Keywords

    ;
    ;
    ;
    ;
    ;

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:inm:ormnsc:v:51:y:2005:i:5:p:726-740. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Chris Asher (email available below). General contact details of provider: https://edirc.repec.org/data/inforea.html .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.