MODELING)THE)LOJACK)EFFECT)IN)THE)) CYBER)SECURITY)MARKET))

Transcription

1 CasatrinaLee 3May2014 i MODELING)THE)LOJACK)EFFECT)IN)THE)) CYBER)SECURITY)MARKET)) )A)STUDY)OF)INCENTIVES) Abstract:) Cybersecurityhasbecomeapertinentconcernamongbusinessesfollowing theincreasingdigitizationofoperations.hackingmethodsareeverevolvingand businessesstruggletodetectandrespondpromptly,aswellasdeveloppreventive measuresagainstfutureattacks.itiswidelyacknowledgedthatcooperationiskey inanindustry seffortsincombatingcybercrime,andinmypaper,ifocusmainlyon thefinancialservicessector.thereexistsanetworkofcollaborationwithinthe sector,suchasthefinancialservicesinformationsecurityanalysiscenterfsm ISAC),whichfacilitatesthesharingofanonymizeddataaboutattackinformation amongcompaniestoimprovesituationawareness.however,inlightoftheprivate costsinvolvedininvestinginresearch,companiesarereluctanttoinvestinr&d, preferringtoactasfreeriders.iturnmyfocustothelojackindustrywithinthe autotheftmarket,whichfacessimilarexternalitiesandincentiveproblems.imodel theincentiveproblemsofbothmarkets,analyzingthesimilaritiesanddifferencesin networkeffects.resultsshowthatalthoughthelojackmodelhassignificant positiveexternalities,excludableprivatebenefitsincentivizecarownerstoinvestin alojack.however,inthecybersecuritymarket,companieshavelittleincentiveto investmorethanthebareminimuminresearchduetothecontagioneffectsofboth negativeandpositiveexternalities.finally,idrawonthesuccessesofthelojackin deterringautothefttoapplythemtobetteroutlinetheopportunitiesfor collaborationforcybersecuritywithinvariousindustries. ) Keywords:cybersecurity,incentives,modeling,LoJack,contagioneffect,network effects,freerider,externalities,financialservices ANHONORSTHESIS SUBMITTEDTOTHEDEPARTMENTOFECONOMICS OFSTANFORDUNIVERSITY PRESENTEDBY: CASATRINALEE CYLEE1@STANFORD.EDU MAY2014 HONORSADVISOR: PROFESSORTIMOTHYBRESNAHAN DEPARTMENTOFECONOMICS

2 CasatrinaLee 3May2014 ii Acknowledgments) ) IamdeeplygratefultomyHonorsAdvisor,ProfessorTimothyBresnahan,for hisinvaluableguidanceandpatiencethroughoutthecompletionofthehonors Thesis.Despitehisbusyschedule,heisalwayseagertomeetforadiscussionand guidemethroughformulatingaconvincingeconomicmodel.iamgratefulforhis instructionthroughouttheprocessofpinningdownmythesistopic,pointingmein thedirectionofrelevantliteratureandironingoutthekinksinmypaper. IamalsothankfultoProfessorMarceloClericiMAriasforhiscontinued guidanceandsupportsinceiembarkedonthisjourneytowriteanhonorsthesis.i amgratefulthatheplantedtheinspirationinmeduringthejuniorhonorsseminar classitookunderhim. Finally,Iamthankfultomyfriendsandfortheirsupport,withoutwhichthis honorsthesiswouldnothavebeenpossible. ) )

3 CasatrinaLee 3May2014 iii ) Contents) ) Acknowledgments ii 1))Introduction 1 2))Literature)Review 5 3))Economic)Models LoJackModel CyberSecurityModel 14 4))Comparing)Models ComparativeAnalysis ContagionEffect 23 5))Discussion)&)Analysis 25 6))Conclusion) 29 7))Bibliography 32 )

4 CasatrinaLee 3May2014 CHAPTER1:INTRODUCTION 1 Chapter1 Introduction Asthemarketplacebecomesincreasinglydigitized,businessesmoveagreater partoftheiroperationsonline,anddataisincreasinglybeingmigratedtothecloud. Naturally,theneedtoprotectdatahasbecomemorepertinent.Hackingmethodshave evolvedtobecomemoresophisticated,withmillionsofattackshappeningeveryday. Newmodesofattackarebeingdevelopedrapidly,morespecificallyzeroPdayattacks, 1 makingitdifficulttoincentivizecompaniestoinvestinattackpreventionresearch,or eventorespondefficientlytotheseattacks. Therearenumerousexistingproblemsassociatedwithinformationsecurity. Companiesoftenlackinsightintothesourceandeffectofattacks,makingitdifficultfor themtotakepreventivemeasuresorrespondeffectively.companiesalsoacknowledge thatresearchincybersecurityisoftentootimepconsumingandcostpinefficient.with thehighcostsandlowreturnsofresearch,companieslackincentivestoinvestincyber securityresearch. 1 ZeroPdayattacksareattackswhichexploitapreviouslyunknownvulnerability,such thatdevelopershavenotimetoaddressandpatch

5 CasatrinaLee 3May2014 CHAPTER1:INTRODUCTION 2 NetworkeffectsoftheInternetfurtherexacerbatethisunderprovisionof research.thehighinterconnectivityoffirmsandnetworkshasresultedinhigh negativeexternalitiesonothermembersofthenetwork.onceamemberofanetwork hasbeenhacked,othermembersofthenetworkaremorevulnerableasitisnoweasier forthehackertoinfiltrateothermembersofthenetwork.positiveexternalities, however,canalsoresultfromthesenetworkeffectsiffirmsarewillingtoinvestin securitymeasures.asecurenetworkwouldbenefitthenetworkasawhole,andthis mutuallybeneficialrelationshipprovidesopportunityforcollaborationamong membersbysharinginformation.usefulinformationwouldincludeattacksources, attackvectors,aswellaseffectivemethodsofresponseandrecovery. Theautotheftindustryfacessimilarexternalities,andresearchhas demonstratedthatthelojack,despiteitsprivatecosts,hasbeensuccessfulin overcomingfreeriderproblems,thereforeincreasingpositiveexternalities,deterring criminalsandloweringcrimerate.iaimtoexaminethismodelinthehopesofapplying ittothecybercrimemarket. TheLoJackisahiddenradiotransmitterusedtoretrievestolenvehiclesandhas proventobeveryeffectiveinachievinggeneraldeterrenceamongcarthieves.lojacks facilitatecostandtimeefficienttheftdetectionandrecoveryofstolencarsasthepolice arebetterabletotrackthem.consequently,ahigherarrestratehasbeenassociated withtheincreaseduseoflojacks. AnimportantfeatureoftheLoJackisthatitisinvisibletocriminals.Thisfeature iskeyinachievinggeneraldeterrenceamongautothievesbecausecriminalsareunable todistinguishacarwithalojackinstalledfromacarwithoutalojackinstalled.witha

6 CasatrinaLee 3May2014 CHAPTER1:INTRODUCTION 3 higherprobabilityofbeingarrestediftheyhappentostealacarwithalojack,thieves arereluctanttotaketheriskofstealingarandomcarinthefirstplace.similartothe cybersecuritymarket,networkeffectsalsocomeintoplayhereintheformofpositive externalities.forexample,iflojacksarepopularinaparticularneighborhood, residentsofthatneighborhoodbenefitfromthehighincidenceoflojacksandenjoya lowerriskofthefteveniftheydonotinstallalojackthemselves.imodelthisincentive structureinmypaperbelow. GiventhesuccessofLoJackindeterringcrime,Iaimtoapplyasimilarmodelto themarketofcybercrime.inbothmarkets,weseeabarrieragainstinvestment car ownersarereluctanttoinvestinalojackandcompaniesarereluctanttoinvestin research becauseatthetimeofinvestment,themarginalbenefittothecarownerand companyiszero.noattackhastakenplaceyet,andthustheyaredisincentivizedto incuradditionalcostsininvesting.however,thebenefitsofcollectiveinvestmentare amplifiedwithgroupinvestment.asinvestmentisincreasedinbothmarkets,thethreat offallingpreytoasuccessfulattackislowered.thisimpliesthatthesocialbenefitof investingincrimepreventionclearlyexceedstheprivatebenefitofinvestment. However,thisresultalsoconsequentlysuggeststheclearpossibilityoffreeridersin bothmarkets. Specifictothecybercrimemarket,themodelshowsthatsharingofinformation amongcompaniesisoptimal,assumingthatsharingincursnocost.thisisbecause companiesareindifferentbetweensharingandnotsharinginformation,butthe collectivepoolingofinformationhelpsprovidebettersituationalawarenessofthe cybercrimelandscapeandthereforedecreasestheriskoffallingvictimtoanattack.

7 CasatrinaLee 3May2014 CHAPTER1:INTRODUCTION 4 Furthermore,themodelshowedthattheamountthatcompaniesarewillingto investincybersecurityresearchisinfactalowconstant,independentofthevaluethey placeontheirinformation,andindependentofthecurrentriskofattack.thissuggests againthatcompaniesareunwillingtoinvestbeyondthatequilibriumconstant, resultinginasevereunderprovisioninthecybersecuritymarket. Inmypaper,Ibreakdownthedifferencesbetweentheautotheftandcyber crimemarkets,morespecificallyintermsofthefreeriderandnetworkeffects.while theautotheftmarketisdiscreteie.breakingintoacardoesnotgainoneaccessinto another),thecybercrimemarketisrelativelylessdiscreteduetothehighlevelof interdependenceandconnectivity.thisresultsinhighnetworkeffects,whichcan compoundpositiveexternalitiesofcollaborativeresearch,butcanalsocompound negativeexternalitiesofacompanyinthenetworkgettinghackedandexposingother memberstoahigherriskofinfiltration. IaimtodrawonthesuccessesoftheLoJackindeterringautotheftandapply theminbetteranalyzingtheopportunitiesforcollaborationforcybersecurityamong networkmembers.mythesisisoutlinedasfollows.abriefliteraturereviewisprovided inchapter2,followedbymyeconomicmodelsoftheautotheftandcybercrime marketsinchapter3.inchapter4,icomparethecybercrimemarkettotheautotheft marketandsubsequentlyapplymyfindingsandprovidemoreinpdepthanalysisand suggestionsforthefinancialindustrytobetterreaptherewardsofcollaborationin cybersecurity.

8 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 5 Chapter2 LiteratureReview Companieshavethusfarfailedtodevelopaneffectivewaytodealwiththe threatofcybercrime.whiletheywidelyacknowledgethatpreventionisideal,itis impossibletodetermineastocksolutionormodeofpreventionforattacks,giventhe highrateatwhichattackvectorsevolve.this,ontheotherhand,hasincentivized criminalstopersistintheirhackingattempts,undeterredbythelegalramificationsor thepossibilityofbeingcaught.infact,researchhasshownthatthelikelihoodof detectingcybercrimeissolowthatthepenaltyinflictedwouldhavetobeofenormous magnitudetodetercybercrimegrady&parisi,2006).asaresult,companieshave provedtobemoreinclinedtochoose cure over prevention choosingtotackle attacksbypatchingtheproblem,ratherthanresolvingtherootvulnerability. However,inrespondingtoattacks,companiesfaceseveralchallenges.Firstly, thesystemneedstobeabletodetectwhenithasbeenhackedbeforeresponsecaneven begintotakeplace.secondly,thesystemneedstoundertakethemosteffectivepatchin

9 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 6 responsetotheinfiltration iftheattackwereazeropdayattack,responsebecomes evenmoreproblematic.thirdly,thesystemneedstohaveadequateresourcestodeal withtheattack;often,smallandmediumenterpriseslacktheseresourcesbauer&van Eeten,2008).Duetothesefactors,responseisslow,anddamageisrarelymitigated efficiently. Marketfailureispresentinthecybersecuritymarket,manifestingitselfinthe formofexternalities.whenafirmiscompromised,itpassesonthedamagetoits consumersintheeventofadatabreach.financialinstitutionshavechosento internalizesuchnegativeexternalitiesbycompensatingcustomersintheeventofa securitybreach,ratherthaninvestinginsecuritymeasuresbauer&vaneeten2011). Anotherformofnegativeexternalitiesisalsopresentamongmembersofacomputer network.duetothehighinterconnectivityofcomputersystems,abreachinamember s systemwouldresultinthesecurityofothermembersbeingcompromised.asexplained inapaperbyneilgandal,largenetworksaremorevulnerabletosecuritybreaches, preciselybecauseofthesuccessofthenetwork.inexamplegivenbygandal,inpart becauseofitslargeinstalledbase,microsoft sinternetexplorerislikelytobemore vulnerabletoattackthanmosaic sfirefoxbrowser.thisisbecausethepayoffto hackersfromexploitingsecurityvulnerabilitiesininternetexplorerismuchgreater thanthepayofftoexploitingsimilarvulnerabilitiesinfirefox. Ontheflipside,positiveexternalitiescanbecreatedwhencompaniesinvestin securitymeasuresandresearchtostrengthentheirsystems.viathesamenetwork effects,theentirenetworkisconsequentlystrengthened.suchmutuallydependent relationshipsofferanopportunityforcollaborationamongmembersofanetwork.

10 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 7 AndersonusesthenetworkeffecttobetterillustratethisinthecontextoftheInternet 2001).ThemorepeopleusetheInternet,themorevalueithasforitsusers.Inthe realmofcybersecurity,themorecompaniesshareinformationwitheachother,the largerandmoreexhaustivethepoolofresources,andthereforethemoreeffectiveitis inpreventingsecuritybreaches.thesharingofinformationrelatedtomethodsfor preventing,detectingandcorrectingsecuritybreachesisdesirableasithelpsprevent organizationsfromfallingpreytosecuritybreachespreviouslyexperiencedgordon, Loeb&Lucyshyn,2003).Thisknowledgeofthecybersecuritylandscapeistermed situationalawareness.additionally,suchinformationhelpsorganizationsrespond morequicklyandefficientlywithfocusedsolutionsifanactualbreachoccurs.threats canbemoreeffectivelyprepemptedandattackscanbemoreefficientlypatched, thereforealleviatingpotentialdamagesofthecyberattack.situationalawareness thereforeinvolvesachievingvisibilityofemergingthreats,andiskeyinfacilitatingthe anticipationandmanagementofattacks. Asmuchasinformationsharinghasbeentoutedapossiblesolutionforcyber security,thereisamajorinherentproblempcompanieslackadequateeconomic incentivestofacilitatesuchsharing.andersonandmooreindicatemisaligned incentivesasthemainreasonforthefailureofinformationsharing2006).thisis corroboratedbyapaperbyvaneetenandbauer,highlightingtheissueofthefreerider problem2009).individualbusinessesandusersmaysufferfromtheperceptionthat theirownriskexposureislow,coupledwiththeinterconnectivityassociatedwith computernetworks,whenafirminvestsincybersecurityactivities,itbearsallthe costsbutdoesn treapallthebenefits.thelargertheshareofbenefitsthataccrueto

11 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 8 otherfirms,thesmallertheincentiveforafirmtoincreaseitsinvestments.companies arethereforedisinclinedtoinvestinandsharetheirsecuritysolutionsbecauseitwould allowothercompaniesinthenetworktobenefitfreelyfromit.forexample,joiningand reportingtoinformationsecurityanalysiscentersisacs)isvoluntary,withno incentivesinplacetoencouragefullreportinganddiscouragefreeriding.membersmay underpinvestinthedevelopmentofinformationsecuritymeasuresinanticipationof obtainingthemforfreefromotherisacmembersgordon,loeb&lucyshyn,2003).as aresult,thesecuritylevelofthenetworkislessthanideal. Zoominginonthefinancialservicessector,thereisanexistingframeworkfor informationsharingunderthefspisacfinancialservicesinformationsharing& AnalysisCenter).Itisuniqueinthatitseemstohavesucceededincreatingasuccessful partnershipininformationsharingdespitethepotentialpitfallsasmentioned previously.accordingtothecurrentpresidentandceoofthefspisacbillnelson,most oftheinformationsharedcomprisesofanonymizeddataaboutattackvectorsand sources.however,littleresearchisdonebytheisaconsecuritymeasures;without extractingvaluefromthesharedinformationtodevelopnewsolutions,thefspisac simplybecomesadatacollectioncenter. Wefirsthavetodistillthefactorsthathavecontributedtothesuccessofthe LoJackintheautotheftmarket.WiththeLoJack,asmallradiotransmitterishiddenin oneofmanypossiblelocationswithinacar.whenthecarisreportedtobestolen,the transmitterisremotelyactivatedbythepolice,allowingthepolicetotrackthestolen car spreciselocation.lojackpequippedstolenvehicleshavea90%recoveryrate,

12 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 9 comparedtoa63%recoveryrateforvehiclesthatlackatrackingsystem.helperin, 2009). InanempiricalpaperbyAyresandLevitt,itisfoundthattherearestrong positiveexternalitiesbythelojackinachievinggeneraldeterrence1998).they furtherfoundthateachdollarspentonlojackresultedinareductioninthecostsof autotheftofapproximately$10.becausethereisnoexternalindicationthatthelojack hasbeeninstalledinacar,itdoesnotdirectlyaffectthelikelihoodthataprotectedcar willbestolen.however,itwasfoundthattheavailabilityandadoptionoflojacksina particularareaisassociatedwithasharpfallinautotheft.morespecifically,the introductionoflojackinacityhasbeenshowntoreduceautotheft,eventhoughthe initialusemaybeverysmall.thereasonforthisisthatwhiletheoddsofastolencar havingalojackinstalledareverysmall,anautothiefmaytypicallystealmanycarsa year.onceheunknowinglystealsacarwithalojackinstalled,heiscaught,aswiththe restofhisaccomplicesbankman,2001). However,similartothecaseofcybersecurity,thereisthephenomenonof underprovision.whileitwasfoundthatthemarginalsocialbenefitofanadditionalunit oflojackhasbeenfifteentimesgreaterthanthemarginalsocialcostinhighcrime areas,thosewhoinstalllojack,however,obtainlessthantenpercentofthetotalsocial benefits,leadingtounderprovisionbythemarketayres&levitt,1998).inother words,peopleareinclinedtofreerideondeterrencephenomenonofthepresenceof thelojackintheneighborhood,butarereluctanttopersonallyinvestinone.an individualcarowner sdecisiontoinstallthelojackonlytriviallyaffectsthelikelihood ofhisorhercarbeingstolensincethievestypicallybasetheirtheftdecisionsonmean

13 CasatrinaLee 3May2014 CHAPTER2:LITERATUREREVIEW 10 LoJackinstallationrates.AsthievesareunabletodistinguishcarswithLoJacksfrom carswithout,thedeterrenceeffectisverystrong,andtheextentofpositiveexternalities arisingfromlojackusageisverylarge.itisthereforecrucialthatoneisableto incentivizecarownerstoinvestinalojack. Movingon,weexaminetheexactmechanismbywhichtheLoJackhasachieved itslargesocialbenefits.itdisruptstheoperationsof choppshops. 2 Intheabsenceof LoJacks,identifyingthesechopPshopsrequireoperationsthatarehighlytimeand resourceintensive,whereastheinstallationofthelojackoftenleadspolicedirectlyto theheartofcriminaloperations.however,itiscrucialtonotethatthereisan interestingsubstitutioneffectintheformofoldervehicles;oldervehiclesarelesslikely tohavelojacksinstalledandarethereforemoretargetedbycriminals.consequently, whiletheoverallautotheftratedecreases,thetheftrateforoldervehiclesincreases. LoJacksareexpensive$700),andwhiletheyhaveprovenveryeffectivein reducingautotheftrates,thesereductionsarepurelyanexternalityfromthe perspectiveofthecarownerinstallingalojack.theonlyinternalizedbenefitsof installingalojackarehigherretrievalratesandlowertheftdamagesonceavehicleis stolenayres&levitt,1998).inlightoftheseeffects,iwillcomparetheexternalities andnetworkeffectsinbothmarketsingreaterdetailinthefollowingsections. 2 Wherestolenvehiclesaredisassembledforresaleofparts.

14 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 11 Chapter3 LoJackModel Wedefinethevariablesasfollows: = "#$%""#""#$%& = "#$%"#$""#$%&&"'"#$%& = "##$"#$"%&'; = 1"h"#h""#$%&"#$%&&', 0"h"#$% = "#$%$&'&h""#""#$%&"#$, h" = = "#$%&""#"#$%&""#$%& Tisdefinedasafunctionofthefractionofthepopulationofcarownersinthe marketwhochoosetoinvestinalojack.

15 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 12 WedefinePersoni sutility )asfollows: " = 0, = 1 " = 1, = WithoutaLoJack,Personi sutilityofhiscarisdiscountedbytheriskoftheft. WithaLoJack,hisutilityisunaffectedbytheriskoftheft,andhisvaluationisonly reducedbythefixedcostofbuyingandinstallingalojack. ToincentivizePersoni"toinvestinaLoJack, : = 1 > : = 0 > 1 < 1) LetusassumethatmisthenumberofpeoplewhochoosetoinvestinaLoJack ie.mpeoplehave < ).Inthismodel,weseektofindequilibriumvaluesof, andsuchthattheyfulfillthefollowingconditions: 1. = 2. = "#$%&""#$"h" 3. = Utilizingtheseequations,wecanderivetheequilibriumvaluesofanindividual s valueofhiscar),theequilibriumriskofcartheft),aswellasthenumberofpeople whowouldinstallalojack).

16 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 13 WhenPersonichoosestoinstallaLoJack,hisprivatebenefitis0,sincenotheft hasoccurredyet.however,theprobabilityofatheftoccurringt)decreasesasthe numberoflojacksinstalledincreasesie.mincreases).thisisclearlyasocialbenefit andindicatespositiveexternalitiesoflojackusage.weexpressthesocialvalueofa higherfractionoflojackadoptionhigher )onthemarketasawholeasfollows: Socialbenefit=totalprivatevalue +socialbenefitofdecreasedriskoftheft "" =0 + " 2) Notetheterm0isobtainedfromthezeromarginalbenefitthataLoJack adopterexperiencesafterinstallingalojackbecausenothefthasoccurredand therefore,notangiblebenefitcanbefelt.thesecondterm "" " representsthesumofsocialbenefitsovereachcarowner.thefirstderivativeoftis negativebecausethetheftratedecreaseswithanincreasedfractionoflojackadoption. ThisbenefitisnotexclusiveonlytothosepeoplewhohaveinstalledtheLoJacksince theoveralltheftrateforbothlojackadoptersandnonpadoptersdecreasesalike.the benefitisthusrepresentedbytheproductoftheirindividualvaluationofthecar ) andthemarginaldecreaseinriskoftheftonsocietyasawholeborneoutofagreater fractionoflojackadoptionamongcarownersintheregion. Here,wecanseethatbecausethegeneraldecreaseintheftratebenefitsthe entirecarownerpopulation,theexcessofsocialbenefitsascomparedtoindividual marginalbenefithasencouragedfreeridingandresultedinunderprovisioninthe marketforlojacks.

17 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 14 CyberSecurityModel Weexaminethefinancialindustrywithrespecttothemarketforcybersecurity, specificallybecausethefinancialindustryisthemostdevelopedintherealmofcyber security,andbecausecybersecurityisattheforefrontofcompanies priorities.the financialindustryhasanexistingorganization,thefinancialservicesinformation SharingandAnalysisCenterFSPISAC),inwhichbankscooperateandshare anonymizeddataoncyberattacks. Wedefinethevariablesasfollows: = "#$%""#$%&$%'"#$%&'$"""#$ = "##$"#$"%&'; = 1""#$%&'h"#$"#$%&'$", 0"h"#$" = "#$""#$#%"#""#"$%h = "##$"#$"%&'; = 1""#$%&'"#$#%""#"$%h, 0"h"#$% = "#$%$&'&)""##$%h"#$%, h" =,,, < 0 = "#$%&""#$%""#$%& Tisdefinedasafunctionofthefractionofbanksthatchosetoshareattack informationandthecumulativeamountofmoneyinvestedinresearch.thisassumes thatthesharingofattackinformationandresearchhavevaluablepayoffs. Wefirstconsidertheissueofsharinginformationwithintheorganization.We canassumethatthecostofsharinginformationis0,sincecompaniesarenotengaging inadditionaleffortsinthecourseofsharinginformationwithothercompaniesinthe

18 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 15 organization.sincethecostofsharinginformationis0,companieswouldbeindifferent betweenchoosingtoshare = 1)andnottoshareinformation = 0).GiventhatT isdependentonsand <0ie.thegreaterthenumberofcompanieswhoshare information,thelowertheriskofbeinghacked),companiesareincentivizedtoshare ie. = 1). Therefore,sharingofinformationS)isassumedtobeefficientlyprovidedinthis model,giventhatallbanksshareatzerocost.thisassumptionissupportedbythefsp ISAC,whichconfirmsthatallbankscontributeanonymizeddatatotheorganization voluntarily.thisisattributedtothefactthatsharingofdataincurslittletimeor monetarycosttoindividualbanksaslongassufficientinfrastructuretocollectrelevant datawasalreadyinplace. IfBanki"choosesnottoengageinresearch = 0), Payoff= 1 ), = 0, = h"#"#$"#h"#"#$ "#$%&'"#$%) Consequently,thereisnocontributionbyBankitothereductionofcrimerate. IfBankichoosestoengageinresearch = 1), Payoff= 1, 0, = h"#"#$"#h"#$ "#$%&'$&"#) Consequently,thisincreases andreducest,asasocialbenefit,muchlikethe caseinthelojackmodelabove.thisimpliesthat <.Itisimportanttonotethat isawhollyprivatecostchosensolelybythebank,andcanbeperceivedasthebank s contributiontogroupresearchassumingthebankdoesnotengageinanyresearchon

19 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 16 itsownusingitsownresources).clearly,thesociallypreferredoptionwouldbefor = 1. Abankwillchoosetoinvestinresearchif: 1 < 1 1 < 1 < < < = ) 3) Weseektofindequilibriumvaluesof,andsuchthattheyfulfillthe followingconditions: 1. = 2. =, 3. "#$$%& 1 "# Utilizingtheseequations,wecanderivetheequilibriumvaluesofanindividual bank svalueofprotectingitsinformation),theequilibriumriskofcybercrime),as wellastheoptimalamountthatabankshouldinvestinresearch). Focusingonconditions2and3, "#$%$&' 1 = 1,

20 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 17 = 1 = 0 = 4) Substitutingthisresultinto =,weobtain: = = 1 5) Weseeherethattheoptimalamountthatabankshouldinvestinresearchis1. Thisisaconstant,independentofthebank svalueitplacesonprotectingits information,andindependentofthecurrentriskofcrime.thiscanbeattributedtothe factthateachbankisreluctanttoinvestinmorethantheminimumtocontributeto loweringtheriskofcrime,preferringtospreadouttheresponsibilityandputtheonus equallyoneverymemberoftheorganization.theyarechoosingtosacrificethelongp termrewardsofengaginginresearchandthecompoundingbenefitsofnetworkeffects inastrengthenednetworkinfavorofshortptermcostsavings. Clearly,thisisamyopicapproach,butisunfortunatelyrampantinthecurrent market.researchhasalsoshownthat,ratherthaninvestinresearchandprevention, banksandfinancialinstitutionshavechosentointernalizethecostsofbeinghackedby compensatingcompanies.intheiropinion,thebenefitsofresearchfailtooutweighthe timeandmonetarycosts.asmorebanksadoptthismindset,thelackofacredible researchteamandfoundationisperpetuated.knowingthattheircounterpartshave adoptedthismindset,individualbanksarelesslikelytobethesolememberinthe

21 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 18 networkinvestinginresearch.inthiscase,networkeffectsandthepotentialbenefitsof increasedresearchinvestmentarenottapped. Toquantifysuchbenefits,welookatthesocialvalueofincreasing : Socialbenefit=privatevalueformarginalbank +socialbenefitofdecreasedriskoftheft =0+, " "" 6) Notetheprivatevalueforthemarginalbankis0,regardlessofwhetherit choosestoinvestinresearchornot.thisisbecauseresearchhasatimelag,whetherin conductingtheresearchortheutilityofresearchresults,andthebenefitatatime wherenohackinghasoccurredis0. Thesecondterm, " representsthesumofsocial "" benefitsovereveryoneinthecommunity.thefirstderivativeoftwithrespecttois negativegiventhatthecrimeratedecreaseswithanincreasedoverallinvestmentin research.likeinthelojackmodelabove,thisbenefitisnotexclusivetothosebanks thathavechosentoinvestinresearch,butbenefitseverymemberoftheorganizationas awholebydecreasingtheprobabilityofaneffectivehackingattempt.thebenefitis thusrepresentedbytheproductoftheirindividualvaluationsoftheirinformation andthemarginaldecreaseinriskofhackingonthecommunityasawholeborneoutof agreatercumulativeinvestmentinresearch. Giventhattheresearchiscollaborative,andthereisnoprivateresearchdoneby banks,thesocialbenefitissharedamongallthebanksequally.thereinliestheproblem ofincentives sinceallbenefitissharedbutallcostisprivate,thereisanincentiveto

22 CasatrinaLee 3May2014 CHAPTER3:ECONOMICMODELS 19 becomeafreerider,resultinginunderprovisionofsecurityresearch,similartothecase oflojacksabove. Wefoundthat = 1forallbanks.Thisseemstobeaunanimousdecision,with nobankchoosingtoinvestmorethantheequilibrium.thisequilibrium,however,isnot optimal,astheriskofhackingcanbefurtherdecreasedwithincreasedinvestmentin research.yetifanybankchoosestoinvestmorethantheperceivedequilibrium,itis unlikelythatotherbankswillfollowsuit.giventhattheresearchisnonprivalrousand nonpexcludablewithinthefspisac,theproblemoffreeridersarises.

23 CasatrinaLee 3May2014 CHAPTER4:COMPARATIVEANALYSIS 20 Chapter4 ComparativeAnalysis WhilewecandrawsimilaritiesbetweenthecybersecurityandLoJackmarkets intermsofunderprovision,therearenumerousdifferencesthatneedtobehighlighted, specificallyinthestructureofitsrespectiveexternalities. 1 Differingstructuresofnetworkeffects FortheLoJackmarket,theskillsandtoolsrequiredtostealacarisdirectly transferrablefromcartocar.inotherwords,onceacriminalisequippedwiththe knowledgeandtoolsofhowtostealacar,thereisnoeconomicbarrierpreventinghim fromstealinganothercar.however,stealingonecardoesnotautomaticallygainhim accesstoanothercarie.theautotheftmarketisdiscrete). Incontrast,inthecybersecuritymarket,moreoftenthannot,criminalsrequire specificinsiderknowledgeinordertogainaccesstothesystemontopofgeneral hackingskills.thisknowledgeisuniquetoindividualcompaniesandisless transferrabletoothercompanies.thatsaid,however,onceacriminalgainsaccesstoa

24 CasatrinaLee 3May2014 CHAPTER4:COMPARATIVEANALYSIS 21 company ssystem,thebarriertogainingaccesstosystemsofothercompaniesinthe networkisloweredie.thecybercrimemarketislessdiscrete).whilethelojack criminalisnotboundbygeographicalorregionalrestrictionsinapplyinghis knowledge,thecybercriminalisboundbythenetworkofcompaniesheistryingto infiltrateie.thisknowledgemaynotbeapplicabletoanothernetworksuchasthefood andbeverageindustry). 2 Differingfreeridereffects IntheLoJackmarket,therearelittletonofreeridereffects.Acarowner installingalojackhasnodirectimpactontheprobabilityofhisimmediateneighbor s cargettingstolen.therefore,thelojackisexcludable.thefreeridereffectonlykicksin whentheinstallationoflojacksinaspecificregionexceedsaparticularthresholdsuch thatthegeneraltheftratedecreases.evenso,whilecarownerswhochoosenotto installlojacksmaybenefitfromthegeneraldecreaseintheftrate,theyreapnobenefits whentheircarswithoutlojacksarestolen.here,weseethattheincentivetobeafree riderislow. Inthecybersecuritymarkethowever,itisacknowledgedthatthereisaninfinite numberofwaysthatacompany ssystemcouldfail,bothontheindividualcompanyand collectivenetwork)levels.investmentinresearch,therefore,doesnot,inanyway, guaranteeareturn.giventhehighmonetarycostsofresearch,coupledwiththetimep intensiveeffortsandcontrastedwiththefastpaceatwhichattackvectorsevolveand develop,researchisexpensiveandmaynotpresentitselfasaneconomicallyrational decisionforcompaniesatfirstglance.infact,bankshaveshownthattheypreferto

25 CasatrinaLee 3May2014 CHAPTER4:COMPARATIVEANALYSIS 22 compensatecustomersforanysecuritybreachestheirnetworkmaysufferratherthan investinresearchbauer&vaneeten,2011).thereinliestheincentiveforcompanies tofreerideonresearchcarriedoutbyothercompaniesinthenetwork.likeinthe LoJackmodel,companieswhodonotcarryoutresearchbenefitfromthegeneral increaseinprotectionofthenetwork.intheeventofinfiltration,theyexperiencea negativepayoff,butsodotheothercompaniesintheirnetwork,whomayhaveinvested inresearch.ielaborateonthesenetworkeffectsbelow.inlightofthis,theincentiveto freerideisdrasticallyhigherinthecybercrimemarketthanthatofthemarketfor LoJacks.

26 CasatrinaLee 3May2014 CHAPTER4:COMPARATIVEANALYSIS 23 ContagionEffect Duetothehighinterconnectivityofnetworkswithinthefinancialindustry,the probabilityofabankgettinghackedisnolongeronlydependentonsimplysharing informationandengaginginresearch.whenabankinthenetworkgetshacked,other membersofthenetworkaresubsequentlymoresusceptibletogettinghackedaswell. Thiscontagioneffectthereforechangesthepayoffofeachindividualbank.Weassume thatthethreatfunctionisunchanged. Takingintoaccountthecontagioneffect, Banki spayoff= 1 "" ) 7) Here, istheprobabilitythatbankiishacked,isthenetworkeffect coefficient,and "" istheprobabilitythatanotherbankinthenetworkishacked,and affectsbankivianetworkeffects. WeseeherethatthecontagioneffecthasloweredBanki'spayoff.Therefore,the contagioneffectservesasamotivatingfactorforbankstoshareinformationwithinthe network,asmentionedabove,particularlysincethecostofsharinginformationiszero. Italsomotivatesbankstoengageinresearchtocontributetotheoverallsecurityofthe networktomaximizetheirsecurity. Thisisanimportantresultanddistinguishesthecybersecuritymarketfromthe LoJackmarket.TheinvestmentinaLoJackisverymuchindividual.AslongasPersoni investsinalojack,thegeneralrateoflojackinvestmentinpersoni sregiondoesnot affecthim.ontheotherhand,acollectivelyhighrateoflojackinvestmentinaregion withoutpersoniinvestinginonemayresultinalowerprobabilityofpersoni'scar gettingstolen,butdoesnothingtoaidrecoveryofpersoni'scarifitgetsstolen.