Analyzing Self-Defense Investments in Internet Security Under Cyber-Insurance Coverage

Transcription

1 Analyzng Self-Defense Investments n Internet Securty Under Cyber-Insurance Coverage Ranjan Pal Department of Computer Scence Unv. of Southern Calforna Emal: rpal@usc.edu Leana Golubchk Department of Computer Scence Unv. of Southern Calforna Emal: leana@usc.edu Abstract Internet users such as ndvduals organzatons are subject to dfferent types of epdemc rsks such as worms, vruses, botnets. To reduce the probablty of rsk, an Internet user generally nvests n self-defense mechansms lke antvrus antspam software. However, such software does not completely elmnate rsk. Recent works have consdered the problem of resdual rsk elmnaton by proposng the dea of cyber-nsurance. In ths regard, an mportant decson for Internet users s ther amount of nvestment n self-defense mechansms when nsurance solutons are offered. In ths paper, we nvestgate the problem of self-defense nvestments n the Internet, under full partal cyber-nsurance coverage models. By the term self-defense nvestment, we mean the monetary-cum-precautonary cost that each user needs to nvest n employng rsk mtgatng self-defense mechansms, gven that t s fully or partally nsured by the Internet nsurance agences. We propose a general mathematcal framework by whch co-operatve non-co-operatve Internet users can decde whether or not to nvest n self-defense for ensurng both, ndvdual socal welfare. Our results show that (1) co-operaton amongst users results n more effcent self-defense nvestments than those n a non-cooperatve settng, under a full nsurance coverage model (2) partal nsurance coverage motvates non-cooperatve Internet users to nvest more effcently n self-defense mechansms when compared to full nsurance coverage. Keywords: cyber-nsurance, Internet rsks, self-defense nvestments, cyber-nsurance coverage, co-operatve non-cooperatve users I. INTRODUCTION The Internet has become a fundamental an ntegral part of our daly lves. Bllons of people nowadays are usng the Internet for varous types of applcatons that dem dfferent levels of securty. For example, commercal government organzatons run applcatons that requre a hgh level of securty, snce securty breaches would lead to sgnfcant fnancal damage loss of publc reputaton. On the other h, an ordnary ndvdual, for nstance, generally uses a computng devce for purposes that do not dem strct securty requrements. There are other Internet applcatons runnng as well, whch requre ntermedate levels of securty. However, all these applcatons are runnng on a network, that was bult under assumptons, some of whch are no longer vald for today s applcatons, e.g., that all users on the Internet can be trusted that the computng devces connected to the Internet are statc objects. Today, the Internet comprses of both, good malcous users. The malcous users perform llegal actvtes, are able to affect many users n a short tme perod, at the same tme reduce ther chances of beng dscovered. Presently the users protect themselves through ant-spam software, frewalls, other add-ons. However, new worms, vruses, botnets emerge rapdly, as a result these self-protecton tools are not always effectve securty solutons. They only ad an Internet user n partally reducng ts rsk. Lttle attenton has been pad to an alternatve approach to hlng rsks, specfcally that of transferrng rsk to a dfferent entty. An example of such a wdely popular technque n modern lfe s nsurance [3]. The rsks are transferred to nsurance companes, n return for a fee,.e., the nsurance premum. For nstance, the works n [5][6][1] dscuss cybernsurance, n general, but wthout much focus on Internet nsurance. In several recent papers [10][9][8][14], the authors show that (1) nsurance would ncrease securty on the Internet, (2) nvestments n both self-defense mechansms nsurance schemes are qute nter-related n mantanng a socally effcent level of securty on the Internet, (3) wthout regulaton, nsurance s not a good ncentve for self-defense. The work n [10] also gves condtons for jontly ensurng vablty of nsurance companes mprovng network securty. In a recent work [11], the authors have nvestgated rsk management usng cyber-nsurance under dfferent nformaton avalablty scenaros between the nsurer the user, wth respect to user securty levels. In a stark contrast to exstng works, they show that under all possble stuatons there s no market for cyber-nsurance on the Internet (.e., cybernsurance ncreases ndvdual user utlty but weakens user ncentves to mprove overall network securty). The authors defne the network securty level as the the probablty that Internet users are attacked. They however, do not consder the nterplay of self-defense nvestments cyber-nsurance nvestments, whch plays an mportant part n mprovng user securty levels. It s not surprsng that the probablty of users not beng attacked may not be mproved usng cybernsurance 1, but the judcous nvestments n both, self-defense cyber-nsurance can defntely mprove ndvdual user securty,.e., the probablty of attacks beng successful wll 1 The ntentons of malcous users to attack the network generally do not change, unless there are mechansms to track punsh them. Cybernsurance does not provde a mechansm to track punsh the gulty.

2 2 be lowered, leadng to a robust Internet (mprovng socal welfare). To the best of our knowledge, none of the prevous efforts n [10][9][8][14][11] consder the co-operatve the noncooperatve nature of network users the effect ths has on the overall level of securty approprate user selfdefense nvestments. We note that the case of co-operatng users s mportant for the followng reasons: (1) It nvtes an opportunty for a user to beneft from the postve externalty 2 that ts nvestment poses on the other users n the network, (2) Although, the majorty of Internet users today are non co-operatve selfsh n nature,.e., they are prmarly nterested n maxmzng ther own performance wthout carng for the overall system performance, there exst Internet applcatons co-operaton amongst users s encouraged (e.g., dstrbuted fle sharng n peer-to-peer envronments, multcastng, effcent network resource sharng). Although, n such applcatons Internet users cooperate to mprove performance, t s not evdent that the same users are ncentvzed to co-operate on ther securty parameters (e.g., self-defense nvestment) as well. Hence n ths paper, we nvestgate the problem of approprate self-defense nvestments under nsurance regulaton 3, gven that Internet users are fully or partally covered by Internet nsurance that Internet users can be both, co-operatve non-co-operatve wth respect to ther self-defense nvestment amounts. The contrbutons of our work are as follows: We quanttatvely analyze an n-agent model, usng botnet rsks as a representatve applcaton, propose a general mathematcal framework through whch co-operatve non-co-operatve Internet users can decde whether to nvest n self-defense mechansms, gven that each user s fully nsured (see Secton III). Our framework s applcable to all rsk types that nflct drect /or ndrect losses to users. Under full nsurance coverage, we perform a mathematcal comparatve study to show that co-operaton amongst Internet users results n better self-defense nvestments when the rsks faced by the users n the Internet are nterdependent (see Secton IV). We use basc concepts from both, co-operatve non-co-operatve game theory to support the clams we make n Sectons III IV. Our results are applcable to co-operatve (e.g., dstrbuted fle sharng) non-cooperatve Internet applcatons a user has the opton to be ether co-operatve or noncooperatve wth respect to securty parameters. We mathematcally prove that n stuatons cooperaton amongst network users s not feasble at all, partal nsurance coverage motvates users to nvest more n self-protecton when compared to full nsurance coverage, thereby resultng n an ncrease n overall socal 2 An externalty s a postve (external beneft) or negatve (external cost) mpact on a user not drectly nvolved n an economc transacton. 3 The term nsurance regulaton refers to the act of makng sure that nsurance contracts are enforced by concerned partes n a proper legal manner. welfare (see Secton V). We note that n practce, currently there exsts vrtually no nsurance-lke rsk management capabltes n the present Internet [12]. However, cyber-nsurance s a hot topc n Internet securty s beng consdered serously by the research communty for a potental soluton to rsk-free securty guarantees for the next generaton Internet [7]. We frmly beleve that wth the evoluton of the Internet over tme, the concept wll become real prove benefcal n the long run. II. ECONOMIC MODEL In ths secton we descrbe our proposed model. To ground the dscusson n real systems, we frst gve a bref descrpton of a representatve applcaton. That s, for purposes of clarty ease of presentaton, we frst descrbe a representatve applcaton, namely that of botnets, as ths s a reasonably rch representatve example of Internet threats. However, we would lke to note that our approach can be appled to other applcatons wth drect/ndrect rsk scenaros (for nstance, such as worms vruses). A. Representatve applcaton A bot s an end-user machne contanng code that can be controlled by a remote admnstrator (bot herder) va a comm control network. Bots are created by fndng vulnerabltes n computer systems. The vulnerabltes are exploted wth malware the malware s then nserted nto the systems. A bot herder can subsequently program the bots nstruct them to perform varous types of cyberattacks. A malware nfected computng devce s susceptble to nformaton theft from t. The nfected devce can become part of a botnet n turn can be used to scan for vulnerabltes n other computer systems connected to the Internet, thus creatng a cycle that rapdly nfects vulnerable computer systems. Hence, bots result n both drect ndrect losses. Drect losses result when the bot herder nfects machnes that lack a securty feature, as ndrect losses result due to the contagon process of one machne gettng nfected by ts neghbors. Rsks posed by bots are extremely common spread rapdly. In a recent study, Symantec corporaton observed approxmately fve mllon dstnct bot-nfected computers wthn a perod of just sx months between July, 2007 December, 2007[10]. Here, we assume that Internet users could buy nsurance from ther Internet servce provders (ISPs) to cover the rsks posed by botnets. For nstance, the coverage could be n the form of money or protecton aganst lost data. B. Model We consder n dentcal 4 ratonal rsk-averse users n a network. The users could be (1) entrely non co-operatve n nature,.e., the network supports Internet applcatons users are not ncentvzed to co-operate wth other users n 4 In general, Internet users are not dentcal. However, our am n ths paper s to study certan general nvestment trends whch we show, reman ntact even f users are heterogenous.

3 3 any capacty (e.g., web surfng) or (2) co-operatve to a varable degree,.e, the network supports Internet applcatons users co-operate wth other users n some capacty to mprove overall system performance but may or may not cooperate entrely. The users could ether voluntarly co-operate by sharng nformaton wth other network users about ther ntentons to nvest n self-defense, or be bound to co-operate due to a network regulaton whch requres partcpatng users to share self-defense nvestment nformaton. Each user has ntal wealth w 0 s exposed to a substantal rsk of sze R wth a certan probablty p 0. (Here, rsk represents the negatve wealth accumulated by a user when t s affected by botnet threats.) We also assume there exst markets for self-defense cyber-nsurance. A user nvestng n self-defense mechansms reduces ts rsk probablty. For an amount x, nvested n self-defense, a user faces a rsk probablty of p(x), whch s a contnuous twce dfferentable decreasng functon of nvestment,.e., p (x) < 0, p (x) > 0, lm x p(x) = 0, lm x p (x) = 0. The nvestment x s a functon of the amount of securty software the user buys the effort t spends on mantanng securty settngs on ts computng devce. In addton to nvestng n self-defense mechansms, a user may also buy full or partal cyber-nsurance coverage at a partcular premum to elmnate ts resdual rsk. A user does not buy nsurance for hgh probablty low rsk events because 1) these events are extremely common does not cause suffcent damage to dem nsurance solutons 2) the nsurance company also has reservatons n nsurng every knd of rsk for proft purposes. We assume that the nsurance market s perfectly compettve wth no barrers to entry ext, whch results n actuarally far premums. We also account for the fact that the system does not face the moral hazard problem,.e., a user nsulated from rsk does not behave dfferently from the way t would behave f t were fully exposed to the rsk. An Internet user apart from beng drectly affected by threats may be ndrectly nfected by the other Internet users. We denote the ndrect rsk facng probablty of a user as q( x, n), x = (x 1,..., x 1, x +1,..., x n ) s the vector of self-defense nvestments of users other than. An ndrect nfecton spread s ether perfect or mperfect n nature. In a perfect spread, nfecton spreads from a user to other users n the network wth probablty 1, as n case of mperfect spread, nfecton spreads from a user to others wth probablty less than 1. For a perfect nformaton spread q( x, n) = 1 n j=1,j (1 p(x j)), as n the case of mperfect spread, q( x, n) < 1 n j=1,j (1 p(x j)). In ths paper, we consder perfect spread only, wthout loss of generalty because the probablty of gettng nfected by others n the case of mperfect spread s less than that n the case of perfect spread, as a result ths case s subsumed by the results of the perfect spread case. Under perfect spread, the rsk probablty of a user s gven as p(x ) + (1 p(x ))q( x, n) = 1 (1 p(x j )) j=1 ts expected fnal wealth upon facng rsk s denoted as w 0 x (1 n j=1 (1 p(x j)) IC) R + IC, (1 n j=1 (1 p(x j)) IC s the far premum IC denotes the nsurance coverage. In ths paper, we use the terms fnal wealth expected fnal wealth nterchangeably. The am of a network user s to nvest n self-defense mechansms n such a manner so as to maxmze ts expected utlty of fnal wealth. III. MATHEMATICAL FRAMEWORK FOR FULL INSURANCE COVERAGE In ths secton, we assume full cyber-nsurance coverage propose a general mathematcal framework for decdng on the approprate self-defense nvestment of an Internet user. We model the followng rsk management scenaros: (1) users do not co-operate do not get nfected by other users n the network, (2) users co-operate may get nfected by other users n the network, (3) users do not co-operate but may get nfected by other users n the network, (4) users co-operate but do not get nfected by other users n the network. We note that Case 4 s a specal case of Case 2 thus s subsumed n the results of Secton III-B. A. Case 1: No Co-operaton, No Infecton Spread Under full nsurance, the rsk s equal to the nsurance coverage, users determne ther optmal amount of selfdefense nvestment by maxmzng ther level of fnal wealth, whch n turn s equvalent to maxmzng ther expected utlty of wealth [4]. We can determne the optmal amount of selfdefense nvestment for each user by solvng for the value of p that maxmzes the followng constraned optmzaton problem: or argmax x F W (x ) = w 0 x p(x )R R + IC subject to argmax x F W (x ) = w 0 x p(x )R 0 p(x ) p 0, F W s the fnal wealth of user p(x )R s the actuarally far premum for full nsurance coverage. Takng the frst second dervatves of F W wth respect to x, we obtan F W (x ) = 1 p (x )R F W (x ) = p (x )R < 0 Thus, our objectve functon s globally concave. Let be the optmal x obtaned by equatng the frst dervatve to 0. Thus, we have: p ( )R = 1. (1)

4 4 Economc Interpretaton: The left h sde (LHS) of Equaton (1) s the margnal beneft of nvestng an addtonal dollar n self-protecton mechansms, as the rght h sde (RHS) denotes the margnal cost of the nvestment. A user equates the LHS wth the RHS to determne ts self-defense nvestment. Condtons for Investment: We frst nvestgate the boundary costs. The user wll not consder nvestng n self-defense f p (0)R 1 because ts margnal cost of nvestng n any defense mechansm,.e., -1, wll be relatvely equal to or lower than the margnal beneft when no nvestment occurs. In ths case, = 0. If the user nvests such that t has no exposure to rsk, =. When p (0)R < 1, the costs do not le on the boundary,.e., 0 < <, the user nvests to partally elmnate rsk (see Equaton (1)). B. Case 2: Co-operaton, Infecton spread Under full nsurance coverage, user s expected fnal wealth s gven by F W = F W (x, x ) = w 0 x (1 (1 p(x j )))R j=1 When Internet users co-operate, they jontly determne ther optmal self-defense nvestments. We assume that co-operaton barganng costs are nl. In such a case, accordng to Coase theorem [13], the optmal nvestments for users are determned by solvng for the socally optmal nvestment values that maxmze the aggregate fnal wealth (AFW) of all users. Thus, we have the followng constraned optmzaton problem: n argmax x, x AF W = nw 0 x n(1 (1 p(x j )))R =1 0 p (x ) p 0, j=1 Takng the frst the second partal dervatves of the aggregate fnal wealth wth respect to x, we obtan (AF W ) = 1 np (x ) (1 p(x j ))R x 2 x 2 (AF W ) = np (x ) j=1,j j=1,j (1 p(x j ))R < 0 The objectve functon s globally concave, whch mples the exstence of a unque soluton ( x ), for each x. Our maxmzaton problem s symmetrc for all, thus the optmal soluton s gven by ) = xopt j j ) for all j = 2,..., n. We obtan the optmal soluton by equatng the frst dervatve to zero, whch gves us the followng equaton np ( ( x )) (1 p(x ))R = 1 (2) j=1,j Economc Interpretaton: The left h sde (LHS) of Equaton (2) s the margnal beneft of nvestng n self-defense. The rght h sde (RHS) of Equaton (2) s the margnal cost of nvestng n self-defense,.e., -1. We obtan the former term of the margnal beneft by nternalzng the postve externalty 5,.e., by accountng for the self-defense nvestments of other users n the network. The external well-beng posed to other users by user when t nvests an addtonal dollar n selfdefense s p (x ) n j=1,j (1 p(x )). Ths s the amount by whch the lkelhood of each of the other users gettng nfected s reduced, when user nvests an addtonal dollar. Condtons for Investment: If np (0) n j=1,j (1 p(x j ))R 1, t s not optmal to nvest any amount n self-defense because the margnal cost of nvestng n defense mechansms s relatvely equal to or less than the margnal beneft of the jont reducton n rsks to ndvduals when no nvestment occurs. In ths case, the optmal value s a boundary nvestment,.e., ( x ) = 0. If the user nvests such that t has no exposure to rsk, =. In cases np (0) n j=1,j (1 p(x j))r < 1, the optmal probabltes do not le on the boundary the user nvests to partally elmnate rsk (see Equaton (2)). C. Case 3: No Co-operaton, Infecton Spread We assume that users do not co-operate wth each other on the level of nvestment,.e., users are selfsh. In such a case, the optmal level of self-defense nvestment s the pure strategy Nash equlbra of the normal form game, G = (N, A, u (s)), played by the users [2]. The game conssts of two players,.e., N = n; the acton set of G s A = n =1 A, A ɛ [0, ], the utlty/payoff functon u (s) for each player s ther ndvdual fnal wealth, s ɛ n =1 A. The pure strategy Nash equlbra of a normal form game s the ntersecton of the best response functons of each user [2]. We defne the best response functon of user, ( x ), as ( x ) ɛ argmax x F W (x, x ), F W (x, x ) = w 0 x (1 (1 p(x j )))R j=1 Takng the frst second partal dervatve of F W (x, x )wth respect to x equatng t to zero, we obtan x (F W (x, x )) = 1 p (x ) 2 x 2 (F W (x, x )) = p (x ) j=1,j j=1,j (1 p(x j ))R (1 p(x j ))R < 0 Thus, our objectve functon s globally concave, whch mples a unque soluton ( x ) for each x. We also observe that a partcular user s strategy complements user j s strategy for all j, whch mples that only symmetrc pure 5 Internalzng a postve externalty refers to rewardng a user, who contrbutes postvely wthout compensaton, to the well-beng of other users, through ts actons.

5 5 strategy Nash equlbra exst. The optmal nvestment for user s determned by the followng equaton: (F W (x, x )) = x 1 p (x ) (1 p(x j ))R = 0 (3) j=1,j Economc Interpretaton: The left h sde (LHS) of Equaton (3) s the margnal beneft of nvestng n selfdefense. The rght h sde (RHS) of Equaton (3) s the margnal cost of nvestng n self-defense,.e., -1. Snce the users cannot co-operate on the level of nvestment n selfdefense mechansms, t s not possble for them to beneft from the postve externalty that ther nvestments pose to each other. Condtons for Investment: If p (0) n j=1,j (1 p(x j))r 1, t s not optmal to nvest any amount n self-defense because the margnal cost of nvestng n defense mechansms s greater than the margnal beneft of the jont reducton n rsks to ndvduals when no nvestment occurs. In ths case, the optmal value s a boundary nvestment,.e., ( x ) = 0. If the user nvests such that t has no exposure to rsk, =. In cases p (0) n j=1,j (1 p(x j))r < 1, the optmal probabltes do not le on the boundary the user nvests to partally elmnate rsk (see Equaton (3)). Multplcty of Nash Equlbra: Due to the symmetry of our pure strategy Nash equlbra the ncreasng nature of the best response functons, there always exsts an odd number of pure-strategy Nash equlbra,.e., j ( j ) for all j = 2,..., n. IV. COMPARATIVE STUDY ( ) = In ths secton, we compare the optmal level of nvestments n the context of varous cases dscussed n the prevous secton. Our results are applcable to Internet applcatons a user has the opton to be ether co-operatve (e.g., dstrbuted fle sharng applcatons) or non-cooperatve wth respect to securty parameters. A. Case 3 versus Case 1 (3) The followng lemma gves the result of comparng Case 3 Case 1. Lemma 1. If Internet users do not co-operate on ther self-defense nvestments (.e., do not account for the postve externalty posed by other Internet users), n any Nash equlbrum n Case 3, the users neffcently under-nvest n self-defense as compared to the case users do not cooperate there s no nfecton spread. Proof. In Case 1, the condton for any user not nvestng n any self-defense s p (0)R 1. The condton mples that 1 p (0) n j=1,j (1 p(x j))r < 0 for all x. The latter expresson s the condton for non-nvestment n Case 3. Thus, for all users, = 0 n Case 1 mples = 0 n Case 3,.e., ) = xbest ) = 0,. The condton for optmal nvestment of user n Case 1 s 1 p (x )R = 0. Hence, 1 p (x ) n j=1,j (1 p(x j))r < 0, for all x. Thus, n stuatons of self-nvestment for user, > 0 n Case 1 mples 0 <, for all x, n Case 3,.e., ) > xbest ) 0,. Therefore, under non-cooperatve settngs, a user always under-nvests n self-defense mechansms. B. Case 3 versus Case 2 The followng lemma gves the result of comparng Case 3 Case 2. Lemma 2. Under envronments of nfecton spread, an Internet user co-operatng wth other users on ts self-defense nvestment (.e., accounts for the postve externalty posed by other Internet users), always nvests at least as much as n the case when t does not co-operate. Proof. In Case 2, the condton for any user not nvestng n any self-defense mechansm s 1 np (0)(1 p(0)) n 1 R 0. The condton also mples that 1 np (0)(1 p(0)) n 1 R 0. The latter expresson s the condton n Case 3 for an Internet user not nvestng n any self-defense mechansm. Thus, for all users, = 0 n Case 2 mples = 0, for all Nash equlbrum n Case 3,.e., ) = xbest ) = 0,. The condton for optmal nvestment of each user n Case 2 s 1 np ( )(1 p( ))n 1 R = 0. The latter expresson mples 1 p ( )(1 p(xopt ))n 1 R < 0. Hence ) > xbest ) 0,. Therefore, under envronments of nfecton spread, a user n Case 3 always under nvests n self-defense mechansms when compared to a user n Case 2. C. Case 2 versus Case 1 The followng lemma gves the result of comparng Case 2 Case 1. Lemma 3. In any n-agent cyber-nsurance model, p(0) < 1 n 1 1 n, t s always better for Internet users to nvest more n self-defense n a co-operatve settng wth nfecton spread than n a non-co-operatve settng wth no nfecton spread. Proof. In Case 1, the condton for any user not nvestng n any self-defense s p (0)R 1. The condton mples that 1 np (0)(1 p(0)) n 1 R 0 for all p 0 < 1 n 1 1 n. Thus, for all, ) = 0 n Case 1 mples xopt ) 0 n Case 3 f only f p 0 < 1 n 1 1 n. In stuatons of non-zero nvestment 1 np (x ( x ))(1 p(x ( x )) n 1 )R > 1 p (x ( x )),, x ( x ),

6 6 f only f p(x ( x )) < 1 n 1 1 n. Hence, 1 np ( 1 p ( )(1 p(xopt ))n 1 )R > )),, ) s the optmal nvestment n Case 2. Snce the expected fnal wealth of a user n Case 1 s concave n x ( x ), ) n Case 2 s greater than xopt ) n Case 1. Thus, we nfer that nvestments made by users n Case 2 are always greater than those made by users n Case 1 when the rsk probablty s less than a threshold value that decreases wth ncrease n the number of Internet users. Hence, n the lmt as the number of users tends towards nfnty, the lemma holds for all p 0. The basc ntuton behnd the results n the above three lemmas s that nternalzng the postve effects on other Internet users leads to better approprate self-defense nvestments for users. We also emphasze that our result trends hold true n case of heterogenous network users because rrespectve of the type of users, co-operatng on nvestments always leads to users accountng for the postve externalty nvestng more effcently. The only dfference n case of heterogenous network user scenaros could be the value of probablty thresholds.e., p(0) (ths value would be dfferent for each user n the network), under whch the above lemmas hold. Based on the above three lemmas, we have the followng theorem. Theorem 1. If Internet users cannot contract on the externaltes, n any Nash equlbrum, Internet users neffcently under-nvest n self-defense, that s compared to the socally optmal level of nvestment n self-defense. In addton, n any Nash equlbrum, a user nvests less n self-defense than f they dd not face the externalty. Furthermore, f p(0) < 1 n 1 1 n, the socally optmal level of nvestment n self-defense s hgher compared to the level f Internet users dd not face the externalty. Proof. The proof follows drectly from the results n Lemmas 1, 2, 3. V. MATHEMATICAL FRAMEWORK FOR PARTIAL INSURANCE COVERAGE In the prevous secton, we proved that Internet users neffcently under-nvest n self-defense mechansms f they do not co-operate wth other users n a network. In ths secton, we show that n non-cooperatve envronments, chargng a deductble on the user nsurance amount (partal cybernsurance), results n mprovement n ndvdual socal welfare when compared to the case n Secton III-C. The ntuton behnd chargng a deductble s that each user wll bear part of ts own loss therefore s more lkely to nvest more n self-defense mechansms than f t had full cybernsurance coverage. Snce our goal s to smply show that partal cyber-nsurance n a non-cooperatve network settng mproves welfare, for ease of exposton we analyze a twouser model to arrve at our result. We denote the users as j. Our result s applcable to a network wth any number of users. A. Case A: No Co-operaton, No Infecton Spread Under partal nsurance, users determne ther optmal amount of self-defense nvestment by maxmzng ther expected utlty of fnal wealth, whch s not equvalent to maxmzng the expected fnal wealth [4]. Thus, we have to perform our analyss based on utlty functons rather than based on the expected value of fnal wealth. Let U() be an ncreasng concave utlty functon for each user n the network such that U > 0 U < 0. We can determne the optmal amount of self-defense nvestment for each user by solvng for the value of p that maxmzes the followng constraned optmzaton problem: argmax p UF W (p ) = U(w 0 x(p 0 p ) p (R D)) 0 p p 0, UF W s the utlty of fnal wealth of a user, x( p), a functon of the dfference of p 0 p, represents user s cost of reducng the rsk probablty from p 0 to p, p = p 0 p, 0 < D < R s the deductble n cyber-nsurance. We assume that x s monotoncally ncreasng twce dfferentable wth x(0) = 0, x (0) > 0, x (0) > 0, p (R D) s the actuarally far premum for user s partal nsurance coverage. Takng the frst second dervatves of UF W wth respect to p, we obtan UF W (p ) = U (A) B, A = w 0 x(p 0 p ) (R D), B = [x (p 0 p ) (R D)] UF W (p ) = U (A) B 2 + C U (A) < 0, C = [ x (p 0 p ) (R D)] Thus, our objectve functon s globally concave wth p opt beng the optmal p obtaned by equatng the frst dervatve to 0. Accordng to our hypothess, U () > 0. Thus, any user wll not consder nvestng n self-defense f x (0) R D because ts margnal cost of nvestng n any defense mechansm wll be relatvely equal or hgher than ts beneft of reducng the expected rsk. In ths case, p opt = p 0. If x (p 0 ) < R D, then = 0 because the margnal cost of completely elmnatng p opt the probablty of rsk s small relatve to the magntude of the rsk tself. In ths case, the user wll nvest such that t has absolutely no exposure to rsk. When x (0) < R D < x (p 0 ), the probabltes do not le on the boundary,.e., 0 < p opt < p 0, the user nvests to partally elmnate rsk. It s evdent that wth D > 0 the condton for nvestment n self-defense mechansms s more relaxed than that n Secton III-A. Thus, a user havng partal nsurance coverage s more motvated

7 7 to nvest n self-defense mechansms under non-cooperatve scenaros. The followng lemma states our result. Lemma 4. In a 2-user network, the users are not ncentvzed to co-operate, a postve deductble on the nsurance coverage always motvates the users to nvest more n self-defense mechansms as compared to a full nsurance coverage scenaro. Proof. The proof follows drectly from the reasonng n the prevous paragraph. B. Case B: No Co-operaton, Infecton Spread As mentoned earler, enforcng a deductble n partal nsurance coverage scenaros may lead to better self-defense nvestments on part of Internet users n turn contrbute to socal ndvdual welfare. In ths secton, we derve condtons for optmally chargng a strctly postve deductble, show that welfare s ndeed mproved when compared to a non-cooperatve scenaro wth full nsurance coverage. Smlarly to Secton III-C, under partal nsurance coverage, user s expected utlty of fnal wealth s determned as UF W = UF W (p, p j, D) = α + β, α = (1 p )(1 p j )U(w 0 x( p ) P (D)) β = (p + (1 p )p j )U(w 0 x(p 0 p ) P (D) D) We defne P (D) as the actuarally far premum, t s expressed as P (D) = (p + (1 p )(R D) We denote the best response of user under a deductble as the soluton to the followng constraned optmzaton problem: p bestd (p j, D) ɛ argmax p UF W (p, p j ) 0 p, p j 1 Then, the followng lemma states the condtons for strctly postve deductbles. Lemma 5. For a 2-user network, gven that x (p 0 p best ) > R, the optmally enforced deductble s strctly postve f only f, for each user : () (1 p best ) 2 R > (1 (1 p best )) 2 x (p 0 p best ), () p best 1 < 1 2, pbest s the rsk probablty n a Nash equlbrum, under full nsurance coverage. Proof. Let p bestd (D) denote the symmetrc pure strategy Nash equlbrum of the optmzaton problem defned n ths secton,.e., p bestd (D) = p bestd (p best j (D), D) = p bestd j (p best (D), D). The Nash equlbrum satsfes the frst order condton gven by E1 + E2 + E3 = 0, (4) E1 = (1 p bestd (D)) (α1 β1), E2 = K1 α2, E3 = K2 α3, α1 = U(w 0 x(p 0 p bestd (D)) P (D) D), β1 = U(w 0 x(p 0 p bestd (D)) P (D)), K1 = (1 p bestd (D)) 2 K11, K11 = (x (p 0 p bestd (D)) (1 p bestd (D))(R D)), α2 = U (w 0 x(p 0 p bestd (D)) P (D)), K2 = p bestd (D)(2 p bestd (D)) K11, α3 = U (w 0 x(p 0 p bestd (D)) P (D) D), Substtutng D = 0, n the frst order condton, we obtan x (p 0 p bestd (0)) (1 p bestd (0))R = 0 For a partcular D, the expected utlty of fnal wealth for user s UF W (p bestd (D), p bestd (D), D) = I + J, I = (1 p bestd (D)) 2 ζ J = 2 p bestd (D))p bestd (D) η ζ = U(w 0 x(p 0 p bestd (D)) P (D)) η = U(w 0 x(p 0 p bestd (D)) P (D) D) Takng the frst dervatve of the expected utlty wth respect to D substtutng D = 0, we obtan UF W (p bestd (D), p bestd (D), D) = G UT, G = p bestd (0)(1 p bestd (0))R UT = U (w 0 x(p 0 p bestd (0)) P (0)) We determne the sgn of the frst dervatve of the expected utlty by mplctly dfferentatng the frst order condton wth respect to D evaluatng t to 0. We obtan the followng relaton p bestd (0)(R x (p 0 p bestd (0))) = 0 From the above relaton, we observe that p bestd (0) = 0 f only f (R x (p 0 p bestd (0))) 0. We also note that when D = 0, the Nash equlbra of the noncooperatve game concdes wth those when full nsurance

8 8 coverage s offered. We now prove that n a 2-user noncooperatve network wth nfecton spread, under full nsurance coverage, x (p 0 p best (0)) > R s a condton satsfed under all Nash equlbra. We defne the best response functon of user, p best (p j ), as p best (p j ) ɛ argmax p F W (p, p j ) = w 0 x( p ) P R ()R P R () = p +(1 p )p j. Takng the frst dervatve wth respect to p equatng t to zero, we obtan x (p 0 p best (p j )) (1 p j )R = 0 Dfferentatng agan wth respect to p j, we obtan Therefore, p best (p j ) x (p 0 p best (p j )) + R = 0 R p best (p j ) = x (p 0 p best (p j )) > 0 Snce 0 < p best (p j ) < 1, x (p 0 p best (0)) > R, for all symmetrc pure Nash equlbra. Thus, UF W (p bestd (D), p bestd (D), D) = 0 We now determne the sgn of the second dervatve of expected utlty of fnal wealth evaluated at D = 0. The second dervatve evaluated at D = 0 gves 2 UF W (p bestd (D), p bestd (D), D) = E + F, (5) E = p bestd (0)(1 p bestd (0))RU (w 0 x(p 0 p bestd (0)) P (0)) F = (1 p bestd (0)) 2 p bestd (0)(2 p bestd (0)) UT, UT = U (w 0 x(p 0 p bestd (0)) P (0)) Double dfferentatng the frst order condton, n Equaton (4), mplctly wth respect to D, substtutng D = 0 we get the value of p bestd (0) as M equals p bestd (0) = M Z, (6) (1 p bestd (0))(1 2(1 p bestd (0)) 2 ) UT Z = (R x (p 0 p bestd (0))) UT It s evdent from Equaton (6) that a value of p bestd (0) < ensures p bestd (0) < 0. Hence, for such a value of p bestd (0), small deductble amounts ncrease the selfdefense nvestment of Internet users n turn contrbutes to an mprovement n both, socal ndvdual welfare when compared to the case of non-cooperaton wth full nsurance coverage. Substtutng Equaton (6) nto Equaton (5), we obtan 2 UF W (p bestd (D), p bestd (D), D) = γ δ γ = 1 (1 p bestd (0)) 2 (1 2(1 pbestd (0)) 2 )R (R x (p 0 p bestd (0))) ) δ = (1 p bestd (0)) 2 U (w 0 x(p 0 p bestd (0)) P (0)) A strctly postve deductble s postve f only f 2 UF W (p bestd (D), p bestd (D), D) that occurs f only f (1 p bestd ) 2 R > (1 (1 p bestd > 0 )) 2 x (p 0 p bestd ). The basc ntuton behnd our results s that addtonal nvestments n self-defense create an external beneft through the postve externalty that exsts between the Internet users. Our stated theorems specfy the condtons under whch ths beneft outweghs the cost of users bearng part of the rsk. Our results are scalable when n users are present n the network. It can be conjectured that n the lmt when n, postve deductbles result for all Nash equlbra p bestd. More generally, we also conjecture that n a network wth n users, postve deductbles result for p bestd < 1 n 1 n. Based on Lemmas 4 5, we state the followng theorem summarzng our results. Theorem 2. In a 2-user network, postve deductbles always motvate non-cooperatve users to nvest more n self-defense nvestments when compared to full coverage scenaros, thereby help n ncreasng ndvdual socal welfare when there s no nfecton spread; they do so n cases of nfecton spread f only f p bestd 1 < 1 2. Proof: The proof follows drectly from the results n Lemmas 4 5. VI. CONCLUSIONS AND FUTURE DIRECTIONS In ths paper, we nvestgated the problem of self-defense nvestments n the Internet, under the full nsurance partal nsurance coverage models. We showed that (1) cooperaton amongst users results n more effcent self-defense nvestments than those n a non-cooperatve settng, under a full nsurance coverage model (2) partal nsurance motvates non-cooperatve Internet users to nvest effcently n self-defense mechansms. Cyber-nsurance s a relatvely new area of research, wth many open questons n both, theoretcal systems drectons. For nstance, one could consder the presence of

9 9 nformatonal asymmetry between the nsurer the nsured. The problem s more on the nsurer sde as the nsured have the freedom to hde nformaton from the nsurer. Ths mght lead to poor unproftable busness models on behalf of the cyber-nsurance company. One could also consder usng ntermedary organzatons between the nsurer the nsured to make sure that there are mnmal or no nformatonal asymmetres between the nsurer the nsured, whch would result n a transparent envronment wthn whch Internet users could make correct approprate nvestments. There are also nterestng drectons to pursue n the context of dstrbuted systems. For nstance, we note that n cooperatve scenaros, dstrbuted applcatons could consder addng nformaton, to already exstng protocol messages, ndcatng whether or not a partcular user/node (partcpatng n the applcaton) has nvested n cyber-nsurance. For example, we could magne a peer-to-peer fle downloadng applcaton, users jonng the peer-to-peer overlay could nclude (n ther jon messages) nformaton about the protecton n whch they have nvested; of course, such nformaton could also be pggybacked on update messages whch are typcal of dstrbuted applcatons. Moreover, we could magne modfyng peer-to-peer protocols to nclude a bas towards exchangng data wth nodes that do nvest n protecton - e.g., nodes could be (a) more based towards beng neghbors (n the overlay) of nodes that do nvest n protecton /or (b) more based towards exchangng data wth nodes that nvest n protecton. It would also be nterestng to consder whether addng nformaton about the level of nvestment s useful n such applcatons what are the possble effects, on the applcatons, of provdng such nformaton as well as the degree of user truthfulness needed n such nformaton n order to produce postve effects. In ths regard, we could look at truth bndng mechansm desgn models n games. Lastly, t would also be nterestng to explore how our model could be appled (or adapted) n the context of moble wreless networks. Although presently our model does not consder user moblty, t may stll provde nterestng nsghts as we do not make assumptons that prevent ts applcablty n such a doman. [5] J.Kesan, R.Majuca, W.Yurck. The economc case for cybernsurance: In Securng Prvacy n the Internet Age. Stanford Unversty Press, [6] J.Kesan, R.Majuca, W.Yurck. Cybernsurance as a market-based soluton to the problem of cybersecurty: A case study. In WEIS, [7] J.Walr. Personal Communcaton. [8] M.Lelarge J.Bolot. Cyber nsurance as an ncentve for nternet securty. In WEIS, [9] M.Lelarge J.Bolot. A new perspectve on nternet securty usng nsurance. In IEEE INFOCOM, [10] M.Lelarge J.Bolot. Economc ncentves to ncrease securty n the nternet: The case for nsurance. In IEEE INFOCOM, [11] N.Shetty, G.Schwarz, M.Feleghyaz, J.Walr. Compettve cybernsurance nternet securty. In WEIS, [12] R.Anderson, R.Boehme, R.Clayton, T.Moore. Securty economcs european polcy. In WEIS, [13] R.H.Coase. The problem of socal cost. Journal of Law Economcs, 3, [14] S.Radosavac, J.Kempf, U.C.Kozat. Usng nsurance to ncrease nternet securty. In ACM NetEcon, VII. ACKNOWLEDGEMENTS We would lke to sncerely thank Professor Konstantnos Psouns for hs nsghtful comments. We would also lke to thank the anonymous revewers for ther feedback, used n mprovng the paper. Ths work was supported n part by the USC Provost Fellowshp, the IBM Faculty Award, the NSF grants. REFERENCES [1] B.Schneer. Its the economcs, stupd. In WEIS, [2] D.Fudenberg J.Trole. Game Theory. MIT Press, [3] H.Kunreuther G.Heal. Interdependent securty. Journal of Rsk Uncertanty, 26, [4] I.Ehrlck G.S. Becker. Market nsurance, self-nsurance, selfprotecton. Journal of Poltcal Economy, 80(4), 1972.