Internet can be trusted and that there are no malicious elements propagating in the Internet. On the contrary, the

Transcription

1 Prcng and Investments n Internet Securty 1 A Cyber-Insurance Perspectve Ranjan Pal, Student Member, IEEE, Leana Golubchk, Member, IEEE, arxv:submt/ [cs.cr] 8 Mar 2011 Abstract Internet users such as ndvduals and organzatons are subject to dfferent types of epdemc rsks such as worms, vruses, spams, and botnets. To reduce the probablty of rsk, an Internet user generally nvests n tradtonal securty mechansms lke ant-vrus and ant-spam software, sometmes also known as self-defense mechansms. However, such software does not completely elmnate rsk. Recent works have consdered the problem of resdual rsk elmnaton by proposng the dea of cyber-nsurance. In ths regard, an mportant research problem s the analyss of optmal user self-defense nvestments and cyber-nsurance contracts under the Internet envronment. In ths paper, we nvestgate two problems and ther relatonshp: 1) analyzng optmal self-defense nvestments n the Internet, under optmal cyber-nsurance coverage, where optmalty s an nsurer objectve and 2) desgnng optmal cyber-nsurance contracts for Internet users, where a contract s a (premum, coverage) par. By the term self-defense nvestment, we mean the monetary-cum-precautonary cost that each user needs to nvest n employng rsk mtgatng self-defense mechansms, gven that t s optmally nsured by Internet nsurance agences. We propose 1) a general mathematcal framework by whch co-operatve and non-co-operatve Internet users can decde whether or not to nvest n self-defense for ensurng both, ndvdual and socal welfare and 2) models to evaluate optmal cyber-nsurance contracts n a sngle cyber-nsurer settng. Our results show that co-operaton amongst users results n more effcent self-defense nvestments than those n a non-cooperatve settng, under full nsurance coverage, n an deal sngle nsurer cyber-nsurance market, whereas n non-deal sngle nsurer markets of non-cooperatve users, partal nsurance drven self-defense nvestments are optmal. We also show the exstence of a cyber-nsurance market n a sngle cyber-nsurer scenaro. Keywords: cyber-nsurance, self-defense nvestments, nformaton asymmetry I. INTRODUCTION The Internet has become a fundamental and an ntegral part of our daly lves. Bllons of people nowadays are usng the Internet for varous types of applcatons. However, all these applcatons are runnng on a network, that was bult under assumptons, some of whch are no longer vald for today s applcatons, e,g., that all users on the R. Pal and L. Golubchk are wth the Department of Computer Scence, Unversty of Southern Calforna, CA, USA. e-mal: {rpal, leana}@usc.edu.

2 2 Internet can be trusted and that there are no malcous elements propagatng n the Internet. On the contrary, the nfrastructure, the users, and the servces offered on the Internet today are all subject to a wde varety of rsks. These rsks nclude denal of servce attacks, ntrusons of varous knds, hackng, phshng, worms, vruses, spams, etc. In order to counter the threats posed by the rsks, Internet users 1 have tradtonally resorted to antvrus and ant-spam softwares, frewalls, and other add-ons to reduce the lkelhood of beng affected by threats. In practce, a large ndustry (companes lke Norton, Symantec, McAfee, etc.) as well as consderable research efforts are centered around developng and deployng tools and technques to detect threats and anomales n order to protect the Internet nfrastructure and ts users from the negatve mpact of the anomales. In the past one and half decade, protecton technques from a varety of computer scence felds such as cryptography, hardware engneerng, and software engneerng have contnually made mprovements. Inspte of such mprovements, recent artcles by Schneer [28] and Anderson [2][3] have stated that t s mpossble to acheve a 100% Internet securty protecton. The authors attrbute ths mpossblty prmarly to four reasons: 1) new vruses, worms, spams, and botnets evolve perodcally at a rapd pace and as result t s extremely dffcult and expensve to desgn a securty soluton that s a panacea for all rsks, 2) the Internet s a dstrbuted system, where the system users have dvergent securty nterests and ncentves, leadng to the problem of msalgned ncentves amongst users. For example, a ratonal Internet user mght well spend $20 to stop a vrus trashng ts hard dsk, but would hardly have any ncentve to nvest suffcent amounts n securty solutons to prevent a servce-denal attack on a wealthy corporaton lke an Amazon or a Mcrosoft [32]. Thus, the problem of msalgned ncentves can be resolved only f labltes are assgned to partes (users) that can best manage rsk, 3) the rsks faced by Internet users are often correlated and nterdependent. A user takng protectve acton n an Internet lke dstrbuted system creates postve externaltes [14] for other networked users that n turn may dscourage them from makng approprate securty nvestments, leadng to the free-rdng problem [6][10][20][22], and 4) network externaltes affect the adopton of technology. Katz and Shapro [12] have analyzed that externaltes lead to the classc S-shaped adopton curve, accordng to whch slow early adopton gves way to rapd deployment once the number of users reaches a crtcal mass. The ntal deployment s subject to user benefts exceedng adopton costs, whch occurs only f a mnmum number of users adopt a technology; so everyone mght wat for others to go frst, and the technology never gets deployed. For example, DNSSEC, and S-BGP are secure protocols that have been developed to better DNS and BGP n terms of securty performance. However, the challenge s gettng them deployed by provdng suffcent nternal benefts to adoptng frms. In vew of the above mentoned nevtable barrers to 100% rsk mtgaton, the need arses for alternatve methods of rsk management n the Internet. Anderson and Moore [3] state that mcroeconomcs, game theory, and 1 The term users may refer to both, ndvduals and organzatons.

3 3 psychology wll play as vtal a role n effectve rsk management n the modern and future Internet, as dd the mathematcs of cryptography a quarter century ago. In ths regard, cyber-nsurance s a psycho-economc-drven rsk-management technque, where rsks are transferred to a thrd party,.e., an nsurance company, n return for a fee,.e., the nsurance premum. The concept of cyber-nsurance s growng n mportance amongst securty engneers. The reason for ths s three fold: 1) deally, cyber-nsurance ncreases Internet safety because the nsured ncreases self-defense as a ratonal response to the reducton n nsurance premum [11][13][30][35]. Ths fact has also been mathematcally proven by the authors n [15][18], 2) n the IT ndustry, the mndset of absolute protecton s slowly changng wth the realzaton that absolute securty s mpossble and too expensve to even approach whle adequate securty s good enough to enable normal functons - the rest of the rsk that cannot be mtgated can be transferred to a thrd party [19], and 3) cyber-nsurance wll lead to a market soluton that wll be algned wth economc ncentves of cyber-nsurers and users (ndvduals/organzatons) - the cyber-nsurers wll earn proft from approprately prcng premums, whereas users wll seek to hedge potental losses. In practce, users generally employ a smultaneous combnaton of retanng, mtgatng, and nsurng rsks [29]. Suffcent evdence exsts n daly lfe (e.g., n the form of auto and health nsurance) as well as n the academc lterature (specfcally focused on cyber-nsurance) [11][13][15][18][30] that nsurance-based solutons are useful approaches to pursue,.e., as a complement to other securty measures (e.g., ant-vrus software). However, cybernsurance has not yet become a realty due to a number of unresolved research challenges as well as practcal consderatons (as detaled below). A number of these challenges are rooted n the dfferences between cybernsurance and other forms of nsurance. Specfcally, these nclude: Networked envronment. The operaton of systems and applcatons n a networked envronments leads to new nsurance challenges. Specfcally, the network s topology, node connectvty, form of nteracton among the nodes, all lead to subsequent rsk propagaton characterstcs. Ths n turn mples that consderatons of nterdependent securty and correlated rsk (among system partcpants) are sgnfcantly more complex n an Internet-type envronment. All ths leads to challenges n modelng of network topologes, rsk arrval, attacker models, and so on. Informaton asymmetry. Informaton asymmetry has a sgnfcant effect on most nsurance envronments, where typcal consderatons nclude nablty to dstngush between users of dfferent types as well as users undertakng actons that affect loss probablty after the nsurance contract s sgned. However, there are mportant aspects of nformaton asymmetry that are partcular to cyber-nsurance. These nclude users hdng nformaton from nsurers, users lackng nformaton aout networked nodes, as well as nsurers lackng nformaton about and not dfferentatng based on products (e.g., ant-vrus software) nstalled by users. All ths leads to challenges n modelng nsurers and nsured enttes.

4 4 In ths paper, we address the problem of prcng and nvestments n Internet securty related to cyber-nsurancedrven rsk management under a correlated, nterdependent, and nformaton asymmetrc Internet envronment. Our problem s mportant because 1) for cyber-nsurance to be popular amongst Internet users, a market for t should frst exst, whch n turn depends on the prces charged by the cyber-nsurer (supply sde) to ts clents (demand sde) and the subsequent profts earned and 2) once a market for cyber-nsurance exsts, Internet users would want to nvest optmally n self-defense nvestments, gven nsurance coverage, so as to mprove overall securty. Optmal user nvestments s mportant for two reasons: 1) nvestng n self-defense mechansms reduces a user s probablty of facng rsk. Gven that a user has cyber-nsurance coverage, ncrease n user self-defense nvestments reduces ts premum charged by the cyber-nsurer. Thus, ts mportant to characterze the approprate amounts of nvestments by a user n self-defense, as well as n cyber-nsurance, such that t maxmzes ts utlty and 2) many dstrbuted Internet applcatons lke peer-to-peer fle sharng, multcastng, and network resource sharng encourage co-operaton between users to mprove overall system performance. In regard to securty nvestments, cooperaton nvtes an opportunty for a user to beneft from the postve externalty 2 that ts nvestment poses on the other users n the network. However, ts not evdent that users nvest better when they cooperate compared to when they do not, n regard to the network achevng greater overall securty. In ths paper, we want to study whether securty nvestments are more effcent under cooperaton than under non cooperaton when t comes to achevng better overall network securty. We make the followng research contrbutons n ths paper. Before statng them, we emphasze that they are based on the expected utlty theory model by von-neumann and Morgenstern, whch s the most wdely used theory for analyzng mcro-economc models. We also assume n all our models the presence of only one cyber-nsurer provdng servce to ts clents (Internet users). 1) We quanttatvely analyze an n-agent model, usng botnet rsks as a representatve applcaton, and propose a general mathematcal framework through whch Internet users can decde 1) whether to nvest and 2) how much to nvest n self-defense mechansms, gven that each user s optmally nsured w.r.t. nsurer objectves n perfect sngle nsurer cyber-nsurance markets(see Secton III). Our framework entals each Internet user to nvest optmally n self-defense mechansms n order to mprove overall network securty, and s applcable to all rsk types that nflct drect and/or ndrect losses to users. 2) For deal 3 sngle nsurer cyber-nsurance markets, we perform a mathematcal comparatve study to show that cooperaton amongst Internet users results n better self-defense nvestments w.r.t. mprovng overall network securty when the rsks faced by the users n the Internet are nterdependent (see Secton IV). We use basc concepts from both, cooperatve and non cooperatve game theory to support the clams we make 2 An externalty s a postve (external beneft) or negatve(external cost) mpact on a user not drectly nvolved n an economc transacton. 3 An nsurance envronment wth no nformaton asymmetry between the cyber-nsurer and the nsured.

5 5 n Sectons III and IV. Our results are applcable to both, co-operatve (e.g., dstrbuted fle sharng) as well as non-cooperatve Internet applcatons, where n both applcaton types a user has the opton to be ether co-operatve or non-cooperatve wth respect to securty parameters. 3) We derve optmal cyber-nsurance contracts ((premum, coverage) pars) between the cyber-nsurer and the nsured under both, deal as well as non-deal cyber-nsurance envronments, and show that a market for cybernsurance exsts when there s a sngle cyber-nsurer provdng nsurance to all Internet users (see Secton V. Whle exstng lterature show that nformaton asymmetres leads to market falure, usng mechansm desgn theory, we desgn robust cyber-nsurance contracts that account for nformaton asymmetres, maxmze cybernsurer profts, and are n market equlbrum. Through our contrbutons, we jontly address an economcs problem of both, the supply sde (cyber-nsurer) as well as the demand sde (cyber-nsured) and study the relatonshp between the two,.e., we study the effect that prces set n a cyber-nsurance contract has on the self-defense nvestment of an Internet user. For ease of presentaton, we frst address the nvestment problem of Internet user under a gven cyber-nsurance contract followed by the problem of prcng optmal cyber-nsurance contracts. We do ths because cyber-nsurers are the frst movers and account for optmal self-defense nvestments of Internet users when desgnng optmal nsurance contracts. II. RELATED WORK The feld of cyber-nsurance n networked envronments has been trggered by recent results on the amount of ndvdual user self-defense nvestments n the presence of network externaltes. The authors n [6][10][16][17][20][22] mathematcally show that Internet users nvest too lttle n self-defense mechansms relatve to the socally effcent level, due to the presence of network externaltes. These works just hghlght the role of postve externaltes n preventng users for nvestng optmally n self-defense nvestments. Thus, the challenge to mprovng overall network securty les n ncentvzng end-users to nvest n suffcent amount of self-defense nvestments nspte of the postve externaltes they experence from other users n the network. In response to the challenge, the works n [16][17] modeled network externaltes and showed that a tppng phenomenon s possble,.e., n a stuaton of low level of self-defense, f a certan fracton of populaton decdes to nvest n self-defense mechansms, t could trgger a large cascade of adopton n securty features, thereby strengthenng the overall Internet securty. However, they dd not state how the tppng phenomenon could be realzed n practce. In a seres of recent works [15][18], Lelarge and Bolot have stated that under condtons of no nformaton asymmetry [1][8] between the nsurer and the nsured, cyber-nsurance ncentvzes Internet user nvestments n self-defense mechansms, thereby pavng the path to trgger a cascade of adopton. They also show that nvestments n both self-defense mechansms and nsurance schemes are qute nter-related n mantanng a socally effcent level of securty on the Internet.

6 6 Inspte of Lelarge and Bolot proposng the role of cyber-nsurance for networked envronments n ncentvzng ncreasng user securty nvestments, ts common knowledge that the market for cyber-nsurance has not blossomed wth respect to ts promsed potental. Most recent works [21][4] have attrbuted the underdeveloped market for cyber-nsurance due to 1. nterdependent securty, 2. correlated rsk, and 3. nformaton asymmetres. Thus, the need of the hour s to develop cyber-nsurance solutons smultaneously targetng these three ssues and dentfy other factors that mght play an mportant role n promotng a developed cyber-nsurance market. The works n [31][15][18] [7] touch upon the noton of nformaton asymmetry and the effect t has on the nsurance parameters, however none of the works explctly model nformaton asymmetry. In relaton to tacklng nformaton asymmetry, the authors n [21][7][15] propose the concept of premum dfferentaton and fnes, but none of the works provde an analytcal model to strengthen ther pont. In addton, no work consders the cooperatve and non cooperatve nature of network users and the effect ths has on the overall level of securty and approprate self-defense nvestments. III. A MATHEMATICAL FRAMEWORK FOR SELF-DEFENSE INVESTMENTS In ths secton, we propose a general mathematcal framework for decdng on the approprate self-defense nvestment of an Internet user, under optmal cyber-nsurance coverage, n deal sngle nsurer cyber-nsurance markets. Here, we assume that Internet users could buy nsurance from enttes lke Internet servce provders (ISPs) to cover the rsks posed by botnets 4. For nstance, the coverage could be n the form of money or protecton aganst lost data/reputaton. Our framework s applcable to drect/ndrect rsks, those that are caused by worms, vruses, and botnets. Drect rsks result when threats such as worms, vruses, and botnets nfect machnes (computng devce) that lack a securty feature, whereas ndrect losses result due to the contagon process of one machne gettng nfected by ts neghbors. A. Model Descrpton We consder n dentcal 5 ratonal rsk-averse users n a network,.e., E(U(w)) < U(E(w)), where w s the wealth possessed by a user. We assume the users to be cooperatve to a varable degree,.e, the network supports Internet applcatons where users cooperate wth other users n some capacty wth the ntenton to mprove overall system performance but may or may not cooperate entrely. The users could ether voluntarly cooperate by sharng nformaton wth other network users regardng self-defense nvestments, or be bound to cooperate due to a network regulaton, whch requres partcpatng users to share self-defense nvestment nformaton. The users may also decde not to cooperate at all dependng on the nature of applcatons. Each user has ntal wealth w 0 and s exposed to a 4 Cyber-nsurance provders could also be thrd-party agences other than ISPs or the government. 5 We assume dentcal users to ensure tractable analyses.

7 7 substantal rsk of sze R wth a certan probablty p 0. (Here, rsk represents the negatve wealth accumulated by a user when t s affected by Internet threats.) A user nvestng n self-defense mechansms reduces ts rsk probablty. For an amount x, nvested n selfdefense, a user faces a rsk probablty of p(x), whch s a contnuous and twce dfferentable decreasng functon of nvestment,.e., p (x) < 0, p (x) > 0, lm x p(x) = 0, and lm x p (x) = 0. The nvestment x s a functon of the amount of securty software the user buys and the effort t spends on mantanng securty settngs on ts computng devce. In addton to nvestng n self-defense mechansms, a user ether fnds t optmal to buy ether full or partal cyber-nsurance coverage at a partcular premum to elmnate ts resdual rsk. The premum and coverage applcable to users are determned through optmal cyber-nsurance contracts that we wll nvestgate n Secton V. A user does not buy nsurance for hgh probablty low rsk events because 1) these events are extremely common and does not cause suffcent damage to demand nsurance solutons and 2) the nsurance company also has reservatons n nsurng every knd of rsk for proft purposes. We also assume for the moment that there exsts markets for cyber-nsurance,.e., cyber-nsurance strengthens overall network securty and there exsts cybernsurance contracts that are n market equlbrum. We wll show n Secton V that markets can be made to exst for sngle-nsurer cyber-nsurance envronments. An Internet user apart from beng drectly affected by threats may be ndrectly nfected by the other Internet users. We denote the ndrect rsk facng probablty of a user as q( x,n), where x = (x 1,...,x 1,x +1,...,x n ) s the vector of self-defense nvestments of users other than. An ndrect nfecton spread s ether perfect or mperfect n nature. In a perfect spread, nfecton spreads from a user to other users n the network wth probablty 1, whereas n case of mperfect spread, nfecton spreads from a user to others wth probablty less than 1. For a perfect nformaton spread q( x,n) = 1 n j=1,j (1 p(x j)), whereas n the case of mperfect spread, q( x,n) < 1 n j=1,j (1 p(x j)). In ths paper, we consder perfect spread only, wthout loss of generalty because the probablty of gettng nfected by others n the case of mperfect spread s less than that n the case of perfect spread, and as a result ths case s subsumed by the results of the perfect spread case. Under perfect spread, the rsk probablty of a user s gven as p(x )+(1 p(x ))q( x,n) = 1 n (1 p(x j )) (1) and ts expected fnal wealth upon facng rsk s denoted as w 0 x (1 n j=1 (1 p(x j)) IC) R+IC, where (1 n j=1 (1 p(x j)) IC s the premum and IC denotes the nsurance coverage 6. The am of a network user s to nvest n self-defense mechansms n such a manner so as to ether maxmze ts expected utlty of fnal wealth, or maxmze the expected utlty of net wealth n the network system, dependng on the nature of the applcaton. 6 For full nsurance coverage R = IC. j=1

8 8 B. Mathematcal Framework for Full Insurance Coverage In ths secton, we assume full cyber-nsurance coverage and propose a general mathematcal framework for decdng on the approprate self-defense nvestment of an Internet user. It has been proved n [33] that under far premums and n deal nsurance envronments, a user fnds ts optmal to buy full coverage. In other stuatons, a user mght buy full coverage but t mght not be optmal for tself as t may end up payng unfar premums to the nsurer, who does not want to make negatve profts. Thus, we assume here that full coverage s optmal for users under deal cyber-nsurance envronments, gven that users would only want to be charged far premums. We model the followng rsk management scenaros: (1) users do not cooperate and do not get nfected by other users n the network, (2) users cooperate and may get nfected by other users n the network, (3) users do not cooperate but may get nfected by other users n the network, and (4) users cooperate but do not get nfected by other users n the network. We note that Case 4 s a specal case of Case 2 and thus s subsumed n the results of Secton III-B2. Scenaros 2 and 3 are realstc n the Internet where rsks do spread even though applcatons may or may not allow co-operaton. Scenaros 1 and 4 are dealstc cases and are analyzed for pathologcal reasons as well as for purposes of comparson wth scenaros 2 and 3 w.r.t. optmal self-defense nvestments. 1) Case 1: No Cooperaton, No Infecton Spread: Under full nsurance, the rsk s equal to the nsurance coverage, and users determne ther optmal amount of self-defense nvestment by maxmzng ther level of fnal wealth, whch n turn s equvalent to maxmzng ther expected utlty of wealth [9]. We can determne the optmal amount of self-defense nvestment for each user by solvng for the value of p that maxmzes the followng constraned optmzaton problem: argmax x FW (x ) = w 0 x p(x )R R+IC or argmax x FW (x ) = w 0 x p(x )R subject to 0 p(x ) p 0, where FW s the fnal wealth of user and p(x )R s the premum for full nsurance coverage. Takng the frst and second dervatves of FW wth respect to x, we obtan FW (x ) = 1 p (x )R (2) and FW (x ) = p (x )R < 0 (3)

9 9 Thus, our objectve functon s globally concave. Let to 0. Thus, we have: be the optmal x obtaned by equatng the frst dervatve p ( )R = 1. (4) Economc Interpretaton: The left hand sde (LHS) of Equaton (4) s the margnal beneft of nvestng an addtonal dollar n self-protecton mechansms, whereas the rght hand sde (RHS) denotes the margnal cost of the nvestment. A user equates the LHS wth the RHS to determne ts self-defense nvestment. Condtons for Investment: We frst nvestgate the boundary costs. The user wll not consder nvestng n selfdefense f p (0)R 1 because ts margnal cost of nvestng n any defense mechansm,.e., -1, wll be relatvely equal to or lower than the margnal beneft when no nvestment occurs. In ths case, such that t has no exposure to rsk, = 0. If the user nvests =. When p (0)R < 1, the costs do not le on the boundary,.e., 0 < <, and the user nvests to partally elmnate rsk (see Equaton (4)). 2) Case 2: Cooperaton, Infecton Spread: Under full nsurance coverage, user s expected fnal wealth s gven by FW = FW(x, n x ) = w 0 x (1 (1 p(x j )))R (5) j=1 When Internet users co-operate, they jontly determne ther optmal self-defense nvestments. We assume that cooperaton and barganng costs are nl. In such a case, accordng to Coase theorem [26], the optmal nvestments for users are determned by solvng for the socally optmal nvestment values that maxmze the aggregate fnal wealth (AFW) of all users. Thus, we have the followng constraned optmzaton problem: n n argmax x, x AFW = nw 0 x n(1 (1 p(x j )))R =1 j=1 0 p (x ) p 0, Takng the frst and the second partal dervatves of the aggregate fnal wealth wth respect to x, we obtan x (AFW) = 1 np (x ) n j=1,j (1 p(x j ))R (6) and 2 x 2 (AFW) = np (x ) n (1 p(x j ))R < 0 (7) j=1,j The objectve functon s globally concave, whch mples the exstence of a unque soluton ( x ), for each x. Our maxmzaton problem s symmetrc for all, and thus the optmal soluton s gven by ) = j ) for all j = 2,...,n. We obtan the optmal soluton by equatng the frst dervatve to zero, whch gves j

10 10 us the followng equaton np ( ( x )) j=1,j (1 p(x ))R = 1 (8) Economc Interpretaton: The left hand sde (LHS) of Equaton (8) s the margnal beneft of nvestng n selfdefense. The rght hand sde (RHS) of Equaton (8) s the margnal cost of nvestng n self-defense,.e., -1. We obtan the former term of the margnal beneft by nternalzng the postve externalty 7,.e., by accountng for the self-defense nvestments of other users n the network. The external well-beng posed to other users by user when t nvests an addtonal dollar n self-defense s p (x ) n j=1,j (1 p(x )). Ths s the amount by whch the lkelhood of each of the other users gettng nfected s reduced, when user nvests an addtonal dollar. Condtons for Investment: If np (0) n j=1,j (1 p(x j))r 1, t s not optmal to nvest any amount n selfdefense because the margnal cost of nvestng n defense mechansms s relatvely equal to or less than the margnal beneft of the jont reducton n rsks to ndvduals when no nvestment occurs. In ths case, the optmal value s a boundary nvestment,.e., ( x ) = 0. If the user nvests such that t has no exposure to rsk, =. In cases where np (0) n j=1,j (1 p(x j))r < 1, the optmal probabltes do not le on the boundary and the user nvests to partally elmnate rsk (see Equaton (8)). 3) Case 3: No Cooperaton, Infecton Spread: We assume that users do not co-operate wth each other on the level of nvestment,.e., users are selfsh. In such a case, the optmal level of self-defense nvestment s the pure strategy Nash equlbra of the normal form game, G = (N,A,u (s)), played by the users [5]. The game conssts of two players,.e., N = n; the acton set of G s A = n =1 A, where A ǫ[0, ], and the utlty/payoff functon u (s) for each player s ther ndvdual fnal wealth, where sǫ n =1 A. The pure strategy Nash equlbra of a normal form game s the ntersecton of the best response functons of each user [5]. We defne the best response functon of user, x best ( x ), as x best ( x )ǫargmax x FW (x, x ), where FW (x, n x ) = w 0 x (1 (1 p(x j )))R (9) j=1 Takng the frst and second partal dervatve of FW (x, x )wth respect to x and equatng t to zero, we obtan x (FW (x, x )) = 1 p (x ) n j=1,j (1 p(x j ))R (10) 7 Internalzng a postve externalty refers to rewardng a user, who contrbutes postvely and wthout compensaton, to the well-beng of other users, through ts actons.

11 11 and 2 x 2 (FW (x, x )) = p (x ) n (1 p(x j ))R < 0 (11) j=1,j Thus, our objectve functon s globally concave, whch mples a unque soluton x best ( x ) for each x. We also observe that a partcular user s strategy complements user j s strategy for all j, whch mples that only symmetrc pure strategy Nash equlbra exst. The optmal nvestment for user s determned by the followng equaton: x (FW (x, x )) = 1 p (x ) n j=1,j (1 p(x j ))R = 0 (12) Economc Interpretaton: The left hand sde (LHS) of Equaton (12) s the margnal beneft of nvestng n selfdefense. The rght hand sde (RHS) of Equaton (12) s the margnal cost of nvestng n self-defense,.e., -1. Snce the users cannot co-operate on the level of nvestment n self-defense mechansms, t s not possble for them to beneft from the postve externalty that ther nvestments pose to each other. Condtons for Investment: If p (0) n j=1,j (1 p(x j))r 1, t s not optmal to nvest any amount n selfdefense because the margnal cost of nvestng n defense mechansms s greater than the margnal beneft of the jont reducton n rsks to ndvduals when no nvestment occurs. In ths case, the optmal value s a boundary nvestment,.e., x best ( x ) = 0. If the user nvests such that t has no exposure to rsk, =. In cases where p (0) n j=1,j (1 p(x j))r < 1, the optmal probabltes do not le on the boundary and the user nvests to partally elmnate rsk (see Equaton (12)). Multplcty of Nash Equlbra: Due to the symmetry of our pure strategy Nash equlbra and the ncreasng nature of the best response functons, there always exsts an odd number of pure-strategy Nash equlbra,.e., x best ( x best ) = xbest j ( x best j ) for all j = 2,...,n. C. Optmal Investments Under Partal Insurance Coverage In ths secton, we analyze the stuaton of optmal self-defense nvestments when the cyber-nsurance agency fnds t optmal to provde partal coverage to ts clents. Ths stuaton arses manly due to condtons of nformaton asymmetry n the nsurance envronment, when partal coverage s necessary to ensure a market for cyber-nsurance (see Secton V). We only assume the realstc case of nformaton asymmetry arsng n a non-cooperatve Internet envronment as co-operatve Internet users would want socal welfare and would not generally want to hde relevant detals from the cyber-nsurer. 1) Case A: No Co-operaton, No Infecton Spread: Under partal nsurance, users determne ther optmal amount of self-defense nvestment by maxmzng ther expected utlty of fnal wealth, whch s not equvalent to maxmzng

12 12 the expected fnal wealth [9]. Thus, we have to perform our analyss based on utlty functons rather than based on the expected value of fnal wealth. Let U() be an ncreasng and concave utlty functon for each user n the network such that U > 0 and U < 0. We can determne the optmal amount of self-defense nvestment for each user by solvng for the value of p that maxmzes the followng constraned optmzaton problem: argmax p UFW(p ) = U(w 0 x(p 0 p ) p (R D)) 0 p p 0, where UFW s the utlty of fnal wealth of a user, x( p), a functon of the dfference of p 0 and p, represents user s cost of reducng the rsk probablty from p 0 to p, p = p 0 p, and 0 < D < R s the deductble n cyber-nsurance. We assume that x s monotoncally ncreasng and twce dfferentable wth x(0) = 0, x (0) > 0, and x (0) > 0, and p (R D) s the actuarally far premum for user s partal nsurance coverage. 2) Case B: No Co-operaton, Infecton Spread: Under condtons of nfecton spread n a non-cooperatve Internet envronment, user s expected utlty of fnal wealth when a deductble of D s mposed on tself s gven as UFW = UFW (p,p,d) = α+β, (13) where and n α = (1 p )U(w 0 x( p ) P(D)) (14) =1 n β = 1 (1 pj)u(w 0 x(p 0 p ) P(D) D) (15) j=1 We defne P(D) as the actuarally far premum, and t s expressed as n P(D) = 1 (1 pj)(r D) (16) j=1 Snce there s spread of nfecton and that the Internet envronment s non co-operatve, we have a non co-operatve game of self-defense nvestments between the Internet users. We denote the best response of user under a deductble as the soluton to the followng constraned optmzaton problem: p bestd (p,d)ǫargmax p UFW(p,p ) 0 p 1,

13 13 The ntersecton of the best responses of the users form the set of Nash equlbra of the nvestment game. IV. COMPARATIVE STUDY In ths secton, we compare the optmal level of nvestments under full cyber-nsurance coverage n the context of varous cases dscussed n the prevous secton. We emphasze here that greater the self-defense nvestments made by a user, better t s for the securty of the whole network. Our results are applcable to Internet applcatons where a user has the opton to be ether co-operatve or non-cooperatve wth respect to securty parameters. A. Case 3 versus Case 1 The followng lemma gves the result of comparng Case 3 and Case 1. Lemma 1. If Internet users do not co-operate on ther self-defense nvestments (.e., do not account for the postve externalty posed by other Internet users), n any Nash equlbrum n Case 3, the users neffcently undernvest n self-defense as compared to the case where users do not cooperate and there s no nfecton spread. Proof. In Case 1, the condton for any user not nvestng n any self-defense s p (0)R 1. The condton mples that 1 p (0) n j=1,j (1 p(x j))r < 0 for all x. The latter expresson s the condton for nonnvestment n Case 3. Thus, for all users, = 0 n Case 1 mples x best = 0 n Case 3,.e., ) = x best x best ) = 0,. The condton for optmal nvestment of user n Case 1 s 1 p (x )R = 0. Hence, 1 p (x ) n j=1,j (1 p(x j))r < 0, for all x. Thus, n stuatons of self-nvestment for user, > 0 n Case 1 mples 0 x best <, for all x, n Case 3,.e., ) > xbest x best ) 0,. Therefore, under non-cooperatve settngs, a user always under-nvests n self-defense mechansms. B. Case 3 versus Case 2 The followng lemma gves the result of comparng Case 3 and Case 2. Lemma 2. Under envronments of nfecton spread, an Internet user co-operatng wth other users on ts selfdefense nvestment (.e., accounts for the postve externalty posed by other Internet users), always nvests at least as much as n the case when t does not co-operate. Proof. In Case 2, the condton for any user not nvestng n any self-defense mechansm s 1 np (0)(1 p(0)) n 1 R 0. The condton also mples that 1 np (0)(1 p(0)) n 1 R 0. The latter expresson s the condton n Case 3 for an Internet user not nvestng n any self-defense mechansm. Thus, for all users, = 0 n Case 2 mples x best = 0, for all Nash equlbrum n Case 3,.e., ) = xbest x best ) = 0,. The condton for optmal nvestment of each user n Case 2 s 1 np ( )(1 p(xopt ))n 1 R = 0. The latter expresson mples 1 p ( )(1 p(xopt ))n 1 R < 0. Hence ) > xbest x best ) 0,.

14 14 Therefore, under envronments of nfecton spread, a user n Case 3 always under nvests n self-defense mechansms when compared to a user n Case 2. C. Case 2 versus Case 1 The followng lemma gves the result of comparng Case 2 and Case 1. 1 Lemma 3. In any n-agent cyber-nsurance model, where p(0) < 1 n 1 n, t s always better for Internet users to nvest more n self-defense n a co-operatve settng wth nfecton spread than n a non-co-operatve settng wth no nfecton spread. Proof. In Case 1, the condton for any user not nvestng n any self-defense s p (0)R 1. The condton 1 mples that 1 np (0)(1 p(0)) n 1 R 0 for all p 0 < 1 n 1 n. Thus, for all, xopt ) = 0 n Case 1 mples ) 0 n Case 3 f and only f p 0 < 1 n 1 1. In stuatons of non-zero nvestment n 1 np (x ( x ))(1 p(x ( x )) n 1 )R > 1 p (x ( x )),, x ( x ), f and only f p(x ( x )) < 1 n 1 1 n. Hence, 1 np ( )(1 p(xopt ))n 1 )R > 1 p ( )),, where ) s the optmal nvestment n Case 2. Snce the expected fnal wealth of a user n Case 1 s concave n x ( x ), ) n Case 2 s greater than xopt ) n Case 1. Thus, we nfer that nvestments made by users n Case 2 are always greater than those made by users n Case 1 when the rsk probablty s less than a threshold value that decreases wth ncrease n the number of Internet users. Hence, n the lmt as the number of users tends towards nfnty, the lemma holds for all p 0. The basc ntuton behnd the results n the above three lemmas s that nternalzng the postve effects on other Internet users leads to better and approprate self-defense nvestments for users. We also emphasze that our result trends hold true n case of heterogenous network users because rrespectve of the type of users, co-operatng on nvestments always leads to users accountng for the postve externalty and nvestng more effcently. The only dfference n case of heterogenous network user scenaros could be the value of probablty thresholds.e., p(0) (ths value would be dfferent for each user n the network), under whch the above lemmas hold. Based on the above three lemmas, we have the followng theorem. Theorem 1. If Internet users cannot contract on the externaltes, n any Nash equlbrum, Internet users neffcently under-nvest n self-defense, that s compared to the socally optmal level of nvestment n self-defense. In addton, n any Nash equlbrum, a user nvests less n self-defense than f they dd not face the externalty. 1 Furthermore, f p(0) < 1 n 1 n, the socally optmal level of nvestment n self-defense s hgher compared to

15 15 the level f Internet users dd not face the externalty. Proof. The proof follows drectly from the results n Lemmas 1, 2, and 3. The theorem mples that when negotatons could be carred out by a regulator (ex., an ISP) amongst Internet users n a cooperatve settng, nevtable network externaltes could be nternalzed and as a result users who beneft from the externalty would be requred to nvest consderably n self-defense nvestments, thereby mprovng overall network securty. The negotatons cannot not be conducted n a non-cooperatve settng and as a result users would not pay for the benefts obtaned from the postve externaltes, thereby nvestng suboptmally. V. OPTIMAL CYBER-INSURANCE CONTRACTS In ths secton, we dscuss the problem of optmal nsurance contracts. We make two contrbutons n ths secton: 1) we derve optmal cyber-nsurance contracts under deal nsurance envronments when no nformaton asymmetry exsts between the cyber-nsurer and the nsured and 2) we derve optmal cyber-nsurance contracts under nformaton asymmetry envronments and show that a market exsts for monopolstc nsurance scenaros. Once optmal contracts are set by the cyber-nsurance agences, Internet users decde on ther optmal self-defense nvestments gven the optmal contracts. A. Optmal Cyber-Insurance Contracts Under No Informaton Asymmetry The man goal of ths secton s to derve optmal cyber-nsurance contracts between the nsurer and ts clents under condtons of no nformaton asymmetry (for perfect nsurance markets), where the nsurer could have ether a socal welfare maxmzng mndset or a proft maxmzng mndset. When an nsurer has a socal welfare mndset, t does not care that much about makng busness profts as t does about nsurng people so as to ncrease the populaton of users nvestng n self-defense mechansms. Its hard to thnk of any commercal organzaton n the modern world who would want to provde servce wthout thnkng of profts. However, f ISPs would be a cybernsurance agency, t would want to secure tself, beng a computng and networkng entty. Gven that an ISP s an eyeball and the snk for many end-user flows, t would have a strong reason to ensure hgh securty amongst ts clents as a prmary objectve, n order to strengthen ts own securty. 1) Model: We assume that Internet users are unformly dstrbuted on the lne segment [0,1],.e., the locaton pǫ[0,1] of a partcular user on the unt nterval denotes ts probablty of facng a substantal rsk of sze R. Ths s the rsk a user faces after some ntal nvestments, whch are precautonary efforts both n the monetary, as well as n the non-monetary sense. We assume that the ISP (or any other nsurance agency) could have an estmate of ths rsk probablty va the answers to some general questons (e.g., the type of ant-vrus protecton one uses, the securty mndset of a user, and some basc general knowledge of Internet securty) t requres ts potental clents to answer before sgnng up for servce, and from the network topology. The network topology gves nformaton

16 16 about the node degrees, whch n turn helps determne the probablty of each user beng affected by threats. Apart from the probablty of facng rsk, the Internet users are assumed to be homogenous n terms of ther ntal wealth w and the sze R of rsk faced, where a rsk represents the negatve wealth accumulated by a user when t s affected by Internet threats. We assume that the potental rsk faced by an Internet user s less than ts ntal wealth w. Each user may buy at most one cyber-nsurance polcy from the nsurer by agreeng to pay a premum z for an nsurance coverage amount c. The cyber-nsurance company advertses only one contract to all ts customers. We assume that the level of coverage s not bgger than sze R of rsk. We also assume that the ntal wealth of a user, the sze of rsk, the cyber-nsurance premum, and the level of coverage have the same measurable unts. We also account for the fact that the system does not face the nformaton asymmetry problem. We apply a rsk-averse utlty functon U p (z,c) to Internet users, where U p (z,c) s defned as w pkr f t buys no nsurance U p (z,c) = w z pk(r c) f t buys nsurance, where K 1 s the degree 8 of rsk averson of a user, assumed to be the same for all users n the network. When K = 1, a user evaluates ts loss to be exactly R. When K > 1, the user adds an addtonal negatve utlty of (K 1)R for an dosyncratc pan due to facng the rsk. We assume that the cyber-nsurance agency s rsk-neutral,.e., t s only concerned wth ts expected profts. For an nsurance polcy (z,c) sold to a user, the contract s worth (1 p)z +p(z c) = z pc (17) to the nsurer. Thus, the overall expected proft made by the cyber-nsurance agency by provdng the same nsurance servce to ts entre geographcal localty s G(z,c) = Here, we use contract and polcy nterchangeably. 1 0 (z pc)dp (18) 2) Welfare Maxmzng Insurance: We now determne an optmal cyber-nsurance polcy,(z,c), a cyber-nsurance agency nterested n maxmzng socal welfare would provde to ts customers. We assume here that the nsurer values the welfare of each of ts customers equally and s not nclned to makng negatve proft. We also assume that a user can decde whether to buy the polcy or not, and that the nsurer also has the power to decde whether to provde nsurance to a customer, based on ts probablty of facng rsk. Problem Formulaton. Let the nsurer offer a contract (z, c). An Internet user facng a probablty of rsk, p, wll 8 The degree of rsk averson mentoned n ths paper could be any standard rsk averson measure such as the Arrow-Pratt rsk averson measure [33].

17 17 want to buy cyber-nsurance f U p (z,c) U p (0,0). Thus, the followng condton must hold for a user to buy cyber-nsurance w z pk(r c) w pkr (19) or, p z Kc = p L(z,c) (20) Therefore, a user buys nsurance only f ts rsk probablty s hgher than some lower bound p L. The lower bound s dependent on z,c, and K. We observe that for a fxed K, the lower the value of premum per unt coverage, the hgher s the ncentve for a user to buy cyber-nsurance. On the other hand, the cyber-nsurance agency may not allow every nterested user to buy nsurance. There exsts a partcular value, p H, of the probablty of rsk, for whch z = p H c. In such a case, the cyber-nsurance company breaks even and the resultng z s the far premum. The nsurance agency denes nsurance servce to users whose probablty of rsk s greater than p H. Thus, p H s the upper bound of the rsk probablty that a user requrng nsurance can afford f t wants to clam nsurance. A cyber-nsurer prmarly nterested n socal welfare advertses a contract(z,c) that maxmzes the total welfare of all Internet users n ts geographcal localty wthout t makng negatve profts. Formally, we frame our optmzaton problem as follows. argmax (z,c) TW = A+B +C subject to D, where A = ph p L [w z pk(r c)]dp, B = C = D = pl 0 1 (w pkr)dp, p H (w pkr)dp, ph p L (z pc)dp 0 A s the expected utlty of all Internet users whose rsk facng probablty, p, les n the nterval [p L,p H ]. B represents the expected utlty of users who have no ncentve to buy nsurance. The rsk probablty of these users les n the nterval [0,p L ]. C stands for the expected utlty of users who want to purchase cyber-nsurance, but

18 18 are dened by the nsurance agency. Ther rsk probabltes le n the nterval [p H,1]. Fnally, D represents the constrant of the optmzaton problem, whch states that the expected profts of the cyber-nsurer are non-negatve. Results. We state our results through a theorem. We note that the terms profts and total user welfare refer to the expected values of profts and socal welfare. Theorem 2. For a welfare-maxmzng cyber-nsurance contract, the optmal (premum, coverage) par s (R,R); the rsk probablty lower bound, p L, equals 1 K ; p H = 1; total user welfare, TW, s (w R 2K 1 2K ); and the nsurer proft, P, equals R (K 1)2 2K 2. Proof. We frst express the rsk probablty bounds, p L and p H, as functons of z,k, and c. In terms of z,k, and c, p L s equal to z Kc and p H equals z c. Integratng the left hand sde of constrant D n our optmzaton problem, we obtan the cyber-nsurer profts as c z 2 2 (K 1) 2 c 2 K 2. Snce the profts are always postve, the constrant D s not bndng on the optmzaton problem. Thus, our constraned optmzaton problem turns nto the followng unconstraned one. argmax (z,c) P Q+T S, where P = (R c z 1 )(K c K ), Q = 1 2 (R c)z2 c 2(K2 1 K ), T = w(1 z c + z Kc ), and S = 1 z2 KR(1 2 c 2 + z2 c 2 K 2) The frst partal dervatve of the objectve functon wth respect to c evaluates to z2 c 2, whch s a strctly nonnegatve quantty. Thus, the optmal value of the objectve functon les at the maxmum value c can assume,.e., R. Substtutng the optmal c n the objectve functon, we obtan a new unconstraned optmzaton problem of a sngle varable as follows. argmax z X Y Z, where X = (w R z c )z 1 (K c K ), Y = w K (K z (K 1)), c

19 19 and Z = R 2K (K2 ( z2 c 2)(K2 1)) The frst dervatve of the objectve functon evaluates to R z c (K 1) 2 K, whch s a strctly non-negatve quantty. Therefore, the optmal value of the objectve functon les at z = R, snce any premum greater than R s unfar to an nsurance customer and would reduce socal welfare. Usng substtuton, the optmal (premum, coverage) par, (R,R), leads to a p L value of 1 K, TW value of (w R2K 1 2K ), and an nsurer proft, P, equal to R(K 1)2 2K. 2 Theorem Implcatons: We nfer that the optmal nsurance coverage n a welfare maxmzng scenaro s full coverage. For K = 1 the lower bound of rsk facng probablty, p L, s 1, and a user buys full cyber-nsurance f t s sure to face a rsk, and n ths case the nsurer charges ts clent a far premum R,.e., probablty of facng rsk coverage (R) = R = premum charged. However, as the degree of rsk averseness of a user ncreases, the value of p L s less than one, and a user decdes to buy nsurance for rsks that occur wth probablty less than or equal to 1. Intutvely, ths result makes sense as more rsk averse users are more nclned to buy cyber-nsurance even for rsks that do not occur wth probablty (w.p) 1. However, for K > 1, the nsurer charges an unfar premum R,.e., probablty of facng rsk coverage (R) < R = premum charged, to users who face rsks that occur w.p < 1, and charges a far premum to users who are sure to face rsk. Thus, the cyber-nsurance agency de-ncentvzes hgher rsk-averse users to buy nsurance when they do not face rsk for sure, to prevent tself from makng negatve profts. The profts made by the nsurance company also ncrease wth ncrease n K, and ths s true as more users buy cyber-nsurance,.e, p L value decreases wth ncrease n K. However, the total user welfare decreases wth ncrease n ts degree of rsk averseness. Ths s due to the fact that our utlty functon for each user s wealth based and a user loses more of ts ntal wealth wth ncrease n ts rsk averseness. We emphasze here that the total user welfare s calculated by mplctly takng nto account ntal precautonary nvestments of a user. After a contract s sgned between the cyber-nsurer and ts clent, a user can decde on ts optmal self-defense nvestments and evaluate a dfferent utlty functon for welfare [23]. B. Proft Maxmzng Insurance In ths secton, we determne the optmal cyber-nsurance polcy, (z, c), a cyber-nsurance agency solely nterested n maxmzng profts (a monopolst) would provde to ts customers. Smlar to Secton V-A2, we assume that a user can decde whether to buy the polcy or not, and that the nsurer also has the power to decde whether to provde nsurance to a customer based on ts probablty of facng rsk. Problem Formulaton. A cyber-nsurer prmarly nterested n makng busness profts chooses a contract (z, c) that maxmzes ts total proft over all users t servces. Formally, we frame our unconstraned optmzaton problem

20 20 as follows. argmax (z,c) ph p L (z pc)dp, subject to A+B +C 0, where A = ph p L [w z pk(r c)]dp, B = C = pl 0 1 (w pkr)dp, p H (w pkr)dp, where p L and p H are defned as above. Results. We state our result through the followng theorem. Theorem 3. For a proft-maxmzng nsurance contract, the optmal (premum, coverage) par s (R K2 2K 1,R); p L = K 2K 1 ; p H = 1; and the nsurer proft, P, equals R (K 1)2 2(2K 1). Proof. Evaluatng the ntegrand n the objectve functon, we determne the expresson for overall proft as P = c[ z c [mn{z c,1} z ck ] 1 2 [({mnz c,1})2 ( z2 c 2 K 2)]] We observe that the expresson s ncreasng n c. Thus, the cyber-nsurer maxmzes ts proft by settng c equal to R. When the premum per unt of coverage s less than 1, the expected overall proft s c z2 (K 1) 2 c 2 2K 2, whch s ncreasng n z c. The ncrease n total proft s due to () ncrease n sales, whch arses due to the ncrease n the range of nsured ndvduals,.e., the dfference n the range s p H p L = z c z Kc = z c K 1 K, whch ncreases wth ncreasng premum per unt of coverage, z c, and () the mean rsk probablty also ncreasng wth the premum per unt of coverage,.e., p H p L pdp = z2 K 2 1 c 2 2K, whch ncreases wth z 2 c. When the premum per unt of coverage s greater than 1 and c = R, the optmal premum s determned by equatng the partal frst dervatve of P to 0,.e., P (PPUC) = z K [K 2 z K2 2 c (2K 1)] = 0, whch results n a premum z equal to R2K 1, where PPUC s the premum per unt of coverage. The nsurer profts when PPUC s less than 1 s R (K 1)2 2K, and equals R (K 1)2 2 2(2K 1) when PPUC 1. Snce K 2 > 2K 1 for all KǫR, the cyber-nsurer profts are maxmzed for PPUC 1. Substtutng the values of z and c, we get the lower bound of rsk probablty as K 2K 1. Theorem Implcatons: We observe that full nsurance coverage s the optmal nsurance coverage n case of a proft maxmzng scenaro. Apart from the case when K = 1, n all other cases of K, the nsurer charges an unfar premum to ts clent for a reason smlar to that mentoned n the mplcatons of Theorem 2. Takng the lmt