How To Understand Network Security
|
|
|
- Camilla Charles
- 5 years ago
- Views:
Transcription
1 Network Security: an Economic Perspective Marc Lelarge (INRIA-ENS) currently visiting STANFORD TRUST seminar, Berkeley 2011.
2 Threats and Vulnerabilities Attacks are exogenous
3 Contribution (1) Optimal security investment for a single agent - Gordon and Loeb model, 1/e rule - Monotone comparative statics (2) Optimal security investment for an interconnected agent - Network externalities (3) Equilibrium analysis of the security game - Free-rider problem, Critical mass, PoA
4 (1) Single agent Two parameters: Potential monetary loss: Probability of security breach without additional security: Agent can invest loss to: Optimal investment: to reduce the probability of
5 (1) Gordon and Loeb Class of security breach probability functions: measure of the productivity of security. Gordon and Loeb (2002)
6 (1) Gordon and Loeb (cont.) Optimal investment (size of potential loss fixed) vulnerability
7 (1) Gordon and Loeb (cont.) Probability of loss for a given investment
8 (1) Gordon and Loeb (cont.) Low vulnerability High vulnerability
9 (1) Conditions for monotone investment If then is non-decreasing Augmenting return of investment with vulnerability: Extension to submodular functions.
10 (1) The 1/e rule If the function is log-convex in x then the optimal security investment is bounded by:,i.e of the expected loss
11 Contribution (1) Optimal security investment for a single agent - Gordon and Loeb model, 1/e rule - Monotone comparative statics (2) Optimal security investment for an interconnected agent - Network externalities (3) Equilibrium analysis of the security game - Free-rider problem, Critical mass, PoA
12 (2) Effect of the network Agent faces an internal risk and an indirect risk. Information available to the agent: poset (partially ordered set). Optimal security investment: in a
13 (2) How to estimate the probability of loss? Epidemic risk model Binary choice for protection Limited information on the network of contagion (physical or not): degree distribution. Best guess: take a graph uniformly at random. Galeotti et al. (2010)
14 (2) Epidemic Model N S Attacker Attacker directly infects an agent N with prob. p. Each neighbor is contaminated with prob. q if in S or if in N.
15 (2) Monotone comparative statics If the function is strictly decreasing in investment Equivalent to: for any then the optimal is non-decreasing. Network externalities function is decreasing:
16 (2) Strong protection An agent investing in S cannot be harmed by the actions of others:. in previous equation. Decreasing network externalities function.
17 (2) Weak protection If, the network externalities function is:
18 Contribution (1) Optimal security investment for a single agent - Gordon and Loeb model, 1/e rule - Monotone comparative statics (2) Optimal security investment for an interconnected agent - Network externalities (3) Equilibrium analysis of the security game - Free-rider problem, Critical mass, PoA
19 (3) Fulfilled expectations equilibrium Concept introduced by Katz & Shapiro (85) Willingness to pay for the agent of type : multiplicative specification of network externalities, Economides & Himmelberg (95). C.d.f of types: % with Willingness to pay for the last agent:
20 (3) Fulfilled expectations equilibrium In equilibrium, expectation are fulfilled: The willingness to pay is: Extension of Interdependent Security 2 players game introduced by Kunreuther & Heal (03).
21 (3) Critical mass Equilibria given by the fixed point equation
22 (3) Critical mass (cont.) Equilibria given by the fixed point equation cost fraction of population investing in security
23 (3) Critical mass (cont.) If only one type: willingness to pay = network externalities function. cost fraction of population investing in security
24 (3) Price of Anarchy The social welfare function: Private externalities Public externalities Because of the public and private externalities, agent under-invest in security (in all cases).
25 Conclusion Simple single agent model: 1/e rule General conditions for monotone investment Interconnected agents: network externalities function General conditions to align incentives Equilibrium analysis of the security game Critical mass, PoA Extensions: In this talk, agent is risk-neutral. What happens if risk-adverse? Insurance?
26 Thank you! Feedbacks are welcome:
Coordination in Network Security Games
Coordination in Network Security Games Marc Lelarge INRIA - ENS Paris, France Email: [email protected] Abstract Malicious softwares or malwares for short have become a major security threat. While originating
Individual security and network design
Individual security and network design Diego Cerdeiro Marcin Dziubiński Sanjeev Goyal FIT 2015 Motivation Networks often face external threats in form of strategic or random attacks The attacks can be
Economic Incentives to Increase Security in the Internet: The Case for Insurance
Economic Incentives to Increase Security in the Internet: The Case for Insurance Marc Lelarge INRIA-ENS France Email: [email protected] Jean Bolot SPRINT USA Email: [email protected] Abstract Entities
Voluntary Participation in Cyber-insurance Markets
Voluntary Participation in Cyber-insurance Markets Parinaz aghizadeh and Mingyan Liu Abstract The study of cyber-insurance, both as a method for transferring residual cyber-security risks, and as an incentive
Modeling Internet Security Investments Tackling Topological Information Uncertainty
Modeling Internet Security Investments Tackling Topological Information Uncertainty Ranjan Pal Department of Computer Science University of Southern California, USA Joint Work with Pan Hui Deutsch Telekom
Voluntary Participation in Cyber-insurance Markets
1 Voluntary Participation in Cyber-insurance Markets Parinaz aghizadeh, Mingyan Liu Department of Electrical Engineering and Computer Science University of Michigan, Ann Arbor, Michigan, 4819-1 Email:
Unraveling versus Unraveling: A Memo on Competitive Equilibriums and Trade in Insurance Markets
Unraveling versus Unraveling: A Memo on Competitive Equilibriums and Trade in Insurance Markets Nathaniel Hendren January, 2014 Abstract Both Akerlof (1970) and Rothschild and Stiglitz (1976) show that
Role of Network Topology in Cybersecurity
Role of Network Topology in Cybersecurity Richard J. La Abstract We study how an underlying network property affects network security when nodes are rational and have four choices i) invest in protection,
When Information Improves Information Security
When Information Improves Information Security (Short paper) Jens Grossklags a, Benjamin Johnson b, and Nicolas Christin b a Center for Information Technology Policy, Princeton University b CyLab, Carnegie
Econ 430 Lecture 9: Games on Networks
Alper Duman Izmir University Economics, May 10, 2013 Semi-Anonymous Graphical Games refer to games on networks in which agents observe what their neighbours do The number of agents taking a specific action
Network Security A Decision and Game-Theoretic Approach
Network Security A Decision and Game-Theoretic Approach Tansu Alpcan Deutsche Telekom Laboratories, Technical University of Berlin, Germany and Tamer Ba ar University of Illinois at Urbana-Champaign, USA
Computational Game Theory and Clustering
Computational Game Theory and Clustering Martin Hoefer [email protected] 1 Computational Game Theory? 2 Complexity and Computation of Equilibrium 3 Bounding Inefficiencies 4 Conclusion Computational
Sharing Information on Computer Systems Security: An Economic Analysis
Sharing Information on Computer Systems Security: An Economic Analysis Lawrence A. Gordon Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance The Robert H. Smith School of
Microeconomic Theory Jamison / Kohlberg / Avery Problem Set 4 Solutions Spring 2012. (a) LEFT CENTER RIGHT TOP 8, 5 0, 0 6, 3 BOTTOM 0, 0 7, 6 6, 3
Microeconomic Theory Jamison / Kohlberg / Avery Problem Set 4 Solutions Spring 2012 1. Subgame Perfect Equilibrium and Dominance (a) LEFT CENTER RIGHT TOP 8, 5 0, 0 6, 3 BOTTOM 0, 0 7, 6 6, 3 Highlighting
1. Write the number of the left-hand item next to the item on the right that corresponds to it.
1. Write the number of the left-hand item next to the item on the right that corresponds to it. 1. Stanford prison experiment 2. Friendster 3. neuron 4. router 5. tipping 6. small worlds 7. job-hunting
How To Play A Static Bayesian Game
Advanced Microeconomics Static Bayesian games Harald Wiese University of Leipzig Harald Wiese (University of Leipzig) Advanced Microeconomics / 7 Part E. Bayesian games and mechanism design Static Bayesian
INVESTING IN CYBERSECURITY:
INVESTING IN CYBERSECURITY: Insights from the Gordon-Loeb Model Lawrence A. Gordon EY Alumni Professor of Managerial Accounting & Information Assurance Affiliate Professor in University of Maryland Institute
Security Audits Revisited
Security Audits Revisited Rainer Böhme Department of Information Systems, University of Münster, Germany [email protected] Abstract. Security audits with subsequent certification appear to
Competitive Cyber-Insurance and Internet Security
Competitive Cyber-Insurance and Internet Security Nikhil Shetty Galina Schwartz Mark Felegyhazi Jean Walrand {nikhils@eecs, schwartz@eecs, mark@icsi, wlr@eecs}.berkeley.edu Abstract This paper investigates
Incentives for Improving Cybersecurity in the Private Sector: A Cost-Benefit Perspective
Incentives for Improving Cybersecurity in the Private Sector: A Cost-Benefit Perspective Testimony for the House Committee on Homeland Security s Subcommittee on Emerging Threats, Cybersecurity, and Science
Vulnerability Assessment. U.S. Food Defense Team
Vulnerability Assessment U.S. Food Defense Team Vulnerability A weakness in a processing, handling or storage facility or operation that would allow for intentional contamination of a food product Vulnerability
Economics of Insurance
Economics of Insurance In this last lecture, we cover most topics of Economics of Information within a single application. Through this, you will see how the differential informational assumptions allow
QUANTITATIVE MODEL FOR INFORMATION SECURITY RISK MANAGEMENT
QUANTITATIVE MODEL FOR INFORMATION SECURITY RISK MANAGEMENT Rok Bojanc ZZI d.o.o. [email protected] Abstract: The paper presents a mathematical model to improve our knowledge of information security and
Rural and Agricultural Finance. Day 1: Block 1 What and Why of Rural Finance?
Rural and Agricultural Finance Day 1: Block 1 What and Why of Rural Finance? Self Introduction 7 Questions 1. Name, institution, and current job title. 2. What activity are you working on now that is related
Marginal cost. Average cost. Marginal revenue 10 20 40
Economics 101 Fall 2011 Homework #6 Due: 12/13/2010 in lecture Directions: The homework will be collected in a box before the lecture. Please place your name, TA name and section number on top of the homework
Summary of Doctoral Dissertation: Voluntary Participation Games in Public Good Mechanisms: Coalitional Deviations and Efficiency
Summary of Doctoral Dissertation: Voluntary Participation Games in Public Good Mechanisms: Coalitional Deviations and Efficiency Ryusuke Shinohara 1. Motivation The purpose of this dissertation is to examine
e-book Platform Competition in the Presence of Two-Sided Network Externalities
2012 45th Hawaii International Conference on System Sciences e-book Platform Competition in the Presence of Two-Sided Network Externalities Yabing Jiang Graduate School of Business Administration Fordham
Midterm March 2015. (a) Consumer i s budget constraint is. c i 0 12 + b i c i H 12 (1 + r)b i c i L 12 (1 + r)b i ;
Masters in Economics-UC3M Microeconomics II Midterm March 015 Exercise 1. In an economy that extends over two periods, today and tomorrow, there are two consumers, A and B; and a single perishable good,
Modeling Insurance Markets
Modeling Insurance Markets Nathaniel Hendren Harvard April, 2015 Nathaniel Hendren (Harvard) Insurance April, 2015 1 / 29 Modeling Competition Insurance Markets is Tough There is no well-agreed upon model
Not Only What But also When: A Theory of Dynamic Voluntary Disclosure
Not Only What But also When: A Theory of Dynamic Voluntary Disclosure Ilan Guttman, Ilan Kremer, and Andrzej Skrzypacz Stanford Graduate School of Business September 2012 Abstract The extant theoretical
Introduction to Probability
Introduction to Probability EE 179, Lecture 15, Handout #24 Probability theory gives a mathematical characterization for experiments with random outcomes. coin toss life of lightbulb binary data sequence
Does One Soros Make a Difference? A Theory of Currency Crises with Large and Small Traders
Review of Economic Studies (2004 71, 87 113 0034-6527/04/00050087$02.00 c 2004 The Review of Economic Studies Limited Does One Soros Make a Difference? A Theory of Currency Crises with Large and Small
A Simple Model of Price Dispersion *
Federal Reserve Bank of Dallas Globalization and Monetary Policy Institute Working Paper No. 112 http://www.dallasfed.org/assets/documents/institute/wpapers/2012/0112.pdf A Simple Model of Price Dispersion
ECO 199 GAMES OF STRATEGY Spring Term 2004 March 23 ADVERSE SELECTION SCREENING AND SIGNALING. EXAMPLE 1 FAILURE OF EQUILIBRIUM Akerlof s Lemons
ECO 199 GAMES OF STRATEGY Spring Term 2004 March 23 ADVERSE SELECTION SCREENING AND SIGNALING EXAMPLE 1 FAILURE OF EQUILIBRIUM Akerlof s Lemons Private used car market Car may be worth anywhere between
Lecture 11: The Design of Trading Platforms (Alos-Ferrer et al. 2010)
Lecture 11: The Design of Trading Platforms (Alos-Ferrer et al. 2010) 1. Introduction Lecture 10: selection between exogenously given market institutions now: emergence of new institutions 2 possibilities
ECON 40050 Game Theory Exam 1 - Answer Key. 4) All exams must be turned in by 1:45 pm. No extensions will be granted.
1 ECON 40050 Game Theory Exam 1 - Answer Key Instructions: 1) You may use a pen or pencil, a hand-held nonprogrammable calculator, and a ruler. No other materials may be at or near your desk. Books, coats,
The Max-Distance Network Creation Game on General Host Graphs
The Max-Distance Network Creation Game on General Host Graphs 13 Luglio 2012 Introduction Network Creation Games are games that model the formation of large-scale networks governed by autonomous agents.
COS 116 The Computational Universe Laboratory 9: Virus and Worm Propagation in Networks
COS 116 The Computational Universe Laboratory 9: Virus and Worm Propagation in Networks You learned in lecture about computer viruses and worms. In this lab you will study virus propagation at the quantitative
Business Continuity & Disaster Recovery
Business Continuity & Disaster Recovery Safety First Quality Every Time 1 Business Continuity & Disaster Recovery Planning Who here has a formal Business Continuity & Disaster Recovery plan? The purpose
Liquidity Cycles and Make/Take Fees in Electronic Markets
Liquidity Cycles and Make/Take Fees in Electronic Markets Thierry Foucault (HEC, Paris) Ohad Kadan (Washington U) Eugene Kandel (Hebrew U) April 2011 Thierry, Ohad, and Eugene () Liquidity Cycles & Make/Take
Behavioural Economics: Introduction to Behavioral Game Theory and Game Experiments. University of Oxford, Michaelmas Term 2013.
Behavioural Economics: Introduction to Behavioral Game Theory and Game Experiments University of Oxford, Michaelmas Term 2013 and Asia Summer Institute in Behavioral Economics National University of Singapore,
Chapter 11. Market-Clearing Models of the Business Cycle
Chapter 11 Market-Clearing Models of the Business Cycle Goal of This Chapter In this chapter, we study three models of business cycle, which were each developed as explicit equilibrium (market-clearing)
Part IV. Pricing strategies and market segmentation
Part IV. Pricing strategies and market segmentation Chapter 9. Menu pricing Slides Industrial Organization: Markets and Strategies Paul Belleflamme and Martin Peitz Cambridge University Press 2010 Chapter
Information in Mechanism Design
Dirk Bergemann and Juuso Valimaki Econometric Society World Congress August 2005 Mechanism Design Economic agents have private information that is relevant for a social allocation problem. Information
2. Information Economics
2. Information Economics In General Equilibrium Theory all agents had full information regarding any variable of interest (prices, commodities, state of nature, cost function, preferences, etc.) In many
NATIONAL STRATEGY FOR GLOBAL SUPPLY CHAIN SECURITY
NATIONAL STRATEGY FOR GLOBAL SUPPLY CHAIN SECURITY JANUARY 2012 Table of Contents Executive Summary 1 Introduction 2 Our Strategic Goals 2 Our Strategic Approach 3 The Path Forward 5 Conclusion 6 Executive
How To Perform An External Security Vulnerability Assessment Of An External Computer System
External Vulnerability Assessment -Executive Summary- Prepared for: ABC ORGANIZATION On March 9, 2008 Prepared by: AOS Security Solutions 1 of 5 Table of Contents Executive Summary... 3 Immediate Focus
System Dynamics Modelling using Vensim
System Dynamics Modelling using Vensim 3 December 2015 Prof Mikhail Prokopenko System: structure http://imgbuddy.com/fish-swarms.asp System: behaviour System: interconnectivity http://pivotpoint.io/en-us/article/the-interconnectivity-of-social-business#.vzta9uywcyw
CPC/CPA Hybrid Bidding in a Second Price Auction
CPC/CPA Hybrid Bidding in a Second Price Auction Benjamin Edelman Hoan Soo Lee Working Paper 09-074 Copyright 2008 by Benjamin Edelman and Hoan Soo Lee Working papers are in draft form. This working paper
IMPROVING NETWORK SECURITY THROUGH CYBER-INSURANCE. Ranjan Pal
IMPROVING NETWORK SECURITY THROUGH CYBER-INSURANCE by Ranjan Pal A Dissertation Presented to the FACULTY OF THE USC GRADUATE SCHOOL UNIVERSITY OF SOUTHERN CALIFORNIA In Partial Fulfillment of the Requirements
Richard Schmidtke: Private Provision of a Complementary Public Good
Richard Schmidtke: Private Provision of a Complementary Public Good Munich Discussion Paper No. 2006-20 Department of Economics University of Munich Volkswirtschaftliche Fakultät Ludwig-Maximilians-Universität
Let the Pirates Patch? An Economic Analysis of Network Software Security Patch Restrictions
Let the Pirates Patch? An Economic Analysis of Network Software Security Patch Restrictions Terrence August and Tunay I. Tunca Graduate School of Business, Stanford University Stanford, CA, 94305 Extended
Work incentives and household insurance: Sequential contracting with altruistic individuals and moral hazard
Work incentives and household insurance: Sequential contracting with altruistic individuals and moral hazard Cécile Aubert Abstract Two agents sequentially contracts with different principals under moral
Knowledge Transfer and Partial Equity Ownership
Knowledge Transfer and Partial Equity Ownership Arghya Ghosh and Hodaka Morita School of Economics, UNSW Business School University of New South Wales 2nd ATE Symposium, UNSW, December 2014 Introduction
The Four-Step Guide to Understanding Cyber Risk
Lifecycle Solutions & Services The Four-Step Guide to Understanding Cyber Risk Identifying Cyber Risks and Addressing the Cyber Security Gap TABLE OF CONTENTS Introduction: A Real Danger It is estimated
21. Unverifiable Investment, Hold Up, Options and Ownership
21. Unverifiable Investment, Hold Up, Options and Ownership This chapter applies the tools of games with joint decisions and negotiation equilibrium to study the hold up problem in economics. We first
Cybersecurity Awareness. Part 1
Part 1 Objectives Discuss the Evolution of Data Security Define and Discuss Cybersecurity Review Threat Environment Part 1 Discuss Information Security Programs s Enhancements for Cybersecurity Risks Threat
Two Papers on Internet Connectivity and Quality. Abstract
Two Papers on Internet Connectivity and Quality ROBERTO ROSON Dipartimento di Scienze Economiche, Università Ca Foscari di Venezia, Venice, Italy. Abstract I review two papers, addressing the issue of
Alok Gupta. Dmitry Zhdanov
RESEARCH ARTICLE GROWTH AND SUSTAINABILITY OF MANAGED SECURITY SERVICES NETWORKS: AN ECONOMIC PERSPECTIVE Alok Gupta Department of Information and Decision Sciences, Carlson School of Management, University
Cooperation with Network Monitoring
Cooperation with Network Monitoring Alexander Wolitzky Microsoft Research and Stanford University July 20 Abstract This paper studies the maximum level of cooperation that can be sustained in sequential
The Impact of Commercial Open Source Software on Proprietary Software Producers and Social Welfare
Journal of Industrial Engineering and Management JIEM, 2014 7(5): 1183-1196 Online ISSN: 2013-0953 Print ISSN: 2013-8423 http://dx.doi.org/10.3926/jiem.1260 The Impact of Commercial Open Source Software
Patent Litigation with Endogenous Disputes
Patent itigation with Endogenous Disputes Presentation at the AEA Annual Meeting January 6, 006 Session: Intellectual Property, itigation, and Innovation By James Bessen and Michael J. Meurer James Bessen
Competition and Fraud in Online Advertising Markets
Competition and Fraud in Online Advertising Markets Bob Mungamuru 1 and Stephen Weis 2 1 Stanford University, Stanford, CA, USA 94305 2 Google Inc., Mountain View, CA, USA 94043 Abstract. An economic model
Paul Belleflamme, CORE & LSM, UCL
International Workshop on Supply Chain Models for Shared Resource Management Managing inter- and intra-group externalities on two-sided platforms Paul Belleflamme, CORE & LSM, UCL 22/01/2010 FUSL, Brussels