When Hackers Talk: Managing Information Security Under Variable Attack Rates and Knowledge Dissemination

Authors:
Vijay Mookerjee;Radha Mookerjee;Alain Bensoussan;Wei T. Yue
Affiliations:
School of Management, The University of Texas at Dallas, Richardson, Texas 75083;School of Management, The University of Texas at Dallas, Richardson, Texas 75083;School of Management, The University of Texas at Dallas, Richardson, Texas 75083;City University of Hong Kong, Kowloon Tong, Hong Kong, People's Republic of China
Venue:
Information Systems Research
Year:
2011

Citing 11
Cited 0

Windows of Vulnerability: A Case Study Analysis

Computer
Hacking Exposed: Network Security Secrets and Solutions, Fourth Edition

Hacking Exposed: Network Security Secrets and Solutions, Fourth Edition
A Decision Analysis Method for Evaluating Computer Intrusion Detection Systems

Decision Analysis
Adversarial classification

Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining
Convergence

Information Security Tech. Report
Using Attack Graphs to Design Systems

IEEE Security and Privacy
Intrusion Prevention in Information Systems: Reactive and Proactive Responses

Journal of Management Information Systems
Optimal Policy for Software Vulnerability Disclosure

Management Science
Maintaining Diagnostic Knowledge-Based Systems: A Control-Theoretic Approach

Management Science
Configuration of and Interaction Between Information Security Technologies: The Case of Firewalls and Intrusion Detection Systems

Information Systems Research
Induction over Strategic Agents

Information Systems Research

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper analyzes interactions between a firm that seeks to discriminate between normal users and hackers that try to penetrate and compromise the firm's information assets. We develop an analytical model in which a variety of factors are balanced to best manage the detection component within information security management. The approach not only considers conventional factors such as detection rate and false-positive rate, but also factors associated with hacker behavior that occur in response to improvements in the detection system made by the firm. Detection can be improved by increasing the system's discrimination ability (i.e., the ability to distinguish between attacks and normal usage) through the application of maintenance effort. The discrimination ability deteriorates over time due to changes in the environment. Also, there is the possibility of sudden shocks that can sharply degrade the discrimination ability. The firm's cost increases as hackers become more knowledgeable by disseminating security knowledge within the hacker population. The problem is solved to reveal the presence of a steady-state solution in which the level of system discrimination ability and maintenance effort are held constant. We find an interesting result where, under certain conditions, hackers do not benefit from disseminating security knowledge among one another. In other situations, we find that hackers benefit because the firm must lower its detection rate in the presence of knowledge dissemination. Other insights into managing detection systems are provided. For example, the presence of security shocks can increase or decrease the optimal discrimination level as compared to the optimal level without shocks.