Knowledge sharing and investment decisions in information security

Authors:
Dengpan Liu;Yonghua Ji;Vijay Mookerjee
Affiliations:
College of Business Administration, University of Alabama in Huntsville, United States;School of Business, University of Alberta, Canada;School of Management, University of Texas at Dallas, United States
Venue:
Decision Support Systems
Year:
2011

Citing 6
Cited 2

The Economic Incentives for Sharing Security Information

Information Systems Research
Evaluating information assurance strategies

Decision Support Systems
Network Software Security and User Incentives

Management Science
Network externalities, layered protection and IT security risk management

Decision Support Systems
E-commerce security threats: awareness, trust and practice

International Journal of Information Systems and Change Management
Information assurance metric development framework for electronic bill presentment and payment systems using transaction and workflow analysis

Decision Support Systems

A move in the security measurement stalemate: elo-style ratings to quantify vulnerability

Proceedings of the 2012 workshop on New security paradigms
Information security - Professional perceptions of knowledge-sharing intention under self-efficacy, trust, reciprocity, and shared-language

Computers & Education

Quantified Score

Hi-index	0.00

Visualization

Abstract

We study the relationship between decisions made by two similar firms pertaining to knowledge sharing and investment in information security. The analysis shows that the nature of information assets possessed by the two firms, either complementary or substitutable, plays a crucial role in influencing these decisions. In the complementary case, we show that the firms have a natural incentive to share security knowledge and no external influence to induce sharing is needed. However, the investment levels chosen in equilibrium are lower than optimal, an aberration that can be corrected using coordination mechanisms that reward the firms for increasing their investment levels. In the substitutable case, the firms fall into a Prisoners' Dilemma trap where they do not share security knowledge in equilibrium, despite the fact that it is beneficial for both of them to do so. Here, the beneficial role of a social planner to encourage the firms to share is indicated. However, even when the firms share in accordance to the recommendations of a social planner, the level of investment chosen by the firms is sub-optimal. The firms either enter into an ''arms race'' where they over-invest or reenact the under-investment behavior found in the complementary case. Once again, this sub-optimal behavior can be corrected using incentive mechanisms that penalize for over-investment and reward for increasing the investment level in regions of under-investment. The proposed coordination schemes, with some modifications, achieve the socially optimal outcome even when the firms are risk-averse. Implications for information security vendors, firms, and social planner are discussed.