Though the choices of terrorists' attack targets are vast, their resources are limited. In this paper, a game-theoretical model is proposed to study both the defender's (government) and the attacker's (terrorist) expenditures among multiple targets under budget constraints to guide investment in defense. We study how the defender's and the attacker's equilibrium allocations depend on the budget constraints, target valuations, cost effectiveness of their investments, and inherent defense levels of targets in both sequential-move and simultaneous-move games. The equilibrium solutions are provided using the Karush-Kuhn-Tucker conditions. At the subgame-perfect Nash equilibrium, the defender's total marginal effects are the same among targets. Moreover, the defender's total marginal effects can be decomposed into direct and indirect effects. We also use the multiple-infrastructure and multiple-urban-area data sets to demonstrate the model results. The regression analysis shows that both the attacker's and the defender's equilibrium investments increase with their own target valuations, because a higher valuation for themselves means a higher attractiveness. Interestingly, the attacker's equilibrium investment is negatively correlated with the defender's target valuations, since a higher defender's valuation would make it more difficult for the attacker to successfully attack the target. By contrast, the defender's equilibrium investment is positively correlated with the attacker's target valuations, as a higher attacker's valuations would increase the urgency for the defender to protect the target. To show the utility of the new model, we compare the results of this model and the model in which the defender assumes that only a single target will be attacked when there could actually be multiple targets attacked. Our results show that the defender will suffer higher expected losses if she assumes that the attacker will attack only one target. The analysis of the attacker's and the defender's budget constraints show that (a) the higher the budget the defender has, the less likely it is that her most valuable target will be attacked; (b) a higher proportion of defense resources should be allocated to the most valuable target if the defender's budget is low; and (c) the attacker is less concentrated on attacking the most valuable target and spreads the resources to attack more targets as his budget increases.

The government, private sectors, and others users of the Internet are increasingly faced with the risk of cyber incidents. Damage to computer systems and theft of sensitive data caused by cyber attacks have the potential to result in lasting harm to entities under attack, or to society as a whole. The effects of cyber attacks are not always obvious, and detecting them is not a simple proposition. As the U.S. federal government believes that information sharing on cybersecurity issues among organizations is essential to safety, security, and resilience, the importance of trusted information exchange has been emphasized to support public and private decision making by encouraging the creation of the Information Sharing and Analysis Center (ISAC). Through a decision-theoretic approach, this article provides new perspectives on ISAC, and the advent of the new Information Sharing and Analysis Organizations (ISAOs), which are intended to provide similar benefits to organizations that cannot fit easily into the ISAC structure. To help understand the processes of information sharing against cyber threats, this article illustrates 15 representative information sharing structures between ISAC, government, and other participating entities, and provide discussions on the strategic interactions between different stakeholders. This article also identifies the costs of information sharing and information security borne by different parties in this public-private partnership both before and after cyber attacks, as well as the two main benefits. This article provides perspectives on the mechanism of information sharing and some detailed cost-benefit analysis.

The United States is funding homeland security programs with a large budget (e.g., 74.4 billion for FY 2019). A number of game‐theoretic defender–attacker models have been developed to study the optimal defense resource allocation strategies for the government (defender) against the strategic adversary (attacker). However, to the best of our knowledge, the substitution or complementary effects between different types of defensive resources (e.g., human resource, land resource, and capital resource) have not been taken into consideration even though they exist in practice. The article fills this gap by studying a sequential game‐theoretical resource allocation model and then exploring how the joint effectiveness of multiple security investments influences the defensive budget allocation among multiple potential targets. Three false belief models have been developed in which only the defender, only the attacker, and both the defender and attacker hold false beliefs about the joint effectiveness of resources. Regression analysis shows that there are significant substitution effects between human and capital resources. The results show that the defender will suffer a higher loss if he fails to consider the substitution or complementary effects. Interestingly, if the attacker holds a false belief while the defender does not, the defender will suffer an even higher loss, especially when the resources are substitutes. However, if both the attacker and defender hold false beliefs, there will be lower loss when resources are complementary. The results also show that the defender should allocate the highly effective resource when the resources substitute each other. This article provides some new insights to the homeland security resource allocation.