Economic Incentives for Cybersecurity: Using Economics to Design Technologies Ready for Deployment

Abstract

Cybersecurity practice lags behind cyber technology achievements. Solutions designed to address many problems may and do exist but frequently cannot be broadly deployed due to economic constraints. Whereas security economics focuses on the cost/benefit analysis and supply/demand, we believe that more sophisticated theoretical approaches, such as economic modeling, rarely utilized, would derive greater societal benefits. Unfortunately, today technologists pursuing interesting and elegant solutions have little knowledge of the feasibility for broad deployment of their results and cannot anticipate the influences of other technologies, existing infrastructure, and technology evolution, nor bring the solutions lifecycle into the equation. Additionally, potentially viable solutions are not adopted because the risk perceptions by potential providers and users far outweighs the economic incentives to support introduction/adoption of new best practices and technologies that are not well enough defined. In some cases, there is no alignment with predominant and future business models as well as regulatory and policy requirements.This paper provides an overview of the economics of security, reviewing work that helped to define economic models for the Internet economy from the 1990s. We bring forward examples of potential use of theoretical economics in defining metrics for emerging technology areas, positioning infrastructure investment, and building real-time response capability as part of software development. These diverse examples help us understand the gaps in current research. Filling these gaps will be instrumental for defining viable economic incentives, economic policies, regulations as well as early-stage technology development approaches, that can speed up commercialization and deployment of new technologies in cybersecurity.

Cybersecurity threat intelligence knowledge exchange based on blockchain

“…On the other hand, unsuccessful voluntary sharing has several and different root causes. Several studies have been analyzing why people is often reluctant to share [2][3][4][5][6][7].…”

“…Visik et al [3], characterize the main reasons about why people is reluctant to share information, if there are not enough incentives for them. Authors suggest that users do not have the same knowledge about the value of artifacts offered, or simply they do not want to share their own data or incidents, as they could be giving a competitive advantage to their own competitors.…”

“…There are multiple benefits of information exchange in cybersecurity, like threat prevention and detection, between others. On the other hand, there are also several unsuccessful voluntary sharing initiatives, which have been studied by multiple authors [2][3][4][5][6][7]. A summary of all the following problems can be seen in the Table 1.…”

Risk Assessment For Industrial Control Systems Quantifying Availability Using Mean Failure Cost (MFC)

“…In [35], the concept of Mean Failure Cost (MFC) was first introduced. The concept was refined through a series of applications [21,36,37] and has been applied to several domains which include mission assurance [38,39], failure impact analysis in Advanced Metering Infrastructure (AMI) [40,41], risk assessment [42,43], game theoretic simulation [40,44], cybersecurity modeling in the cloud [45], and SCADA environments [46,47]. This value-based metric (MFC), when applied quantifies the security of a computing system by the statistical mean of the random variable that represents for each stakeholder, the amount of loss that results from security threats and system vulnerabilities.…”

Quantifying the impact of unavailability in cyber-physical environments

“…The concept was refined through a series of applications [20,30,31] and has been applied to several domains which include mission assurance [32,33], failure impact analysis in Advanced Metering Infrastructure (AMI) [34,35], risk assessment [36], game theoretic simulation [34,37], cybersecurity modeling in the cloud [38] and SCADA environments [39]. This value-based metric, MFC, when applied quantifies the security of a computing system by the statistical mean of the random variable that represents for each stakeholder, the amount of loss resulting from security threats and system vulnerabilities.…”