Security Patch Management: Share the Burden or Share the Damage?

Abstract

Patch management is a crucial component of information security management. An important problem within this context from a vendor's perspective is to determine how to release patches to fix vulnerabilities in its software. From a firm's perspective, the issue is how to update vulnerable systems with available patches. In this paper, we develop a game-theoretic model to study the strategic interaction between a vendor and a firm in balancing the costs and benefits of patch management. Our objective is to examine the consequences of time-driven release and update policies. We first study a centralized system in a benchmark scenario to find the socially optimal time-driven patch management. We show that the social loss is minimized when patch-release and update cycles are synchronized. Next, we consider a decentralized system in which the vendor determines its patch-release policy and the firm selects its patch-update policy in a Stackelberg framework, assuming that release and update policies are either time driven or event driven. We develop a sufficient condition that guarantees that a time-driven release by the vendor and a time-driven update by the firm is the equilibrium outcome for patch management. However, in this equilibrium, the patch-update cycle of the firm may not be synchronized with the patch-release cycle of the vendor, making it impossible to achieve the socially optimal patch management in the decentralized system. Therefore, we next examine cost sharing and liability as possible coordination mechanisms. Our analysis shows that cost sharing itself may achieve synchronization and social optimality. However, liability by itself cannot achieve social optimality unless patch-release and update cycles are already synchronized without introducing any liability. Our results also demonstrate that cost sharing and liability neither complement nor substitute each other. Finally, we show that an incentive-compatible contract on cost sharing can be designed to achieve coordination in case of information asymmetry.information technology security, liability, cost sharing, patch management, coordination schemes

The Influence of Software Process Maturity and Customer Error Reporting on Software Release and Pricing

“…Our results in this paper would be quite robust to imperfect debugging, provided that debugging is mostly effective. Second, we take a simpler view that patches are released as soon as the vendor has a patch available; in reality, when patches are released (either willingly or by threat of disclosure) and when they are applied (if ever) by users is a complex topic in its own right and extensively studied in the vulnerability disclosure literature (see August and Tunca 2006, Cavusoglu et al 2007, Arora et al 2008, Cavusoglu et al 2008. One possible future extension could be to explore this link between vulnerability disclosure 26 and a vendor's product release time and pricing.…”

Optimizing Network Patching Policy Decisions

“…Cavusoglu, et al [18,19] use a game-theoretic model to study interactions between a vendor releasing patches and an organization deploying the patches across its environment. They examine the cost/benefit consequences of the time-driven release policies adopted by a vendor and similar policies for patch deployment adopted by an organization, and explore situations in which the socially optimal patch management can be achieved.…”

Optimal Policy for Software Vulnerability Disclosure

“…Arora, Caulkins and Telang (2005) develop an analytical model where the possibility of patching a software product after it has been released creates incentives for the vendors to rush to the market with buggier products, especially in larger markets. Cavusoglu et al (2005) present a model of risk sharing between the vendor and software users where the risk arises due to vulnerabilities. These papers do not deal with the issue of disclosure directly.…”