Strategic Discovery and Sharing of Vulnerabilities in Competitive Environments

Abstract

Abstract. We investigate the incentives behind investments by competing companies in discovery of their security vulnerabilities and sharing of their findings. Specifically, we consider a game between competing firms that utilise a common platform in their systems. The game consists of two stages: firms must decide how much to invest in researching vulnerabilities, and thereafter, how much of their findings to share with their competitors. We fully characterise the Perfect Bayesian Equilibria (PBE) of this game, and translate them into realistic insights about firms' strategies. Further, we develop a monetary-free sharing mechanism that encourages both investment and sharing, a missing feature when sharing is arbitrary or opportunistic. This is achieved via a lighthanded mediator: it receives a set of discovered bugs from each firm and moderate the sharing in a way that eliminates firms' concerns on losing competitive advantages. This research provides an understanding of the origins of inefficiency and paves the path towards more efficient sharing of cyber-intelligence among competing entities.

Fair and private rewarding in a coalitional game of cybersecurity information sharing

“…Let O = {o 1 , ..., on} represent the organizations participating in cybersecurity information sharing. Although various information can be shared among organizations such as raw network logs, attackers techniques, the signature of attacks, and the vulnerabilities' details, in this work, we particularly focus on sharing discovered security vulnerabilities as in [8]. In each sharing cycle, a set of vulnerabilities V = {v 1 , ..., vm} will be detected by the participant organizations.…”

“…To facilitate sharing the cybersecurity information, various protocols and standards have been proposed such as TAXII, STIX, and CybOX [14,15]. The cybersecurity information sharing in competitive environments with the game theory approach has been studied in [7,8]. Economic analyses of cybersecurity information sharing and applying incentives for motivation have been studied in [6].…”

“…Recently, plenty of research has been done in modelling the benefit and cost of the cybersecurity information sharing by applying game theory [6][7][8]. Traditionally the cybersecurity information sharing is modelled as a non-cooperative game where the players are the organisations, and the strategies are choosing between sharing and not-sharing.…”

Cyber-Threats Information Sharing in Cloud Computing: A Game Theoretic Approach

“…The researches in [12][13] [14][15][2] [16] analyze information sharing in the context of cybersecurity. Those papers show that multiple factors impact cyber threat information sharing including competition [14], free riding [2], interconnection [17], and the possibility to exploit vulnerabilities for cyber war [16]. However, none of those work look into sharing cybersecurity information in cloud computing.…”

“…In our past work [18], we present an evolutionary game theoretic model to self-enforce firms toward participating in sharing framework by utilizing the participation cost in a tactical way. The work in [14] uses a two stage Bayesian game to analyze the information sharing decision of two strategic and competing firms. They established that the sharing strategies are unique and dominant, and are in the simple forms of full-sharing or no sharing completely determined by the competitive nature of the security findings.…”