This Article Full Text (PDF) References Alert me when this article is cited Alert me if a correction is posted Services Email this article to a friend Similar articles in this journal Alert me to new issues of the journal Download to citation manager Citing Articles Citing Articles via HighWire Citing Articles via Google Scholar Google Scholar Articles by Gal-Or, E. Articles by Ghose, A. Search for Related Content

The Economic Incentives for Sharing Security Information

Katz Graduate School of Business, 368 A Mervis Hall, University of Pittsburgh, Pittsburgh, Pennsylvania 15260
Leonard Stern School of Business, New York University, New York, New York 10012
esther{at}katz.pitt.edu
aghose{at}stern.nyu.edu

Given that information technology (IT) security has emerged as an important issue in the last few years, the subject of security information sharing among firms, as a tool to minimize security breaches, has gained the interest of practitioners and academics. To promote the disclosure and sharing of cyber security information among firms, the U.S. federal government has encouraged the establishment of many industry-based Information Sharing and Analysis Centers (ISACs) under Presidential Decision Directive (PDD) 63. Sharing security vulnerabilities and technological solutions related to methods for preventing, detecting, and correcting security breaches is the fundamental goal of the ISACs. However, there are a number of interesting economic issues that will affect the achievement of this goal. Using game theory, we develop an analytical framework to investigate the competitive implications of sharing security information and investments in security technologies. We find that security technology investments and security information sharing act as "strategic complements" in equilibrium. Our results suggest that information sharing is more valuable when product substitutability is higher, implying that such sharing alliances yield greater benefits in more competitive industries. We also highlight that the benefits from such information-sharing alliances increase with the size of the firm. We compare the levels of information sharing and technology investments obtained when firms behave independently (Bertrand-Nash) to those selected by an ISAC, which maximizes social welfare or joint industry profits. Our results help us predict the consequences of establishing organizations such as ISACs, Computer Emergency Response Team (CERT), or InfraGard by the federal government.

Key Words: security technology investment; information sharing; security breaches; externality benefit; social welfare; spillover effect
History: This paper was received on August 29, 2003.

This article has been cited by other articles:

				J. Wang, A. Chaudhury, and H. R. Rao Research Note--A Value-at-Risk Approach to Information Security Investment Information Systems Research, March 1, 2008; 19(1): 106 - 120. [Abstract] [PDF]

				S. L. Jarvenpaa and A. Majchrzak Knowledge Collaboration Among Professionals Protecting National Security: Role of Transactive Memories in Ego-Centered Knowledge Networks Organization Science, March 1, 2008; 19(2): 260 - 276. [Abstract] [PDF]