CAREER: Securing Cyberspace: The Role of Markets and Policy

Rahul TelangCMU0546009摘要保护网络空间和国家基础设施已成为政策制定者的关键优先事项。认识到软件供应商是构建和开发安全产品的关键这一事实，这个职业项目检查并量化了供应商提供安全产品的激励措施。PI正在分析三个主要的供应商激励措施，以提供及时和可靠的补丁；不安全产品对供应商的成本，以及他们提供安全软件的激励措施，以及采用自愿安全保证标准的激励措施。该项目还在探索市场结构、竞争性质和政策干预如何影响这些激励措施。供应商提供可靠补丁的激励措施可提供对披露政策如何工作的关键见解，并帮助行业和立法者制定有关漏洞披露的最佳政策。通过量化不安全产品的成本和安全认证的价值，该项目为供应商和政策制定者提供了见解，帮助他们了解自愿认证是否有效以及如何加快其传播速度。PI正在开发新的数据集、新的经验方法和建模技术，以提供可操作的建议。该项目还将通过CMU的课程开发对社会科学、经济学和工程学学生的教育产生直接影响。公社开设了信息安全与风险管理课程，并开设了新的信息安全经济学课程。这一职业项目为教学单元、案例研究和有用的统计练习提供了材料，并提供了有关信息安全的各种政策和管理方面的说明。

Rahul TelangCMU0546009 AbstractSecuring cyberspace and national infrastructure has become a key priority for policy makers. Recognizing the fact that the software vendors are key to building and developing secure products, this CAREER project examines and quantifies vendors incentives to provide secure products. The PI is analyzing three major vendor incentives incentives to provide timely and reliable patches; cost of insecure products to vendors and hence their incentives to provide secure software and, incentives to adopt voluntary security assurance standards. The project is also exploring how market structure, the nature of competition and policy interventions affect these incentives. Vendors incentives to provide reliable patches provide key insights into how disclosure policies work and help industry and lawmakers develop optimal policies regarding vulnerability disclosure. By quantifying the cost of insecure products and value of security certification, this project provides insights to both vendors and policymakers in understanding whether voluntary certification works and how to speed up its diffusion. The PI is developing novel data sets, new empirical methodologies, and modeling techniques to provide actionable recommendations. The project will also have direct impact on the education of social science, economics and engineering students through course development at CMU. The PI has developed the course on Information Security and Risk Management and developing a new course on Economics of Information Security. This CAREER project is providing material for teaching modules, case studies and useful statistical exercises and illustrations on various policy and managerial aspects of Information security.