CT-ISG: The Economics of Internet Security: Theoretical and Empirical Analysis

随着互联网用于商业目的的持续增长，可能造成长时间大规模中断的网络攻击的后果是一个日益重要的经济问题。2003年，总统的国家网络安全战略指出，在所谓的“市场失灵导致网络安全投资不足”的情况下，政府有必要采取行动。然而，这种“市场失灵”缺乏经验证据和/或理论支持。虽然有大量关于网络安全的技术文献，但对网络安全经济学的研究仍处于非常早期的阶段。本项目通过理论与实证研究的结合，有助于更好地理解互联网安全的经济学。首先，利用博弈论模型分析了互联网服务提供商（isp）在增加互联网安全方面投资的经济动机。客户对服务质量的敏感性和增加安全投资的折旧在决定isp的投资激励方面起着关键作用。然而，在网络攻击中，这些激励措施可能与利害攸关的社会价值（来自互联网使用）并不完全一致。本文通过实证研究来估计私人投资激励在多大程度上可能导致网络安全投资不足的情况。该研究项目的结果将在为网络空间安全监管政策制定过程提供信息方面产生更广泛的影响。此外，与提供互联网络有关的经济和技术问题之间的相互作用将成为研究生和本科生一级若干教育倡议的主题。这些包括：关于网络安全的研究生研讨会，电子商务和工程系统经济学现有课程的新材料，以及“顶点”项目（高级论文）。研究结果将在项目网站（http://www.people.virginia.edu/~ag7s/economics_of_internet_security.htm）上公布

With the continuing growth of the use of the Internet for business purposes, the consequences of a possible cyber attack that could create a large scale outage of long time duration is an increasingly important economic issue. In 2003, the President's National Strategy to Secure Cyberspace stated that government action is warranted where alleged "market failures result in underinvestment in cyber security". However, there is scant empirical evidence and/or theoretical support for such "market failure". While there exists a large body of technical literature on cyber security, research on the economics of cyber security is still in its very early stages.This project contributes to a better understanding of the economics of Internet security through a combination of theoretical and empirical research efforts. First, the economic motivations for investment in added Internet security by Internet Service Providers (ISPs) are analyzed using game theoretic models. Customer's sensitivity to quality of service and depreciation of investments in added security play key roles in determining the ISPs' investment incentives. However, these incentives may not be perfectly aligned with the social value (derived from Internet usage) at stake during a cyber attack. Empirical research is undertaken to estimate to what extent private incentives for investment may lead to a situation of underinvestment in cyber security.The results of this research project will have a broader impact in informing the process of regulatory policy-making towards securing cyberspace. In addition, the interplay between the economic and technological issues associated with the provision of Internet will be the subject of a number of educational initiatives both at graduate and undergraduate levels. These include: a graduate seminar on cyber security, new material for existing courses in E-commerce and the economics of engineering systems and "Capstone" projects (senior theses). The research findings will be reported in the project web site (http://www.people.virginia.edu/~ag7s/economics_of_internet_security.htm