CT-ISG: The Economics of Internet Security: Theoretical and Empirical Analysis

随着互联网用于商业目的的持续增长，可能造成长时间大规模中断的可能网络攻击的后果是一个越来越重要的经济问题。 2003年，总统的《网络空间安全国家战略》指出，在据称“市场失灵导致网络安全投资不足”的情况下，政府有必要采取行动。然而，这种“市场失灵”缺乏经验证据和/或理论支持。虽然有大量关于网络安全的技术文献，但对网络安全经济学的研究仍处于早期阶段。本项目通过理论和实证研究相结合，有助于更好地理解互联网安全经济学。首先，经济动机的投资增加互联网安全的互联网服务提供商（ISP）进行了分析，使用博弈论模型。客户对服务质量的敏感性和增加安全性的投资折旧在决定ISP的投资激励方面起着关键作用。然而，这些激励措施可能并不完全符合网络攻击期间所涉及的社会价值（源自互联网使用）。通过实证研究，对私人投资动机在多大程度上导致网络安全投资不足的情况进行了评估。该研究项目的结果将在为网络空间安全监管政策制定过程提供信息方面产生更广泛的影响。此外，与提供互联网有关的经济和技术问题之间的相互作用将成为研究生和本科生一级若干教育举措的主题。其中包括：关于网络安全的研究生研讨会、电子商务和工程系统经济学现有课程的新材料以及“顶点”项目（高级论文）。研究结果将在项目网站（http：//www.example.com）上公布www.people.virginia.edu/~ag7s/economics_of_internet_security.htm

With the continuing growth of the use of the Internet for business purposes, the consequences of a possible cyber attack that could create a large scale outage of long time duration is an increasingly important economic issue. In 2003, the President's National Strategy to Secure Cyberspace stated that government action is warranted where alleged "market failures result in underinvestment in cyber security". However, there is scant empirical evidence and/or theoretical support for such "market failure". While there exists a large body of technical literature on cyber security, research on the economics of cyber security is still in its very early stages.This project contributes to a better understanding of the economics of Internet security through a combination of theoretical and empirical research efforts. First, the economic motivations for investment in added Internet security by Internet Service Providers (ISPs) are analyzed using game theoretic models. Customer's sensitivity to quality of service and depreciation of investments in added security play key roles in determining the ISPs' investment incentives. However, these incentives may not be perfectly aligned with the social value (derived from Internet usage) at stake during a cyber attack. Empirical research is undertaken to estimate to what extent private incentives for investment may lead to a situation of underinvestment in cyber security.The results of this research project will have a broader impact in informing the process of regulatory policy-making towards securing cyberspace. In addition, the interplay between the economic and technological issues associated with the provision of Internet will be the subject of a number of educational initiatives both at graduate and undergraduate levels. These include: a graduate seminar on cyber security, new material for existing courses in E-commerce and the economics of engineering systems and "Capstone" projects (senior theses). The research findings will be reported in the project web site (http://www.people.virginia.edu/~ag7s/economics_of_internet_security.htm