Security Investment (Failures) in Five Economic Environments: A Comparison of Homogeneous and Heterogeneous User Agents

Security interactions in networked systems, and the associated user choices, due to their complexity, are notoriously difficult to predict, and sometimes even harder to rationalize. We argue that users often underestimate the strong mutual dependence between their security strategies and the economic environment (e.g., threat model) in which these choices are made and evaluated. This misunderstanding weakens the effectiveness of users’ security investments. We study how economic agents invest into security in five different economic environments, that are characteristic of different threat models. We consider generalized models of traditional public goods games (e.g., total effort and weakest link) and two recently proposed games (e.g., weakest target game). Agents may split their contributions between a public good (protection) and a private good (selfinsurance). We can examine how incentives may shift between investment in a public good (protection) and a private good (insurance), subject to factors such as network size, type of attack, loss probability, loss magnitude, and cost of technology. We compare Nash equilibrium predictions for homogeneous and heterogeneous user populations. We also provide results for the social optima for different classes of attacks and defenses in the case of homogeneous agents. ∗This is a working paper in preparation for archival journal submissions and represents a subset of results from an ongoing project on security economics. Some of the preliminary results on the homogeneous case presented here have been published in [21]. Results on the case of heterogeneous agents are available also in [22]. We hope to further improve this draft with the feedback of the workshop participants.