Hackers, Users, Information Security

We analyze the strategic interactions among end-users and between end-users and a hacker. We show that security efforts by end users are strategic substitutes. This explains the inertia among end-users in taking precautions even in the face of grave potential consequences. Next, we analyze the direct and indirect effects of changes in user fixing cost and the rate of enforcement against hacking. For instance, a reduction in user fixing cost would directly lead users to increase fixing effort. However, that would make them less attractive targets, and so induce less hacking, and hence, indirectly lead users to reduce fixing. National University of Singapore. Corresponding author: Ivan Png, tel: +65 6516-6807; http://www.comp.nus.edu.sg/~ipng/. We thank Anindya Ghose and the anonymous referees for very helpful advice and suggestions. Workshop on the Economics of Information Security (WEIS 2006) © 2006, Png, Tang, and Wang 2