This paper studies the security choices of identical plantcontroller systems, when their security is interdependent due the exposure to network induced risks. Each plant ismodeled by a discrete-time stochastic linear system, which is sensed and controlled over a communication network. We model security decisions of the individual systems (also called players) as a game. We consider a two-stage ...

Security audits with subsequent certification appear to be the tool of choice to cure failures in providing the right level of security between different interacting parties, e. g., between an outsourcing provider and its clients. Our game-theoretic analysis scrutinizes this view and identifies conditions under which security audits are most effective, and when they are not. We find that basic ...

Information security has traditionally been considered a strategic cat-and-mouse game between the defending party and “the attacker”. The goal of the attacker has been to compromise the defender’s systems and to profit from this unauthorized access, while the goal of the defender has been to prevent unauthorized access to and usage of resources. In this game, both the attacker and the defender ...

In the following, we assume, without loss of generality, that for all players i, Ri > 0, δi > 0, pi > 0, and αi > 0. Given a joint mixed-strategy x, we partition the players by type w.r.t. x: let I ≡ I(x) ≡ {i | xi = 1}, N ≡ N(x) ≡ {i | xi = 0}, and P ≡ P (x) ≡ {i | 0 < xi < 1} be the set of players that fully invest in protection, do not invest in protection, and partially invest in protection...

We investigate global cascades in networks consisting of strategic agents with interdependent security. We assume that the strategic agents have choices between i) investing in protecting themselves, ii) purchasing insurance to transfer (some of) risks, and iii) taking no actions. Using a population game model, we study how various system parameters, such as node degrees, infection propagation ...

We study the computational complexity of computing Nash equilibria in generalized interdependent-security (IDS) games. Like traditional IDS games, originally introduced by economists and risk-assessment experts Heal and Kunreuther about a decade ago, generalized IDS games model agents’ voluntary investment decisions when facing potential direct risk and transfer-risk exposure from other agents....

With increasing connectivity among comprising agents or (sub-)systems in large, complex systems, there is a growing interest in understanding interdependent security and dealing with inefficiency in security investments. Making use of a population game model and the well-known Chung-Lu random graph model, we study how one could encourage selfish agents to invest more in security by internalizin...