DeepAI AI Chat
Log In Sign Up

Economics and Optimal Investment Policies of Attackers and Defenders in Cybersecurity

by   Austin Ebel, et al.
Columbia University

In our time cybersecurity has grown to be a topic of massive proportion at the national and enterprise levels. Our thesis is that the economic perspective and investment decision-making are vital factors in determining the outcome of the struggle. To build our economic framework, we borrow from the pioneering work of Gordon and Loeb in which the Defender optimally trades-off investments for lower likelihood of its system breach. Our two-sided model additionally has an Attacker, assumed to be rational and also guided by economic considerations in its decision-making, to which the Defender responds. Our model is a simplified adaptation of a model proposed during the Cold War for weapons deployment in the US. Our model may also be viewed as a Stackelberg game and, from an analytic perspective, as a Max-Min problem, the analysis of which is known to have to contend with discontinuous behavior. The complexity of our simple model is rooted in its inherent nonlinearity and, more consequentially, non-convexity of the objective function in the optimization. The possibilities of the Attacker's actions add substantially to the risk to the Defender, and the Defender's rational, risk-neutral optimal investments in general substantially exceed the optimal investments predicted by the one-sided Gordon-Loeb model. We obtain a succinct set of three decision types that categorize all of the Defender's optimal investment decisions. Also, the Defender's optimal decisions exhibit discontinuous behavior as the initial vulnerability of its system is varied. The analysis is supplemented by extensive numerical illustrations. The results from our model open several major avenues for future work.


page 1

page 2

page 3

page 4


Over-representation of Extreme Events in Decision-Making: A Rational Metacognitive Account

The Availability bias, manifested in the over-representation of extreme ...

Relative rationality: Is machine rationality subjective?

Rational decision making in its linguistic description means making logi...

A Bayesian-network-based cybersecurity adversarial risk analysis framework with numerical examples

Cybersecurity risk analysis plays an essential role in supporting organi...

Asymptotic Security using Bayesian Defense Mechanism with Application to Cyber Deception

This paper addresses the question whether model knowledge can guide a de...

Asymptotic Security by Model-based Incident Handlers for Markov Decision Processes

This study investigates general model-based incident handler's asymptoti...

On the Economics of Offline Password Cracking

We develop an economic model of an offline password cracker which allows...

Can Language Representation Models Think in Bets?

In recent years, transformer-based language representation models (LRMs)...