1 / 19

Internet Security, Vulnerability Disclosure, & Software Provision

Internet Security, Vulnerability Disclosure, & Software Provision. Jay Pil Choi, Chaim Fershtman, Neil Gandal, WEIS 2005 Cambridge, MA. Introduction. We examine how software vulnerabilities affect firms that sell software and consumers that purchase software.

madelyn
Download Presentation

Internet Security, Vulnerability Disclosure, & Software Provision

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Internet Security, Vulnerability Disclosure, & Software Provision Jay Pil Choi, Chaim Fershtman, Neil Gandal, WEIS 2005 Cambridge, MA

  2. Introduction • We examine how software vulnerabilities affect firms that sell software and consumers that purchase software. • Three decisions of the firm: • (I) an upfront investment in the quality of the software • (II) a policy decision whether to announce vulnerabilities, • (III) and a price for the software. • Two decisions of the consumer: • (I) whether to purchase the software • (II) whether to apply a patch.

  3. Related Literature • “Intersection” of computer science, engineering & economics on cyber security • Anderson (2001) – Overview • Market for Vulnerabilities • Camp and Wolfram (2004) • Schechter (2004) • Ozment (2004)

  4. Literature Continued • Arora, Telang, and Xu (2004) examine the optimal policy for software vulnerability disclosure (when to release the patch). • Arora, Krishnan, Nandkumar, Telang, and Yang (2004) find empirical evidence that vulnerability disclosure increases attacks (per host) & patching decreases the number of attacks (per host).

  5. Model Software Vendor • I = investment; determines software quality. n(I) = number of security problems. Assume n’(I)<0, n’’(I)>0; [We’ll use n=1/I] • Whether or not to announce a problem. Announcing (A=1), Not announcing (A=0). • p = price of the software

  6. Consumers • Whether to buy the software • Whether to download patch (if available) • [1,2] – consumer type. Uniform distribution • Value of the software to type : v1 + v2 • D – Damage from each security problem to type . • c – the cost of a downloading/installing a patch to consumers.

  7. Hackers and Technology • Hackers exert effort. • -- Exogenous probability that the firm will find the problems before hackers. • Ne is the expected number of consumers who purchase the software but do not install a patch. • Ne = probability of attack if the problem not announced •  <1 (exogenous) the difficulty of exploiting a vulnerability when reverse engineering (via a patch) is not possible. • Ne = the probability of attack if the problem is announced.

  8. Expected Damage • The expected damage to a consumer of type  from a vulnerability that is found first by hackers is given by (1-)NeDn(I). • The expected damage to a consumer of type  from a vulnerability that is found first by the firm who announces and releases a patch is: • NeDn(I) for consumers that do not have a patch • zero for consumers that have a patch. • Because of the negative network effect, the expected damage is increasing in the number of consumers on the network that do not have a patch.

  9. Timing Stage 1: Firms choose the level of investment (I) that determines the number of vulnerabilities, n(I) to maximize = p* [n(I)] N* [n(I)] – I. Stage 2: Firms set price (p*) and announcement policy (A). Stage 3: Consumers make purchasing decisions.

  10. Equilibrium In the second stage, Iis given. Hence n*(I) is given as well. For every (n,A,p), we need to define the equilibrium allocation of consumers. Each consumer type  chooses whether or not to acquire the software, and if so whether to patch. (| (n,A,p) )  ({0,1}, {0,1}), where the first {0,1} refers to whether to buy the software and the second {0,1} refers to whether to patch or not. (A*,p*) and (|…) is an equilibrium if (1) (|…) is the optimal consumer strategy given (A*,p*) and n*(I), (2) Given (|…), the firm cannot unilaterally increase profits by changing its strategy.

  11. Consumer Adoption Decision The quality (I) and the number of vulnerabilities n(I) are given. Similarly the price and announcement policies have been determined. B* = the number of consumer who buy the software and install patches if they become available N* = the number of consumer who buy the software, but will not apply patches if they become available. Rational expectations, hence Ne =N*. Case 2: v2>n(I)D. [v2-n(I)D] is positive & grows with .

  12. Firm Announces Vulnerabilities Wp is the consumer value from buying software and installing a patch (1) Wp(, Ne)= [v1 + v2] -(1-)NeDn(I)- n(I)c. Wnp is the consumer value from buying, but not installing a patch. (2) Wnp(, Ne)= [v1 + v2] -(1-)NeDn(I)- NeDn(I), If everybody patches, Ne = 0, but in that case “not patching” is a better option for any individual consumer. There cannot be an equilibrium in which all consumers patch. (Problems with vulnerabilities cannot be solved (exclusively) “ex post” by having everyone patch.) Hence, a firm that announces vulnerabilities will sell the software both to consumers who will apply patches and to consumers who will not apply patches

  13. Firm Announces Vulnerabilities Equilibrium is characterized by Wnp(*, N*)= Wp(*, N*)  c=*DN*. B=2-*, and N*=*-1, where 1 is lowest value consumer that purchases. The firm extracts all of the surplus from the marginal consumer: p1=Wnp(1, N*)=[v1 + v2] -(1-)N*Dn(I)- N*Dn(I). Equilibrium price is decreasing in the number of vulnerabilities which provides incentives to invest in security Equilibrium requires N*=*-1, B*=2-*, c=*DN*  Wnp(*, N*)= Wp(*, N*), p1=Wnp(1, N*). (3) 1= p1 (N*+ B*) = [v1 + 1v2-(1-)N*1Dn(I)- N*1Dn(I)] [2-1].

  14. Firm Does Not Announce Vulnerabilities Value to the consumer of type  from no announcement (Wna) is given by Wna(, Ne)= v1 + v2-N*Dn(I) If there is no announcement, the firm will set the price, p2 = Wna(2, N*) where N*=2-2. (4) 2= p2 N* = [v1 + 2v2-(2-2)2Dn(I) ] [2-2]

  15. Firm choice of price and vulnerability announcement policy(Fixed Investment) For small  and large , the firm will not announce vulnerabilities. When  is very small, it is very difficult for the hacker to reverse engineer without an announcement. When  is large, there is a high probability that the firm will find the problem first. An increase in the cost of the patch or a decrease in the damage reduces the probability that the firm will announce a vulnerability. The parameters v1 and v2 affect consumer valuations, pricing, & profits, but have little effect on optimal disclosure choice of the firm.

  16. Example 1 Example 1: v1=0.1, v2=20, D=8, =0.5, =0.5, c=2 If the firm chooses to announce and provide patches. I*=1.1, p*=19.39, 1=1.021, N*=0.204, B*=0.775, =17.88, and TS=27.14 If the firm chooses not to announce software vulnerabilities, I*=1.95, p*=19.13, 2=1.054, N*=0.946, =16.15, and TS=24.07 Social surplus is maximized when the firm announces vulnerabilities. Here the firm’s announcement policy corresponds with the social optimal policy.

  17. Example 2 Example 2: Same as example 1, except that =0.2. Compared to example 1, there is lower probability that hackers will be able to exploit the vulnerabilities in the absence of an announcement. If the firm chooses to announce the vulnerabilities and provide patches. I*=1.0, p*=19.39, 1=1.015, N*=0.205, B*=0.78, =18.11, and TS=26.16. If the firm chooses not to announce software vulnerabilities I*=1.25, p=19.45, 2=1.03, N*=0.97, =17.59, and TS=26.33. There is a reduction in the equilibrium investment relative to example 1; it is more difficult for hackers to exploit vulnerabilities in the absence of an announcement. The firm would announce vulnerabilities, although social surplus is higher in the case in which vulnerabilities are not announced.

  18. Example 3 Example 3: Same as example 1, except that =.05. It very unlikely that hackers will be able to exploit the vulnerabilities in the absence of an announcement. If the firm chooses to announce the vulnerabilities and provide patches, I*=0.95, p*=19.47, 1=1.015, N*=0.205, B*=0.78, =18.24 and TS=27.77. If the firm chooses not to announce software vulnerabilities, I*=0.65, p=19.75, 2=1.013, N*=0.987, =18.84, and TS=28.27 The firm would not announce vulnerabilities in this case & that maximizes TS. This case confirms the intuition that (I) it is not always optimal for the firm to announce vulnerabilities and (II) higher investment in security may not necessarily raise total surplus.

  19. Preliminary Conclusions & Further Discussion Firms are likely to announce vulnerabilities when there is a relatively high probability that hackers will be able to exploit the vulnerabilities in the absence of an announcement. This policy coincides with the socially optimal announcement policy. When there is a relatively low probability that hackers will be able to exploit the vulnerabilities in the absence of an announcement, firms do not announce vulnerabilities and it is socially optimal not to announce them. We did not allow for intermediaries, like CERT; it may not be possible for a firm to adopt a “do not announce” policy. With competition in software provision and a dynamic setting with new consumers over time, there would likely be increased investment in reducing software vulnerabilities

More Related