An economic mechanism to manage operational security risks for inter-organizational information systems

Transcription

1 Inf Syst Front DOI /s y An economc mechansm to manage operatonal securty rsks for nter-organzatonal nformaton systems Fang Fang Manoj Parameswaran Xa Zhao Andrew B. Whnston Sprnger Scence+Busness Meda, LLC 2012 Abstract As organzatons ncreasngly deploy Interorganzatonal Informaton Systems (IOS), the nterdependent securty rsk they add s a problem affectng market effcency. Connected organzatons become part of entre networks, and are subject to threats from the entre network; but members securty profle nformaton s prvate, members lack ncentves to mnmze mpact on peers and are not accountable. We model the problem as a sgnalng-screenng game, and outlne an ncentve mechansm that addresses these problems. Our mechansm proposes formaton of secure communtes of organzatons anchored by Securty Complance Consortum (SCC), wth members held accountable to the communty for securty falures. We study the nterconnecton decsons wth and wthout the mechansm, and characterze condtons where the mechansm plays roles of addressng moral hazard and hdden nformaton ssues by screenng the F. Fang (B) Department of ISOM, Calforna State Unversty at San Marcos, San Marcos, CA 92096, USA e-mal: fangfang@csusm.edu M. Parameswaran Department of ISOM, Unversty of Washngton, Seattle, WA 98195, USA e-mal: manojpc@uw.edu X. Zhao Department of ISOM, Unversty of North Carolna at Greensboro, Greensboro, NC 27402, USA e-mal: X_zhao3@uncg.edu A. B. Whnston Department of IROM, Unversty of Texas, Austn, TX 78712, USA e-mal: abw@uts.cc.utexas.edu organzatons securty types and/or by provdng them ncentves to mprove. We also dscuss the welfare gans and the broad mpact of the mechansm. Keywords Inter-organzatonal nformaton systems Informaton securty Rsk management Economcs of nformaton systems Economc mechansms 1 Introducton Today s compettve envronment has sgnfcantly rased the stakes for modern organzaton, forcng them to explore new ntatves to mprove ther busness effcences and reduce cost. To meet ths partcular need, the focus of nformaton technology has shfted from the organzatonal level to the nter-organzatonal level. Hengst and Sol (2001) For example, Wal-Mart and Procter & Gamble have developed a channel partnershp by leveragng ther nformaton technologes and sharng data across ther mutual supply chans. The coordnaton of supply chan channel actvtes s sgnfcantly mproved and the need for nventory s also reduced as a result. Grean and Shaw (2000) In addton, a rch set of lterature (e.g. Ghattas and Soffer 2009; Soper et al. 2007) has reported on the organzatonal actvtes of routnely usng networks to nterconnect and share nformaton wth ther partners, supplers and customers. Such nterconnectons serve a wde varety of purposes: communcaton, nformaton sharng, electronc data nterchange, transacton fulfllment, busness process ntegraton, outsourcng relatonshps, and formaton of strategc allances. Informaton systems are transtonng to an era of nter-organzatonal nformaton systems (IOS).

2 InfSystFront However, the above lterature also ponts out that the further development of IOS faces many challenges, whch may be related to strategy, management, polcy and technology. Potental lock-n effects, network externaltes, change management and organzatonal resstance, dfferng organzatonal cultures, varaton n law and regulatons across markets, dfferng busness protocols and process defntons, data format ncompatblty, consensus of choce and avalablty of approprate technologes and varaton n complance requrements, are among a few on the lst. Majorty of the current research and ndustry efforts have focused on the above aspects (e.g. Fang et al. 2008; Solman and Janz 2004). In ths paper, we focus on a key challenge of IOS that has not receved suffcent attenton: securty. When companes connect ther Informaton Systems wth one another, the securty rsk accrues not only due to potental vulnerabltes of ther drect partners, but also due to the vulnerablty of organzatons that ther partners n turn connect to. Inter-organzatonal lnk to a busness partner can expose an organzaton to network-wde rsks n multple ways: a vrus at a remote member of the busness network may travel multple trusted lnks to eventually harm the organzaton s network; a hacker ganng access to a remote network can cascade ntrusons through a sequence of lnks n the network and gan access to the organzaton; a zombe node n a remote organzaton can ntate denal-of-servce attacks aganst the network; lack of complance by employees n a remote organzaton can lead to securty breaches of any of the above types; the organzaton may be ndrectly reachable from another whose securty polces fall below requrements. The rsks descrbed above are consdered to be a type of securty rsks caused by nterconnecton. To descrbe the dea of rsks caused by nterconnecton, one can thnk of the rsks that a house s caught on fre. In a communty when houses are closely located, the rsk s hgher even though the owners themselves protect ther house very carefully, such as not leavng the house wth the candles lt. However, the house can stll be vulnerable f the neghbors were careless. The same dea apples when organzatons nterconnect ther nformaton systems to mprove busness effcences. Even though one organzaton has nvested a sgnfcant amount of money n safeguardng ther own nformaton systems and tranng ther own employees on securty rsks (such as ways to prevent socal engneerng), ther transacton data could be avalable through ther nterconnected busness partners (e.g. supplers) who do not have a good securty protecton and are easer for hackers to fnd ways to break nto ther systems. Such nterconnecton rsks sgnfcantly affect the organzatons ncentves to use IOS due to the nablty to foresee the vulnerablty of the overall nterconnecton (Kumar and Sareen 2009; Kunreuther and Heal 2003). To allevate such concerns and provde better ncentves for organzatons to conduct busness more effcently, we propose an ncentve mechansm anchored by a Securty Complance Consortum (SCC), leadng to the formaton of a secure communty of organzatons, each member of whch s accountable to every other member for securty related losses caused by t. Our proposed ncentve mechansm tres to tackle the problem of self-nterested organzatons wthholdng prvate nformaton (a.k.a. nformaton asymmetry). For example, organzatons may not have securty nfrastructure n place to protect themselves and ther busness partners. It could be an acceptable stuaton nsde the organzaton due to the way ther systems support ther busness. However, f such an organzaton creates an nterconnected lnk wth ther busness partners, ther busness partners wll ncur a much hgher rsk than expected. Our mechansm s desgned to nduce organzatons to reveal ther true types regardng ther exstng securty profles. Or, even better, t can provde such organzatons ncentves to mprove the nfrastructure and hence enhance ther chance of establshng busness connectons. Revelaton of types and mproved nvestments n securty by an ndvdual organzaton would beneft the communty as a whole. In other words, our proposed mechansm seeks to ensure that self-nterested actons aggregate to advancng the communty welfare as well. The key to resolvng the nterdependency ssue and meetng the above objectve s accountablty. Our proposed SCC wll mpose accountablty among the partcpatng organzatons and force them to make ther securty and nterconnecton decsons consderng not only themselves but the overall network as a whole. The secure communty of organzatons serves as the bass of a mechansm that reduces nformaton asymmetry. The communty s admnstered by a Securty Complance Consortum (SCC), and choce to jon s voluntary, but comes wth accountablty for losses caused by the member organzaton to any other member of the communty. The SCC admnsters membershp n the communty wth the objectve of ensurng outcomes that are best for the communty. It may be consttuted by consensus among a consortum of leadng organzatons. It s not requred that the SCC takes specfc stances on choce of technologes or specfc standards of securty wthn the communty. SCC does not requre member organzatons to conform to a specfed level of

3 Inf Syst Front securty, gven the dffculty to observe and verfy the securty level or nvestment. To demonstrate the mprovement n effcency, we present an analytcal model wth two types (type 1 and type 2) of organzatons, whch are dfferent n ther costs of mprovng securty from low to hgh probablty of safety. A type 1 organzaton tends to mantan a hgh securty level but a type 2 organzaton does not have an ncentve to mantan a hgh securty level due to varous reasons. A type 2 organzaton fnds t more expensve to mprove ts securty level n order to ensure accountablty to the whole communty. Both types are self-nterested n all actons, and ther nformaton about ther types s prvate. Ther nvestments n mprovng securty are not publcly observable. The most obvous reason for an organzaton to be of type 2 s that the company s securty polcy and practce may be too lberal. Organzatons that consder securty mportant may stll fnd themselves n type 2 category for a varety of reasons. Some possble reasons are: lack of resources n small frms, lax employee practces, lack of central control, treatng securty as a necessary but not mportant requrement prmarly for complance, lack of attenton due to a lack of any past hstory of attacks, and beng located n a geographc area or nternet doman whch has low securty profle. Organzatons n our model have three choces: to jon the communty or not, the type of connecton used (wth or wthout IOS) to share nformaton wth each partner, and what type of safety level to mantan for ther nformaton systems. There s no value n not beng connected. We model the nterdependent choces of organzatons as a sgnalng-screenng game. When members of the communty connect wth others usng IOS, they ncur managed rsk and gan value. The rsk s managed because communty membershp mples accountablty by partners. Connectng wth other members wthout usng IOS s a domnated strategy for the members. Wth non-members (outsders), members of the communty have two choces. The frst s to connect usng IOS, whch mples hgher securty rsk. The other opton s to connect wthout IOS, mplyng no rsk of nterconnecton, but less added value due to ncreased operatonal costs, delayed nformaton acquston, and/or sub-optmal decson makng. When the partners are not members of the communty, connecton usng IOS also ncurs addtonal cost of securng the nterconnecton. Outsders choces of mode of nterconnecton wth other outsders wll also nvolve choosng whether to connect wth IOS or not, wth the former opton addng rsk, and the latter opton reducng value. Outsders nterconnecton wth members wll depend on the choces made by members. The rest of the paper s organzed as follows: Secton 2 revews the exstng lterature on organzatonal securty rsks and nterorganzatonal systems. We then descrbe the analytcal model, dscuss ts mplcatons, characterze the effects of ntroducton of the mechansm under varous condtons and demonstrate welfare gans n Secton 3. Secton 4 concludes the paper wth a dscusson of manageral mplcatons and future extensons. 2 Lterature revew Informaton securty has been a focus of Informaton Systems (IS) research long before securty became a manstream topc (e.g. Straub 1990; Straubetal.2008). Many of the recent studes focus on the economc aspects of nformaton system securty (Gordon and Loeb 2006; Kannan and Telang 2005). Of partcular nterest s the queston of how organzatons decde to nvest n securty and at what levels. The nvestment queston has been addressed n the general context (e.g., Gordon and Lobe 2002; Hausken 2006) andn the context of a specfc class of securty solutons, Intruson Detecton Systems (Cavusoglu et al. 2005). The common approach n nvestment research has been to treat securty rsks as exogenous, even when both external attacks and nternal threats are nvestgated. In general, IS research has focused on nformaton securty n the context of ntra-organzatonal nformaton systems. We dentfy ssues of nterdependent rsk orgnatng from nterconnectons usng IOS, and propose a soluton to mprove effcency of nvestment n the presence of such rsk. Lterature on economc aspects and nterdependent rsks of IOS s lmted. Pror research has examned IOS from the economc perspectve n the context of ther adopton, dffuson, property rghts, network externaltes and swtchng costs (e.g. Bakos and Nault 1997; Barua and Lee 1997; Han et al. 2004; Wangand Sedmann 1995; Zhu et al. 2006). Kunreuther and Heal (2003) characterzes a class of nterdependent securty rsks and demonstrate that frms generally under-nvest n securty protectons when ther securty rsks are nterdependent. Varan (2004) explaned the decson on securty nvestment n such a mult-frm envronment usng the theory of prvate provsonng of publc goods, whch was well-studed n economcs (See Mas-Colell at al. 1995; Varan1992; Samuelson 1954). Ths lne of lterature has been extended to a supply chan settng n Bandyopadhyay et al. (2010). Ogut et al. (2005) uses an economc model to examne frms nvestments n securty protectons and ther use of

4 InfSystFront cyber-nsurance n the context of nterdependent securty rsks. They fnd that securty nvestment and the nsurance coverage levels are less than the correspondng socally optmal levels when cyber-rsks are nterdependent. Zhao et al. (2009) consders both the postvely and negatvely nterdependent securty rsks and examne two alternatve rsk management solutons rsk poolng arrangement (RPA) and managed securty servces (MSS) n addton to cybernsurance. They fnd that RPA and MSS can complement cybernsuance and help address the ssues of nvestment neffcency caused by rsk nterdependency. Interdependent rsk of e-mal and Internet servce provders has been examned n the context of spam, where mutual accountablty among certfed provders was found to reduce rsk (e.g. Parameswaran et al. 2007; Zhaoetal.2008). Our paper complements ths stream of research by studyng solutons to neffcent nvestment n IOS caused by nter-dependent securty rsk. 3 Model setup In ths secton, we frst ntroduce an analytcal model to characterze decsons by organzatons when actng alone. We then extend t to the case where nformaton systems can be nterconnected. We model the nterconnecton envronment as a sgnalng-screenng game, characterze varous outcomes, and study welfare mplcatons. In the absence of the mechansm, we show that moral hazard s prevalent, the low types have no ncentve to mprove securty, and n some cases even the hgh types lack ncentve to mprove securty. Wth the ntroducton of the mechansm, we show that the moral hazard problem can be addressed, hgh types always have an ncentve to mprove securty, and the low types have an ncentve to mprove securty under specfc condtons. 3.1 A securty model for standalone nformaton systems We assume a set of n modern organzatons, each wth ts own nformaton systems deployed wthn ts organzatonal boundares. The set of the organzatons s denoted as N := {1, 2,, n}. Each organzaton N decdes on the level of securty nvestment based on a cost-beneft analyss. In order to do so, the organzaton needs to evaluate the followng parameters: V the value of mplementng the nformaton systems n organzaton ; p (0, 1) a probablty measurement of the nformaton systems safety level; v the expected loss of each securty attack; and C (p ) the nvestment n securty needed to mantan the securty level p. Note that pror lterature has proposed many measurements of organzatonal nformaton systems securty. In ths paper, we defne the safety level as the probablty that an organzatonal system stays rsk free. In other words, (1 p ) represents the probablty that the organzatonal IS wll experence a securty compromse. Wthout loss of generalty, we assume that the safety level p can be mantaned at two possble values: p h and p l,where0 < p l < p h < 1. Organzaton chooses between the two values and makes correspondng nvestment C (p l ) or C (p h ). It s also straghtforward to assume that C (p h )>C (p l ) because hgher safety level s always harder to mantan. C s used to denote C (p h ) C (p l ), the cost of securty mprovement. The choce s made by comparng the net value of nformaton systems at the two specfed securty levels. Mathematcally, the net value (denoted as U alone )s computed as V (1 p )v C (p ), the value of usng the system less the expected loss due to securty rsk and the cost of securty nvestment. Lemma 1 1 shows that the organzaton s choce of securty level wll be hgh f and only f the cost of securty mprovement s less than the beneft of mproved securty. Lemma 1 Organzaton wll mantan a safety level p = p h f the cost of securty mprovement C s no hgher than the expected reducton n loss from securty falure (p h p )v. The resultng net value of the nformaton systems s: U alone (p h ) = V (1 p h )v C (p h ). (1) Otherwse, the organzaton wll choose to mantan a low safety level p l wth a net value: U alone (p l ) = V (1 p l )v C (p l ). (2) Please note that here we assume that the value V s large enough so that max{u alone (p h ), U alone (p l )} s at least postve. Ths condton ensures that all types of organzatons wll mantan a postve overall value, gven ther best choce of securty, and stay n busness. Pror to the advent of wdespread use of IOS, each organzaton treated ts own nformaton systems as prvate assets managng ther own nformaton flows and mprovng effcency of busness processes. Investment n securty was drected at proper functonng of systems and protectng the organzatonal nformaton 1 All the proofs of the Lemmas and Propostons are provded n Appendx A.

5 Inf Syst Front assets from beng napproprately accessed or modfed. When organzatonal nformaton systems stand alone, the organzatons securty nvestment choces are ndependent decsons that maxmze ther own net value. In ths paper, we ntend to assess levels and effectveness of nvestments n securty across all the organzatons n the set. Therefore, we use overall welfare level, defned as the aggregate net value generated from the nformaton systems for the n organzatons, to measure the effcency level of securty nvestment. When organzatons ndependently evaluate ther system securty envronment and make correspondng decsons on ther requred safety level maxmzng ndvdual net value, the welfare level of the nformaton systems across those organzatons s maxmzed as well. However, as we wll show n the followng sectons, nter-connectng the nformaton systems across organzatonal boundares wll change the optmalty of the welfare level when organzatons make ther securty nvestment decsons n a decentralzed fashon. 3.2 Extendng the securty model to IOS Increasngly, organzatons are realzng the value of nformaton sharng and are deployng IOS. However, lnkng wth nformaton systems outsde the organzaton brngs addtonal securty concerns to exstng systems. Malcous hackers may fnd a way to route attacks to the targeted organzaton through the partner. Worse, the attack may not come from the busness partners the organzaton drectly lnked to but from some organzaton that was lnked wth a busness partner. All the organzatons that are lnked together drectly or ndrectly form an nterconnected network, whose vulnerablty accumulates all the organzatons vulnerablty. For example, f we denote the set of organzatons n the same nterconnected network wth organzaton as N, then the aggregated probablty of securty breaches organzaton expects to suffer wll be j N (1 p j ). In the equaton, j s any organzaton that s drectly or ndrectly connected to organzaton. Organzaton s expected loss n each attack s v and hence the expected loss can be calculated as j N (1 p j )v. For that reason, to evaluate the rsk of nterconnecton, organzaton needs to estmate all the other organzatons safety level p j for j N. However, p j s usually nformaton prvate to organzaton j. No organzaton wll voluntarly admt ts safety level s low and push potental busness partners away. Ths hdden nformaton problem ntroduces a partcular challenge for organzatons n dentfyng secure busness partners to nterconnect wth. For each organzaton, we assume that nterconnectng ts relevant nformaton systems wth those of ther partners provdes the most effcent busness processes and compettve advantages. That s, f a par of companes decde to form a strategc partnershp and lnk ther systems together usng IOS, both of them wll enjoy an added net value of V A, whch can be consdered the overall value less the nvestment and operatng cost. 2 Alternatvely, f ether decdes that usng IOS s not n ts best nterest, t can choose to perform the process that uses shared nformaton asynchronously. For example, nstead of allowng the salesperson from organzaton b to query ts nventory level drectly, organzaton a can request that the salesperson submt a request form and organzaton a wll assgn dedcated personnel to revew the request and generate such an nventory report for organzaton b. Such an asynchronously processed procedure may delay nformaton acquston and lose crtcal decson tme, sacrfcng process effcency. Therefore, we assume that the added value from a partnershp wthout IOS can only partally realze all the potental benefts of an nformaton system lnkage, denoted as δv A. δ [0, 1) s a dscount factor ndcatng the proporton of the value that can be realzed from the asynchronously lnked nter-organzatonal processes. In order to study the dfferent connecton decsons, we assume that there are two types of organzatons, namely type 1 and type 2 organzatons. Each ncurs dfferent costs n mprovng ts safety level. That s, C takes two possble values: 1 and 2.Type1(2) organzatons ncur cost 1 ( 2 ) to mprove ther safety levels from p l to p h. Wthout loss of generalty, we assume that 1 < 2. Each organzaton knows ts own type, but t cannot dentfy whether other organzatons are of type 1 or type 2. That s, both the cost of securty mprovement and the safety level of an organzaton are prvate nformaton whch s nether observable nor verfable by outsders of the organzaton. All organzatons share the common belef that the total number of type 1 organzatons s n 1 and the total number of type 2 organzatons s n 2 = n n 1.Wealsoassumethat v = v for all organzatons and focus on heterogeneous cost of securty nvestment only. 2 Please note here we do not sngle out each temzed beneft and cost. Rather, we keep the term n general. Our focus of ths paper s on the beneft and cost from a securty breach perspectve. Therefore, we consder V A as the net value when there s no securty ssue at all. When there s potental securty concern, we need to dscount the value by ncludng the cost of securty nvestment and expected loss of securty breach.

6 InfSystFront An organzaton expects to establsh partnershps wth only a proporton of the other n 1 organzatons. We use a parameter λ to denote ths proporton. In order to avod trval cases and mantan tractablty of our model, we consder stuatons when the followng condtons hold. [Condton 1] [Condton 2] [Condton 3] 2 >(p h p l )v. 1 < n 1 (p h p l )v. λ(1 δ)v A < n 1 (1 p l )v. Condton 1 focuses on the case where type 2 organzatons do not have ncentve to mprove ther safety level from p l to p h f ther systems are standalone. Condton 2 restrcts that the cost of securty mprovement s not too hgh for type 1 organzatons so that they may nvest n hgh safety level p h f they were concerned about the overall rsk that they may mpose on other type 1 organzatons. Condton 3 requres that the added value of connectng wth IOS to all the type 1 organzatons, λ(n 1 1)(1 δ)v A, s lower than the overall added rsks that all the type 1 organzatons may ncur by connectng to each other but they all mantan low safety levels, n 1 (n 1 1)(1 p l )v. Note that the term (n 1 1) appear on both sdes of condton 3 and were hence cancelled out. Therefore, t s more desrable to nduce type 1 organzatons to mantan a hgh securty level from a welfare pont of vew. An organzaton needs to evaluate whether t s worthwhle to connect wth ts partner frms usng IOS by tradng off the added busness value derved from the connecton and the expected securty rsk that the denote the expected net value for company to nterconnect ts nformaton systems wth ts busness partners, whch can be computed usng the followng formula: connecton entals. Let U conn U conn = V + λ(n 1)V A (1 p )v j N (1 p j )v C (p ). (3) When the value of λ s large, t ndcates an abundance of busness opportuntes wth partnershps, and t s very lkely that an organzaton wll connect wth all other organzatons usng IOS. Organzaton wll have to evaluate the rsk usng the worst case scenaro where N converges to the whole set N. Comparng the value of U conn to U alone, the company gans added value λ(n 1)V A from nterconnecton, but expects to suffer losses j N (1 p j )v due to compromses orgnatng from other organzatons. Alternatvely, organzaton can decde to connect asynchronously, wthout IOS, ganng a net value U asy. We can derve the value U asy = V + λ(n 1)δV A (1 p )v C (p ). (4) Lemma 2 Type 2 organzatons choose to mantan a low safety level p l no matter whether they decde to connect wth or wthout IOS. Type 1 organzatons wll mantan a low safety level p l f 1 >(p h p l )v, otherwse, they wll mprove ther safety levels to p h. Lemma 2 shows that when an organzaton decdes to connect usng IOS, t only consders ts own cost of nvestment n securty and the losses the externally sourced securty rsk may cause at ts own systems. Other organzatons nter-connecton decsons or securty nvestment decsons wll not affect ts securty nvestment decson. Therefore, the decsons about securty nvestment levels are made n a decentralzed fashon. Then, n order to decde whether to connect ts system to the systems of other organzatons, organzaton wll need to estmate the overall network securty status and the expected rsk based on other organzatons nvestment decsons utlzng the result from Lemma 2. Proposton 1 (1) When 1 (p h p l )v, an organzaton wll connect to all ts busness partners wth IOS only f λ(1 δ)v A [ 1 1 n (n 1 p h + n 2 p l ) p l ] v. It wll connect to ts busness partners wthout IOS f λ(1 δ)v A < [ 1 1 n (n 1 p h + n 2 p l ) p l ] v. (2) When 1 >(p h p l )v, an organzaton wll connect to all ts busness partners wth IOS only f λ(1 δ)v A (1 p l )v. It wll connect to ts busness partners wthout IOS f λ(1 δ)v A < (1 p l )v. Proposton 1 provdes the threshold condtons on when an organzaton wll adopt connectng wth IOS strateges compared to connectng wthout IOS strateges. It s worth notng that n our assumpton, the value of connecton s always postve so that an organzaton s always better off when connectng wthout IOS than not connectng at all. Combnng wth the securty level decsons, we are able to dentfy four possble scenaros, as shown n Fg. 1a d. Table 1 summarzes the frms connecton decsons. In Fg. 1a and b (correspondng to Proposton 1(1), type 1 organzatons wll nvest n a hgh safety level and type 2 organzaton wll nvest n a low safety level, due to the cost of mprovng securty s too hgh for type 2. However, n Fg. 1a, all the organzatons wll

7 Inf Syst Front a) b) organzatons s well protected and nether can they do busness effcently wth IOS due to ther securty concerns. In Secton 3.4, we are able to calculate the welfare level n each scenaro and compare the welfare mprovement when our proposed mechansm s n place. c) d) Type 1 nvest n p h Type 1 nvest n p l Type 2 nvest n p h Type 2 nvest n p l Connectng wth IOS Connectng wthout IOS Fg. 1 Four outcomes wthout ncentve mechansm connect wth each other wth IOS, regardless of ther safety levels, because the hgh beneft of connectng overcomes the expected loss. In Fg. 1b, the organzatons wll nterconnect wthout IOS, due to the fact that the added value s not worth the cost of ncreased securty vulnerablty. In Fg. 1c and d (correspondng to Proposton 1(2), both type 1 and type 2 organzatons wll nvest n a low securty level because the cost of mprovng securty s too hgh for both types. However, n Fg. 1c, all the organzatons wll stll connect wth each other wth IOS even though none of the organzatons has a satsfactory safety level. Ths case can only occur when the added beneft of connectng s really hgh and the expected securty loss s relatvely affordable. In Fg. 1d, the organzatons wll nterconnect wthout IOS, due to the fact that none of the organzatons has provded a satsfactory securty protecton and hence the securty rsk of nterconnecton becomes really severe. Ths scenaro s the worst stuaton that can occur snce none of the 3.3 Implementaton of mechansm wth SCC In ths secton, we consder the case where each organzaton has the choce of whether to partcpate n SCC and comply wth the accountablty constrants. The mplementaton of SCC works as follows. The SCC certfes all the organzatons that decde to jon the consortum. All the network traffcs and actvtes send among the SCC organzatons wll be montored. The certfcaton technologes must be used to guarantee authentcaton and non-repudaton. That s, SCC organzatons are confdent of dentfyng the source of the securty attacks due to authentcaton technologes. A SCC organzaton cannot deny the securty attacks that orgnated from ts network. Meanwhle, t cannot clam that t has suffered securty attacks orgnated from other SCC organzatons when t does not have. Canddate technologes whch fulfll these characterstcs of certfcaton are Publc/Prvate Key Infrastructure, such as dgtal sgnatures. The mplementaton of the SCC mechansm may generate extra overhead to dentfy the organzatons certfcaton status. We gnored such an mpact n our model by assumng that the sze of overhead s neglgble compared to the regular traffc. In stuatons that the assumpton does not hold, we suggest that the SCC adjust the subscrpton fee to accommodate the overhead cost. Although the overhead wll create a deadweght loss whch reduces the value of the SCC mechansm, the loss s nevtable as no securty mechansm s free. Gven the rsng concerns on nterdependent securty rsks, the overhead should not dmnsh the ncentve of organzatons adoptng the SCC mechansm. Snce we assume that organzatons wll enjoy the beneft of added busness effcency f they connect Table 1 Summary of outcomes wthout SCC mechansm 1 (p h p l )v 1 >(p h p l )v λ(1 δ)v A (1 p l )v Fg. 1a: type 1 hgh securty and Fg. 1c: type 1 hgh and type 2 low. type 2 low. All connectng wth IOS All connectng wthout IOS E(1 p)v λ(1 δ)v A Fg. 1a: type 1 hgh securty and Fg. 1d: both type 1 and type 2 low <(1 p l )v type 2 low. All connectng wth IOS securty. All connectng wth IOS λ(1 δ)v A < E(1 p)v Fg. 1d: both type 1 and type 2 low Fg. 1d: both type 1 and type 2 low securty. All connectng wthout IOS securty. All connectng wth IOS

8 InfSystFront wth IOS, they wll always want to do so f there s enough securty protecton. By jonng the communty, the organzaton assumes responsblty for mantanng the securty of the overall communty. Specfcally, f an organzaton connects wth other organzatons usng IOS, t s responsble for all the losses due to securty falures routng va ts own systems. Meanwhle, t collects compensaton f t suffers from securty falure orgnatng from other partcpatng organzatons. As a result, the overall protecton towards the nterdependent rsks nsde the SCC s always better than that outsde of the SCC. Ths fact provdes organzatons wllng to connect wth IOS an added ncentve to jon the SCC. However, f an organzaton decdes not to connect wth SCC, then t really does not have any ncentve to jon SCC snce t cannot hold other organzatons responsble when securty attacks occur, whch must be from ther own network. So we gnore the possblty that an organzaton jons the SCC but decdes not to connect wth IOS. After decdng to jon the communty, each organzaton then decdes on ts safety level and strateges for connectng wth other members of SCC or nonmembers. Defne N n as the set of all the organzatons that partcpate n SCC, we frst ntroduce the followng Lemma 3. Lemma 3 If organzaton has already partcpated n SCC, t wll mantan a hgh safety level f C j N n (p h p l )v. Comparng the result of Lemma 3 to Lemma 1, we observe a hgher threshold of securty mprovement cost for organzatons to stay n low safety level. Therefore, the organzatons are more lkely to mprove ther safety levels when the mechansm s n place. Wthout the mechansm, an organzaton s only concerned about ts own loss due to securty attacks, whch s (p h p l )v. If ts cost of securty mprovement s hgher than that level, t decdes to stay at a low safety level even when such a decson may cause more damage to the other nterconnected organzatons. When t decdes to partcpate n SCC, t wll evaluate not only ts own securty loss but also the expected compensaton that t has to make to other organzatons due to ts poorly mantaned safety level. Therefore, t wll ncrease ts securty level to hgh when the cost to do so s lower than the overall expected compensaton pad towards the partcpatng organzatons, j N n (p h p l )v. We can hence clam that our mechansm provdes stronger ncentves for securty mprovement. Each organzaton, n order to decde whether to partcpate n SCC, needs to evaluate how many other organzatons wll partcpate and what ther connecton and securty decsons are. Such a sgnalng-screenng game may lead to multple equlbra and requres the SCC to coordnate so as to obtan the most effcent equlbrum outcome. In ths paper, we focus on examnng two major types of equlbra: a poolng equlbrum where all the organzatons partcpate n SCC and a separatng outcome where only type 1 organzatons partcpate. Each equlbrum may requre dfferent exstng condtons. In the followng sectons, we wll derve these condtons and analyze the organzatons correspondng safety levels and connectng decsons Poolng outcome: Both types partcpate When both types partcpate, the sze of the overall communty s n and N n = N. Use super-scrpt commp to denote the case when a poolng outcome s obtaned and the organzatons jon the communty. We obtan the net value for an organzaton : U comm p (p ) = V + λ(n 1)V A (1 p )v (1 p j )v C (p ) (5) j N: j = Accordng to Lemma 3 and Condton 2, we can conclude that type 1 organzatons wll always mantan a hgh safety level f they jon the communty. Type 2 organzatons may mantan a hgh safety level f 2 n(1 p l )v. Otherwse, they wll mantan a low safety level. Fgure 2a and b summarze the two poolng outcomes. Fgure 2a descrbes the scenaro that all the organzatons jon SCC and mantan a hgh securty level. Fgure 2b shows the case when they all jon SCC but only type 1 organzatons mantan a hgh securty level and type 2s do not. The followng Proposton 2 shows the condton when each of the the poolng outcomes may hold. Proposton 2 When 2 n(p h p l )v (n 1) max{0, (1 p l )v λ(1 δ)v A }, both types of organzatons wll partcpate n the SCC communty and choose to mplement the hgh safety level. When λ(1 δ)v A (1 p l )v and 2 > n(p h p l )v, both types of organzatons wll partcpate n the SCC communty, but type 2 organzatons wll decde to mantan the low safety level. Under other condtons, the poolng outcomes cannot be supported snce type 2 organzatons wll f nd t better to stay outsde of SCC. The result of Proposton 2 provdes nsght on when each type wll partcpate n SCC. Table 2 summarzes

9 Inf Syst Front a) b) the frms connecton and nvestment decsons n presence of SCC. Generally speakng, type 2 organzatons are more reluctant to mprove ther safety levels due to the hgher securty costs they ncur. In order to keep them n the SCC communty and to hold them accountable for securty loss caused by them, one of the two condtons need to hold: (a) the cost of securty level must be lower than a specfc threshold so that they wll mprove ther safety levels to p h n order to reduce the expected compensaton payout; or, (b) the added value of connecton wth IOS compared to connecton wthout IOS, λ(1 δ)v A must be hgh enough so that they would fnd t worth stayng nsde connected network and compensatng ther partners for the losses caused by ther low safety levels Separatng outcome: Only type 1 organzatons partcpate c) Type 1 nvest n p h Type 1 nvest n p l Type 2 nvest n p h Type-2 nvest n p l Connectng wth IOS Connectng wthout IOS SCC communty network Fg. 2 Outcomes wth ncentve mechansm When the condtons to support poolng outcomes descrbed n above Proposton 2 do not hold, type 2 organzatons may start to leave the communty because t s too costly for them to mantan hgh safety level (.e. 2 s too hgh) and the accountablty has mposed too hgh a burden f they decde to just stay at the low safety level. In such a case, a type 2 organzaton may not be consdered as a good canddate for type 1 organzatons to deploy IOS wth. If that s true, the SCC wll attempt to mantan a smaller nterconnected network wth only type 1 organzatons. In ths case, the total number stayng n the SCC communty s n 1. When type 2 organzatons decde to stay outsde of the SCC communty, type 1 organzatons need to decde whether mantanng IOS connectons wth them s valuable. If a type 1 organzaton decdes to mantan such a connecton, the type 2 organzatons low safety levels may cause trouble to not only ts own systems but also to all the other systems n the SCC network, whch the type 1 organzaton wll be held accountable for. Lemma 4 Atype1 organzaton, f t decdes to stay n SCC communty comprsed of all other type 1 organzatons, wll mantan a hgh safety level, and choose to connect wth type 2 organzatons wthout IOS. Type 2 organzatons, f they decde to stay outsde of the communty, wll be cut off from type 1 organzatons as stated n Lemma 4. They can also have a choce n whether to connect usng IOS wth other Table 2 Summary of the outcomes wth the SCC mechansm λ(1 δ)v A (1 p l )v When 2 n(p h p l )v, Fg. 2a: All jon SCC and connect wth IOS All hgh securty level When 2 > n(p h p l )v, Fg. 2b: All jon SCC and connect wth IOS Only type 1 hgh securty level (1 p h )v λ(1 δ)v A <(1 p l )v When 2 (p h p l )v + (n 1)[λ(1 δ)v A (1 p h )v], Fg. 2a: All jon SCC and connect wth IOS. All hgh securty level When 2 >(p h p l )v + (n 1)[λ(1 δ)v A (1 p h )v], Fg. 2c: Only type 1 jon SCC, connect other SCC members wth IOS, and mantan hgh securty level. Type 2 stay out SCC, connect to all other organzatons wthout IOS, and mantan low securty level λ(1 δ)v A <(1 p l )v No one wll jon SCC due to the low value V A. The mechansm wll not work

10 InfSystFront type 2 organzatons. However, they also do not have an ncentve to do so n ths case snce they wll also be concerned about the securty rsk brought by the other type 2 organzatons as demonstrated n the followng Lemma. Lemma 5 In the separatng outcome, a type 2 organzaton wll mantan a low safety level, and choose not to connect wth other type 2 organzatons wth IOS. Together, Lemmas 4 and 5 descrbe the only possble separatng outcome where only type 1 organzatons wll jon SCC and mantan hgh securty level. Type 2 organzatons wll stay outsde SCC, connected to each other wthout IOS, and nvest n low securty levels. Fgure 2c demonstrates such an outcome. Proposton 3 A separatng outcome descrbed n Fg. 2c s supported when λ(1 δ)v A [ (1 p h )v, (1 p l )v ] and 1 (p h p l )v n 1 λ(1 δ)v A (1 p 1 h )v < 2 (p h p l )v. n 1 When the separatng equlbrum holds, the type 1 organzatons together form an nterconnected network among them. Wthn the nterconnected network, they enjoy effcent connectons wth IOS and the full added value of such connecton. Ther securty rsk s lmted snce all wll mantan hgh safety level. The non-members wll stay outsde such a communty and connect wth ether members or other non-members wthout usng IOS. They choose to do so because they do not want to jon the network by mantanng hgh safety levels or by compensatng the members once ther systems are compromsed and n turn affect other members. Meanwhle, they wll not connect ther IOS wth other non-members snce they know those other non-members are also mantanng low safety levels and connectng wth them wll ntroduce too many securty problems to ther own systems. The separatng equlbrum holds when the value of connectng λ(1 δ)v A s nether too hgh to attract type 2 organzatons nto the communty nor too low to become unattractve to other type 1 organzatons. In addton, the cost of securty mprovement for type 2 must be hgh enough such that they would not want to mprove and the cost mprovement for type 1 must be low enough such that they have ncentve to mprove ther safety levels and stay n the network. 3.4 Outcomes and Effcency Comparson Now we have ntroduced all the seven outcomes, ncludng four outcomes when there s no ncentve mechansm and three outcomes when the mechansm s ntroduced. We next compare the outcomes wth SCC and wthout SCC and evaluate the effcency change. The analyss helps examne the value of our mechansm as an ncentve mechansm (to mprove securty) or as a sgnalng tool or as both. We can also dentfy when and why our mechansm generates hgher welfare levels. Comparng the condtons that support each outcome, we dentfed nne scenaros wth dfferent possble changes of outcomes from the network wthout mechansm to the network wth mechansm. In each of them, our mechansm may play a dfferent role. We dscuss those nne possble changes one by one, by frst ntroducng the condtons and then dscussng the changes n decsons by both types of organzatons. We wll also quantfy the welfare mprovement for each case. Table 3 summarzes the followng scenaros n terms of the condtons they hold, and the change of cases when there s no SCC to when SCC s mplemented. Table 3 Summary of the changes from no SCC to SCC 1 (p h p l )v 1 >(p h p l )v λ(1 δ)v A (1 p l )v When 2 n(p h p l )v, When 2 n(p h p l )v, Scenaro 1 (Fg. 1a Fg. 2a) Scenaro 6 (Fg. 1c Fg. 2a) When 2 > n(p h p l )v, When 2 > n(p h p l )v, Scenaro 2 (Fg. 1a Fg. 2b) Scenaro 7 (Fg. 1c Fg. 2b) E(1 p)v λ(1 δ)v A When 2 (p h p l )v + (n 1)[λ(1 δ)v A When 2 (p h p l )v + (n 1)[λ(1 δ)v A <(1 p l )v (1 p h )v], Scenaro1(Fg.1a Fg. 2a) (1 p h )v], Scenaro 8 (Fg. 1d Fg. 2a) When 2 >(p h p l )v + (n 1)[λ(1 δ)v A When 2 >(p h p l )v + (n 1)[λ(1 δ)v A (1 p h )v], Scenaro3(Fg.1a Fg. 2c) (1 p h )v], Scenaro 9 (Fg. 1d Fg. 2c) (1 p h )v λ(1 δ)v A When 2 (p h p l )v + (n 1)[λ(1 δ)v A When 2 (p h p l )v + (n 1) < E(1 p)v (1 p h )v], Scenaro4(Fg.1b Fg. 2a) (1 p h )v], Scenaro 8 (Fg. 1d Fg. 2a) When 2 >(p h p l )v + (n 1)[λ(1 δ)v A When 2 >(p h p l )v + (n 1)[λ(1 δ)v A (1 p h )v], Scenaro5(Fg.1b Fg. 2c) (1 p h )v], Scenaro 9 (Fg. 1d Fg. 2c) λ(1 δ)v A <(1 p l )v No one wll jon SCC due to the low value V A. The mechansm wll not work

11 Inf Syst Front Scenaro 1 When λ(1 δ)v A E(1 p)v, 3 1 (p h p l )v, and 2 n(p h p l )v (n 1) max{0,(1 p l )v λ(1 δ)v A }: Wthout the mechansm: these condtons wll lead type 1 organzatons to choosng a hgh safety level but type 2 to choosng a low safety level. Snce organzatons cannot dentfy whch of the others are of type 1, they have to make ther connecton decsons based on the expected safety level. When λ(1 δ)v A E(1 p)v, they connect to all other organzatons usng IOS even knowng some have a low safety level. (The outcome s descrbed n Fg. 1a) Wth the SCC mechansm: type 2 wll fnd t worthwhle to mprove ts safety level and partcpate n the SCC. Ths s because the mechansm does not allow them to free rde the type 1 organzatons. They need to be accountable for ther own losses. In fact, type 2 also beneft from ths outcome snce the SCC provdes a safe envronment to them as well. (The outcome s descrbed n Fg. 2a) Improvement of welfare = n 2 n(p h p l )v n 2 2, whch s composed of the total reduced securty loss of the network less the total cost for type 2 organzatons to mprove securty. The mprovement s strctly postve. Scenaro 2 (p h p l )v: When λ(1 δ)v A (1 p l )v, and 1 Wthout the mechansm: same outcome as descrbed n the frst case. (Fg. 1a) Wth the SCC mechansm: type 2 stll fnds mprovng ts safety level s too costly and hence stays at a low safety level. However, snce the value of connectng wth IOS s hgh, they wll stll jon the SCC communty. (Fg. 2b) Improvement of welfare = 0. There s no change n connecton and securty decsons for both types of organzatons. Ths s because the decsons are already effcent under the parameters. However, one notable ssue wthout the mechansm was that type 1 wll suffer from the low safety level mantaned by type 2 organzatons. Wth the SCC n place, type 2 wll compensate type 1 s losses for connectng wth them. Such a re-allocaton of net values ntroduces farness as type 2 organzatons take responsblty for the losses caused by ther own decsons to stay at a low safety level. 3 Here, we defne E(1 p)v as the expected loss when the type p s not know. Therefore, E(1 p) =[n 1 (1 p h ) + n 2 (1 p l )]/n. Scenaro 3 When λ(1 δ)v A [ E(1 p)v, (1 p l )v), 1 (p h p l )v, and 2 >(p h p l )v + (n 1) [λ(1 δ)v A (1 p h )v ] : Wthout the mechansm: same outcome as descrbed n the frst case. (Fg. 1a) Wth the SCC mechansm: type 2 stll fnds mprovng ts safety level costly and hence stays at a low safety level. In addton, snce the value of connectng wth other organzatons wth IOS s lower than the above case 2, type 2 organzatons wll also fnd that t s not worth payng the compensaton and stayng n the SCC communty. Therefore, they wll stay out. Meanwhle, type 1 wll stay n the SCC communty, nvest n a hgh safety level, and connect wth other type 1 organzatons wth IOS, connect wth those non-members (.e.type 2 organzatons) wthout IOS (Fg. 2c) [ Improvement of welfare = n 2 n1 (1 p h ) + (n 1)(1 p l ) ] v n 2 (n 1 +n 1) λ(1 δ)v A. The frst term s the expected reducton of securty loss and the second term s the loss due to dsconnectng the type 2 organzatons from the IOS. The change of welfare wll be postve f the number of type 1 organzatons (.e. the sze of SCC communty) n s large enough: 1 n 1 < (1 p l)v λ(1 δ)v A λ(1 δ)v A (1 p h.the value of )v the SCC under ths condton s to help separate the low safety ones to ensure secure connectons (avod unsafe connectons). Scenaro 4 When λ(1 δ)v A [ (1 p h )v, E(1 p)v), 1 (p h p l )v, and 2 (p h p l )v + (n 1) [λ(1 δ)v A (1 p h )v ] : Wthout the mechansm: type 1 organzatons wll choose a hgh safety level but type 2 wll choose low. Snce the organzatons cannot dentfy whch of the others are of type 1, they make connecton decsons based on the expected safety levels and now they decde not to connect wth IOS snce the expected value of connectng s too low to cover the securty loss. (Fg. 1b) Wth the SCC mechansm: type 2s wll fnd t worthwhle to mprove ther safety levels and partcpate n the SCC so the expected network rsk s lower and both types wll partcpate n the SCC communty. (Fg. 2a) Improvement of welfare = n(n 1) [ λ(1 δ)v A (1 p h )v ] + n 2 [ (ph p l )v 2 ]. The frst term represents the total mproved net value of more effcent connectons less the added rsks when they are nterconnected. The second term s for type 2 organzatons to mprove ther safety levels. Our mechansm, under ths condton, effcently

12 InfSystFront provdes type 2 organzatons wth ncentves to mprove securty, allevates the securty concerns, and nduces effcent connectons. Scenaro 5 When λ(1 δ)v A [ (1 p h )v, E(1 p)v), 1 (p h p l )v, and 2 >(p h p l )v + (n 1) [λ(1 δ)v A (1 p h )v ] : Wthout the mechansm: ths case s the same as the above case 4, where the network s not connected usng IOS. (Fg. 1b) Wth the SCC mechansm:type 2 wll stay outsde due to ther hgh cost of securty mprovement. Type 1 s then able to dentfy the other hgh type partners and form more effcent connectons wth them. (See Fg. 2c) Improvement of welfare = n 1 (n 1 1) [ λ(1 δ)v A (1 p h )v ], representng the mproved connectons among the n 1 type 1 organzatons. Scenaro 6 When λ(1 δ)v A (1 p l )v, 1 >(p h p l )v, and 2 n(p h p l )v: Wthout the mechansm: both types wll choose a low safety level due to ther cost concerns. However, they are stll connected va IOS snce the value of connecton s hgh. Ths s the case where organzatons expect the largest securty loss from the network. (See Fg. 1c) Wth the SCC mechansm: both types fnd t worthwhle to mprove ther safety levels to hgh and partcpate n the SCC. The mechansm provdes ncentve for both to mprove securty. (The outcome s descrbed n Fg. 2a) Improvement of welfare = n 2 (p h p l )v n 1 1 n 2 2, whch s composed of the total reduced securty loss less the costs for both types of organzatons. Scenaro 7 When λ(1 δ)v A (1 p l )v, 1 >(p h p l )v, and 2 > n(p h p l )v (n 1) max{0,(1 p l )v λ(1 δ)v A }: Wthout the mechansm: same outcome as descrbed n the frst case. (Fg. 1c) Wth the SCC mechansm: type 1 organzatons fnd t worthwhle to mprove ther safety level to hgh and partcpate n the SCC whle type 2 wll also partcpate but reman at low safety levels due to ther hgh costs of mprovng securty. The mechansm provdes ncentves only for type 1 to mprove securty. (Fg. 2b) Improvement of welfare = n 1 [ n(ph p l )v 1 ], representng the mproved securty of type 1 organzatons. Scenaro 8 When λ(1 δ)v A [ (1 p h )v, (1 p l )v), 1 >(p h p l )v, and 2 (p h p l )v + (n 1) [ λ(1 δ)v A (1 p h )v ] : Wthout the mechansm: both types wll choose a low safety level due to ther cost concerns. In addton, they wll not connect ther IOS snce the value ganed s not worth the expected loss of securty. (Fg. 1d) Wth the SCC mechansm: both types fnd t worthwhle to mprove ther safety levels to hgh and partcpate n the SCC (Fg. 2a) Improvement of welfare =n(n 1) [ λ(1 δ)v A (1 p l )v ] +n 2 (p h p l )v n 1 1 n 2 2, snce both types have mproved ther securty and connecton decsons. Scenaro 9 When λ(1 δ)v A [ (1 p h )v, (1 p l )v), (p h p l )v < 1 (p h p l )v + (n 1 1) [ λ(1 δ)v A (1 p h )v ],and 2 (p h p l )v + (n 1) [ λ(1 δ)v A (1 p h )v ] : Wthout the mechansm: both types wll choose low safety levels due to ther cost concerns. In addton, they wll not connect ther IOS snce the value ganed s not worth the expected loss of securty. (Fg. 1d) Wth the SCC mechansm: type 1 wll partcpate and nvest n mprovng safety level but type 2 wll not. (Fg. 2c) Improvement of welfare = n 1 (n 1 1) [ λ(1 δ)v A (1 p h )v ] +n 1 [(p h p l )v 1 ], representng type 1 s mproved connecton effcency wth other type 1 organzatons and ther mproved securty. 4 Concludng remarks Organzatons are ncreasngly usng IOS to realze ncreased value from more effcent collaboratons. For example, personnel from one organzaton can have access to the nformaton systems of a busness partner to query ts nventory level or transacton hstory. Sales executves from one organzaton can query ts busness partner s customer nformaton va ther CRM data portal. Lnkng nformaton systems across organzatonal boundares has enabled effcent busness process ntegraton, such as n supply chan management n vertcal ndustres, B2B transactons, outsourcng relatonshps, and n strategc allances. As the mportance of fosterng busness eco-systems s ncreasngly recognzed, nformaton system nterconnectons are dentfed as the substrate to buld such systems on. In partcular, many such eco-systems rely