When Hackers Talk: Managing Information Security Under Variable Attack Rates and Knowledge Dissemination

Vijay Mookerjee (), Radha Mookerjee (), Alain Bensoussan () and Wei T. Yue ()
Additional contact information
Vijay Mookerjee: School of Management, The University of Texas at Dallas, Richardson, Texas 75083
Radha Mookerjee: School of Management, The University of Texas at Dallas, Richardson, Texas 75083
Alain Bensoussan: School of Management, The University of Texas at Dallas, Richardson, Texas 75083
Wei T. Yue: City University of Hong Kong, Kowloon Tong, Hong Kong, People's Republic of China

Information Systems Research, 2011, vol. 22, issue 3, 606-623

Abstract: This paper analyzes interactions between a firm that seeks to discriminate between normal users and hackers that try to penetrate and compromise the firm's information assets. We develop an analytical model in which a variety of factors are balanced to best manage the detection component within information security management. The approach not only considers conventional factors such as detection rate and false-positive rate, but also factors associated with hacker behavior that occur in response to improvements in the detection system made by the firm. Detection can be improved by increasing the system's discrimination ability (i.e., the ability to distinguish between attacks and normal usage) through the application of maintenance effort. The discrimination ability deteriorates over time due to changes in the environment. Also, there is the possibility of sudden shocks that can sharply degrade the discrimination ability. The firm's cost increases as hackers become more knowledgeable by disseminating security knowledge within the hacker population. The problem is solved to reveal the presence of a steady-state solution in which the level of system discrimination ability and maintenance effort are held constant. We find an interesting result where, under certain conditions, hackers do not benefit from disseminating security knowledge among one another. In other situations, we find that hackers benefit because the firm must lower its detection rate in the presence of knowledge dissemination. Other insights into managing detection systems are provided. For example, the presence of security shocks can increase or decrease the optimal discrimination level as compared to the optimal level without shocks.

Keywords: optimal security management; variable attack rates; hacker learning; security shocks (search for similar items in EconPapers)
Date: 2011
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (14)

Downloads: (external link)
http://dx.doi.org/10.1287/isre.1100.0341 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:orisre:v:22:y:2011:i:3:p:606-623

Access Statistics for this article

More articles in Information Systems Research from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().