Economics and optimal investment policies of Attackers and Defenders in cybersecurity

Abstract

Our thesis is that economics and investment policies are vital factors in determining the outcome of cybersecurity conflicts. For our economic framework, we borrow from the pioneering work of Gordon and Loeb, in which the Defender optimally trades off investments for lower likelihood of its system breach. Our two-sided model has in addition an Attacker, assumed to be rational and also guided by economic considerations in its decision-making, to which the Defender responds. The model is a simplified adaptation of a model proposed during the Cold War for weapons deployment in the USA. Our model is a Stackelberg game and, from an analytic perspective, a Max–Min problem. The complexity of the analysis is due to the non-convexity of the objective function in the optimization. The Attacker’s possible actions add substantially to the risk to the Defender, and the Defender’s rational, risk-neutral optimal investments in general substantially exceed the optimal investments predicted by the one-sided Gordon–Loeb model. We obtain a succinct set of three decision types that categorize all of the Defender’s optimal investment decisions. Also, the Defender’s optimal decisions exhibit discontinuous behavior as the prior vulnerability of its system is varied. Results for two limiting cases of the model corresponding to an Extreme Attacker and an Extreme Defender are given. The analysis is supplemented by extensive numerical illustrations. The results from our model open several major avenues for future work.