CT-ISG: The Economics of Internet Security: Theoretical and Empirical Analysis

CT-ISG：互联网安全经济学：理论与实证分析

• 批准号: 0627399
• 负责人: Alfredo Garcia
• 金额: $ 37.32万
• 依托单位: University of Virginia Main Campus
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-01-01 至 2010-12-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627399&HistoricalAwards=false
• 关键词: CT; ISG; Economics; Internet; Security

With the continuing growth of the use of the Internet for business purposes, the consequences of a possible cyber attack that could create a large scale outage of long time duration is an increasingly important economic issue. In 2003, the President's National Strategy to Secure Cyberspace stated that government action is warranted where alleged "market failures result in underinvestment in cyber security". However, there is scant empirical evidence and/or theoretical support for such "market failure". While there exists a large body of technical literature on cyber security, research on the economics of cyber security is still in its very early stages.This project contributes to a better understanding of the economics of Internet security through a combination of theoretical and empirical research efforts. First, the economic motivations for investment in added Internet security by Internet Service Providers (ISPs) are analyzed using game theoretic models. Customer's sensitivity to quality of service and depreciation of investments in added security play key roles in determining the ISPs' investment incentives. However, these incentives may not be perfectly aligned with the social value (derived from Internet usage) at stake during a cyber attack. Empirical research is undertaken to estimate to what extent private incentives for investment may lead to a situation of underinvestment in cyber security.The results of this research project will have a broader impact in informing the process of regulatory policy-making towards securing cyberspace. In addition, the interplay between the economic and technological issues associated with the provision of Internet will be the subject of a number of educational initiatives both at graduate and undergraduate levels. These include: a graduate seminar on cyber security, new material for existing courses in E-commerce and the economics of engineering systems and "Capstone" projects (senior theses). The research findings will be reported in the project web site (http://www.people.virginia.edu/~ag7s/economics_of_internet_security.htm

随着互联网在商业用途中的使用不断增长，可能造成大规模长时间中断的网络攻击的后果已成为一个日益重要的经济问题。 2003 年，总统的网络空间安全国家战略指出，在所谓的“市场失灵导致网络安全投资不足”的情况下，政府有必要采取行动。然而，这种“市场失灵”的经验证据和/或理论支持很少。虽然存在大量有关网络安全的技术文献，但网络安全经济学的研究仍处于早期阶段。该项目通过理论和实证研究工作的结合，有助于更好地理解互联网安全的经济学。首先，使用博弈论模型分析了互联网服务提供商 (ISP) 投资增加互联网安全的经济动机。客户对服务质量的敏感性以及增加安全性的投资折旧在确定 ISP 的投资激励方面发挥着关键作用。然而，这些激励措施可能与网络攻击期间所面临的社会价值（源自互联网使用）并不完全一致。实证研究旨在估计私人投资激励在多大程度上可能导致网络安全投资不足的情况。该研究项目的结果将在为确保网络空间安全的监管政策制定过程提供信息方面产生更广泛的影响。此外，与提供互联网相关的经济和技术问题之间的相互作用将成为研究生和本科生教育举措的主题。其中包括：网络安全研究生研讨会、电子商务现有课程的新材料以及工程系统经济学和“Capstone”项目（高级论文）。研究结果将在项目网站 (http://www.people.virginia.edu/~ag7s/economics_of_internet_security.htm