Week 6 Exercises: Solving Information Asymmetry

Key Definitions

Information Asymmetry exists when two actors are in a situation when their decisions affect each other, and one of them has relevant information that the other one lacks. “Relevant” information is information that might affect their decision.

Moral Hazard happens when people know that they are being protected; they will often (rationally) choose to engage in riskier behaviors because of that protection. This is also known as hidden action situation.

Adverse Selection happens when the people who have more information get to choose whether they will participate (e.g. buy insurance). In that case, mostly it is only people who know they are high risk that will choose to participate. This is also known as a hidden information situation.

Market for Lemons is an example of what happens when information asymmetry and adverse selection are in a market: the potential exists to drive away all of the low risk / “good” participants and only leave the highest risk / “worse” participants. This can make it worse for everyone involved, though no individual in the market can fix it.

Inherent Information Asymmetry

ALL of cybersecurity has an inherent information asymmetry: attackers try to keep their attacks secret.

Is there also asymmetry in the other direction? Do defenders try to keep their defenses secret? Is that a good idea?

  • This concept is known as “Security by Obscurity”
  • Why does it work better for attackers than defenders?

Potential Solutions

  • Regulation: Require information sharing in specific situations.
    • Challenge: Which situations? How to enforce? Is it enough to solve information asymmetry problem?
  • Lemons Laws: Have a minimum standard of quality, and require companies to compensate people who receive defective products
    • Challenge: Raises floor, but still means most/all products are at the floor
    • Challenge: Must have clearly defined “quality” measures
  • Signalling: People with information can find a way to credibly signal their information
    • Example: School signals that you are the kind of person that school is easier for
    • Challenge: Only works if people can credibly signal, and if others can understand signals
  • Warranties: People with good products can offer a warranty for defects.
    • What is the equivalent of a warranty in cybersecurity?
  • Insurance: People with less information can buy insurance to cover losses
    • Usually requires protective measures – brings everyone up to a minimum
    • Challenge: Doesn’t work with correlated risks