Week 5 Exercises: Incentive Alignment

Today we are going to talk about misaligned incentives in cybersecurity.

Misaligned incentives happen when the “guard” – the person doing the protection – isn’t the same person, group, or organization that suffers from harms if/when a cyberattack occurs.

Incentive Alignment Situations

For each these situations, ask yourself:

1) Who is harmed by the attack?
2) Who is in the best position to defend against this attack? Why?

Then, identify whether this is a situation of “incentive alignment” – when the person harmed is the best defender against the attack – or if this is a situation of “misaligned incentives” – when the best defender does not suffer the majority of harm.

If this is a situation of misaligned incentives, next, ask yourself: is there a reasonable rule / policy / law that we could put in place that would cause the incentives to be aligned?

Situation 1: Click Fraud

Google runs an advertising service. Advertiser pay Google to serve ads on webpages; each time someone clicks on an ad from a specific advertiser, that advertiser pays Google for the click. If they want to, each webpage, then, can ask Google to put ads on their webpage. Each time someone visits their webpage, Google displays ads to that person. If the person clicks on the ad, then Google will pay the webpage for the click (from the money the advertiser pays for the click, while keeping part of the money for itself). Google is a middleman between the advertisers and the webpages.

A hacker has figured out a way to write a program to “pretend” to click on ads. The hacker sets up a webpage, and asks Google to put a bunch of ads on the webpage. The hacker then uses their program to “click” on the ads over and over, thousands of times per day, and then keeps all of the money that Google pays for those clicks.

Situation 2: Ransomware

You have a bunch of personal data on your computer – your bank info, your passwords, pictures of your family, your homework, etc. A hacker breaks into your computer and looks around and sees that personal information. They encrypt that information (so you can’t access it anymore), and then they contact you and offer to sell you the decryption program/key for $1000.

Situation 3: DDoS / Booters

You are playing an internet-based game with some of your friends, and there are lots of others (strangers) also playing in the same game space. One of the other people on the game (that you don’t know) gets upset and angry at something you did. They go on the Internet and find a “booter” service. This booter service has access to a large network of 10,000 computers that they have hacked into. The angry gamer pays this booter service $50, and this booter service has all of the computers in its network try to connnect to your computer / game system at the same time. This overwhelms your Internet connection and causes your game to drop its connection.

Situation 4: Employer Ransomware

You work for a large organization (like UW). As part of your job, you are supposed to use a computer that the organization provides to you to do your work (e.g. programming, accounting, email, etc.). Because of this, your computer has a lot of information on it that is sensitive and secret to the organization.

A hacker breaks into your computer and looks around and sees that sensitive information. They consider a standard ransomware attack, where they encrypt that information, and then contact you to try to sell you the decryption program/key. But, instead, they decide that rather than target you (a low-level employee without much money), they will instead target your employer (the large organization).

They first download all of the sensitive data from your computer so they have a copy. Then they encrypt all of that data on your computer so you can’t use your computer. They then contact your employer, and make an offer: if the employer pays them $100,000, then the hacker will delete their copy of the data and provide the decryption program/key. if the employer doesn’t pay, then the hacker will publish their copy of the secret/sentisive data publicly for the world to see.

Situation 5: Bug finding

Microsoft makes Office 365, which includes Microsoft Outlook. Outlook is used by a LOT of organizations, including the US government, to send and receive very sensitive information via email, including information that is protected by law (such as personal information of students for universities, and nuclear secrets for the government).

No software if perfect, and all software has bugs, including Outlook. Some of those bugs can be exploited by hackers to break into Outlook at steal information (these are called “vulnerabilities”). A hacker finds one of these vulnerabilities in Outlook. They then use that vulnerability to break into the US Department of Energy and steal nuclear secrets and try to sell those secrets to foreign governments.

Microsoft hears that this is happening, but they don’t know what the vulnerability is in outlook that the hackers are using. Microsoft considers spending a lot of money looking through the code for Outlook to try to find that vulnerability. But they decide that this is too expensive, and choose to wait until someone else figures out the vulnerability and reports it to them.