Information Asymmetry

This week, we are going to look into another particularly difficult economics issue that arises frequently in cybersecurity: information asymmetry. Information asymmetry is basically the study of what happens when two people are interacting somehow (i.e. their decisions affect each other), but one person has more relevant information about the decisions than the other person.

We are going to continue to use the two sources over the next few weeks: Tyler Moore’s paper on Security Economics (that we started last week) and Ross Anderson’s book on Security Engineering.

Start today by reading a small section from the book Security Engineering by Ross Anderson. For today, just read section 8.3.3 of Anderson’s book which also also goes into that same concept, and introduces two other ideas that are direct results of information asymmetry: moral hazard and adverse selection. I also recommend reading those two Wikipedia articles to help you understand these two concepts.

Next, let’s go back and read Moore’s paper on Security Economics that we started last week. Begin by reading section 3.2 (information asymmetry). This section continues explaining the idea of information asymmetry.

Next, we are going to be spending more time this week thinking about possible policy solutions: how do we use these ideas to come up with new approaches to stopping cyber attacks and new solutions to make the world a safer and more secure place? To do that, read in Moore’s paper about three general approaches that are commonly discussed in cybersecurity: requiring information disclosure to eliminate an information asymmetry (Moore section 4.1.2); using cyber insurance to motivate security (Moore section 4.1.3); and assigning liability to indirect intermediaries (Moore section 4.1.4).

Finally, read sections 4.3, 4.4, and 4.5, which are all examples of trying to use these solutions to address real-world problems in cybersecurity.

For this week’s summary + question, I want you to think about information, and the ways information affects cybersecurity. Specifically, think about who has what information, and how that matters. This is the central question in information asymmetry – one person has important information another does not, and that allows them to do things that they otherwise could not. This happens all of the time. Try to identify at least one additional information asymmetry that happens somewhere in cybersecurity, and describe why you think it is an information asymmetry.

Optional: There is a good research paper that uses the framework of information asymmetry to discuss privacy and personal data protection: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1522605

Optional 2: Here is an interesting paper that argudes that adverse selection affects technology adoption for trust. https://dl.acm.org/doi/10.1145/1593254.1593286