Misaligned Incentives

This week we begin our discussion of information economics issues that have a big influence in cybersecurity. We will also be looking into ways that we can use this knowledge to suggest policy solutions to some cybersecurity problems.

First, I want you to read some economics theory that will help us talk about and think about cybersecurity. In class so far, we have been talking about motivations and trying to understand why people do things that they do. We have been talking about these motivations in isolation, without looking at how other people’s choices affect those motivations.

The field of economics looks at strategic interactions in motivations and choices. How do a defenders motivations and choices change based on what the attackers are doing? How do defenders motivations and choices change based on what other defenders are doing? How do attackers motivations and choices change based on what defenders do? How do attackers motivations and choices change based on what other attackers do? And when this iterates, what happens? If I change my decision based on your decision, and then you change your decision based on mine, then I might want to change again, and so on.

Over the next three weeks, our readings are going to be split across two sources. First, there is a summary paper by Tyler Moore about the economics of cybersecurity. That chapter is freely available. And second there is a chapter on security economics in the book Security Engineering by Ross Anderson. The book is a bit dated – its main examples are 20 years old – but it does a good job of describing the basic economics principles, and using them to discuss cybersecurity issues that are now considered to be well-understood but still happening. This book is available online through the UW Library (though you may need to search for “Security Engeering” on the UW Library website and click through before these links work).

Start reading part of the paper about the economics of cybersecurity. Don’t read the whole thing right now, though; we’ll be breaking it into parts and reading different parts of it over the next three weeks. For this week, please read Sections 1 and 2 for background. Then read section 3.1 (p. 5-6) to start learning about a basic problem in economics, misaligned incentives; section 4.1.1 (ex ante vs. ex post, p.8-10) to start thinking about general ways to solve this problem, and section 4.2 (p. 15-20) to look at this solution around a specific cybersecurity problem (botnets).

Also for today, just read section 8.6.6 of Anderson’s book. This section has a number of real-world examples of misaligned incentives in security situations. It is short, but worthwhile for its examples that help us understand how this abstract concept plays out in the real world.

Finally, submit a summary + question for this week. For the summary, let’s combine the two. Consider the botnet problem – lots of consumers own Internet-connected devices (aka computers) that are vulnerable to hacking. A hacker might want to break into many of these and combine them into a network that are all under their control. Please try to summarize why this is a situation of misaligned incentives. What are the incentives of the hacker? What are the incentives for the consumers? Are they aligned? Why or why not?