Managing Interdependent Information Security Risks: Cyberinsurance, Managed Security Services, and Risk Pooling Arrangements
Journal of Management Information Systems, Forthcoming
48 Pages Posted: 20 Apr 2010 Last revised: 13 Jul 2013
Date Written: March 11, 2013
Abstract
The interdependency of information security risks often induces firms to invest inefficiently in IT security management. Cyberinsurance has been proposed as a promising solution to help firms optimize security spending. However, cyberinsurance is ineffective in addressing the investment inefficiency caused by risk interdependency. In this paper, we examine two alternative risk management approaches: risk pooling arrangements (RPAs) and managed security services (MSSs). We show that firms can use an RPA as a complement to cyberinsurance to address the overinvestment issue caused by negative externalities of security investments; however, the adoption of an RPA is not incentive-compatible for firms when the security investments generate positive externalities. We then show that the MSS provider (MSSP) serving multiple firms can internalize the externalities of security investments and mitigate the security investment inefficiency. As a result of risk interdependency, collective outsourcing arises as an equilibrium only when the total number of firms is small.
Keywords: information security, cyberinsurance, risk pooling, risk management, managed security service, economics of information systems
Suggested Citation: Suggested Citation
Do you have a job opening that you would like to promote on SSRN?
Recommended Papers
-
Sharing Information on Computer Systems Security: An Economic Analysis
By Lawrence A. Gordon, Martin P. Loeb, ...
-
The Impact of the Sarbanes-Oxley Act on the Corporate Disclosures of Information Security Activities
By Lawrence A. Gordon, Martin P. Loeb, ...
-
Information Security Expenditures and Real Options: A Wait-and-See Approach
By Lawrence A. Gordon, Martin P. Loeb, ...
-
The Economic Incentives for Sharing Security Information
By Anindya Ghose and Esther Gal-or
-
By Joseph Canada, J. Randel Kuhn, ...
-
SOX: Unintended Dilemmas for Auditing
By Jonathan E. Duchac, Edward B. Douthett, ...
-
Optimal Risk Sharing with Limited Liability
By Semyon Malamud, Huaxia Rui, ...
-
A Strategic Analysis of Information Sharing Among Cyber Attackers
By Anindya Ghose and Kjell Hausken
-
Assessing the Value of Network Security Technologies
By Huseyin Cavusoglu and Hasan Cavusoglu
-
Experiences and Challenges with Using CERT Data to Analyze International Cyber Security
By Stuart Madnick, Xitong Li, ...