Economics of Ransomware: Risk Interdependence and Large-Scale Attacks

Forthcoming in Management Science Earlier Version Presented at WISE 2017, CIST 2018, and WEIS 2019

140 Pages Posted: 3 Apr 2019 Last revised: 15 Nov 2021

See all articles by Terrence August

Terrence August

University of California, San Diego (UCSD) - Rady School of Management

Duy Dao

University of California, San Diego (UCSD) - Rady School of Management; University of Calgary - Haskayne School of Business

Marius Florin Niculescu

Georgia Institute of Technology - Scheller College of Business

Date Written: November 5, 2021

Abstract

Recently, the development of ransomware strains as well as changes in the marketplace for malware have greatly reduced the entry barrier for attackers to conduct large-scale ransomware attacks. In this paper, we examine how this mode of cyberattack impacts software vendors and consumer behavior. When victims face an added option to mitigate losses via a ransom payment, both the equilibrium market size and the vendor's profit under optimal pricing can actually increase in the ransom demand. Profit can also increase in the scale of residual losses following a ransom payment (which reflect the trustworthiness of the ransomware operator). We show that for intermediate levels of risk, the vendor restricts software adoption by substantially hiking up price. This lies in stark contrast to outcomes in a benchmark case involving traditional malware (non-ransomware) where the vendor decreases price as security risk increases. Social welfare is higher under ransomware compared to the benchmark in both sufficiently low and high-risk settings. However, for intermediate risk, it is better from a social standpoint if consumers do not have an option to pay ransom. We also show that the expected ransom paid is non-monotone in risk, increasing when risk is moderate in spite of a decreasing ransom-paying population. For ransomware attacks on other vectors (beyond patchable vulnerabilities), there can still be an incentive to hike price. However, market size and profits instead weakly decrease in the ransom amount. When studying a generalized model that includes both traditional and ransomware attacks, our results remain robust to a wide range of scenarios, including threat landscapes where ransomware has only a small presence.

Keywords: software security, software patching, ransomware, large-scale cyberattacks, network externalities, interdependent risk

JEL Classification: L86, L19, D11, D40

Suggested Citation

August, Terrence and Dao, Duy and Dao, Duy and Niculescu, Marius Florin, Economics of Ransomware: Risk Interdependence and Large-Scale Attacks (November 5, 2021). Forthcoming in Management Science Earlier Version Presented at WISE 2017, CIST 2018, and WEIS 2019, Available at SSRN: https://ssrn.com/abstract=3351416 or http://dx.doi.org/10.2139/ssrn.3351416

Terrence August

University of California, San Diego (UCSD) - Rady School of Management ( email )

9500 Gilman Drive
Rady School of Management
La Jolla, CA 92093
United States

HOME PAGE: http://management.ucsd.edu/faculty/directory/august/

Duy Dao (Contact Author)

University of Calgary - Haskayne School of Business ( email )

University Drive
Calgary, Alberta T2N 1N4
Canada

University of California, San Diego (UCSD) - Rady School of Management ( email )

9500 Gilman Drive
Rady School of Management
La Jolla, CA 92093
United States

Marius Florin Niculescu

Georgia Institute of Technology - Scheller College of Business ( email )

800 West Peachtree St.
Atlanta, GA 30308
United States
404-385-3105 (Phone)

HOME PAGE: http://scheller.gatech.edu/directory/faculty/niculescu/index.html

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
701
Abstract Views
2,991
rank
53,208
PlumX Metrics