Dynamic competition in IT security: A differential games approach

Abstract

Hackers evaluate potential targets to identify poorly defended firms to attack, creating competition in IT security between firms that possess similar information assets. We utilize a differential game framework to analyze the continuous time IT security investment decisions of firms in such a target group. We derive the steady state equilibrium of the duopolistic differential game, show how implicit competition induces overspending in IT defense, and then demonstrate how such overinvestment can be combated by innovatively managing the otherwise misaligned incentives for coordination. We show that in order to achieve cooperation, the firm with the higher asset value must take the lead and provide appropriate incentives to elicit participation of the other firm. Our analysis indicates that IT security planning should not remain an internal, firm-level decision, but also incorporate the actions of those firms that hackers consider as alternative targets.

Appendix

1.1 Proof for proposition 1

Proof : in the symmetric case, we can rewrite (14) as

$$ \frac{{\beta NL\gamma }}{2}{x^2} + \frac{{\beta NL}}{2}x - \frac{\rho }{x} - r = 0 $$

Let $K = \frac{{\beta NL\gamma }}{2}{x^2} + \frac{{\beta NL}}{2}x - \frac{\rho }{2} - r$ . We have the results of comparative statistics as follows.

$$ \frac{{dx}}{{d\gamma }} = - \frac{{\partial K/\partial \gamma }}{{\partial K/\partial x}} = - \frac{{\beta NL{x^2}/2}}{{\beta NL\gamma x + \beta NL/2 + \rho /{x^2}}} < 0;\frac{{dx}}{{dL}} = - \frac{{\partial K/\partial L}}{{\partial K/\partial x}} = - \frac{{\beta N\gamma {x^2}/2 + \beta Nx/2}}{{\beta NL\gamma x + \beta NL/2 + \rho /{x^2}}} < 0 $$

$$ \frac{{dx}}{{d\beta }} = - \frac{{\partial K/\partial \beta }}{{\partial K/\partial x}} = - \frac{{NL\gamma {x^2}/2 + NLx/2}}{{\beta NL\gamma x + \beta NL/2 + \rho /{x^2}}} < 0;\;\frac{{dx}}{{d\rho }} = - \frac{{\partial K/\partial \rho }}{{\partial K/\partial x}} = - \frac{{ - 1/x}}{{\beta NL\gamma x + \beta NL/2 + \rho /{x^2}}} > 0 $$

Since ${S_A} = {S_B} = S = \rho /\left( {\beta X} \right)$ from (1) and (2), we have dS/dx < 0. Therefore, it holds that $dS/dL = \left( {dS/dx} \right)\left( {dx/dL} \right) > 0$, and $dS/d\gamma = \left( {dS/dx} \right)\left( {dx/d\gamma } \right) > 0$.

$$ \frac{{dS}}{{d\rho }} = \frac{{\partial S}}{{\partial \rho }} + \frac{{\partial S}}{{\partial x}}\frac{{dx}}{{d\rho }} = \frac{1}{{\beta x}}\left( {1 - \frac{{\rho /{x^2}}}{{\beta NL\gamma x + \beta NL/2 + \rho /{x^2}}}} \right) > 0 $$

$$ \frac{{dS}}{{d\beta }} = \frac{{\partial S}}{{\partial \beta }} + \frac{{\partial S}}{{\partial x}}\frac{{dx}}{{d\beta }} = \frac{\rho }{{{\beta^2}x}}\left( {\frac{{NL\gamma {x^2}/2 + NLx/2}}{{NL\gamma {x^2} + NLx/2 + \rho /(\beta x)}} - 1} \right) < 0 $$

1.2 Proof for proposition 2

Proof: We are required to show: if L _A  < L _B , then x _A  > x _B . We exhibit this by contradiction.

Suppose it holds that if L _A  < L _B , then x _A  < x _B . Note that, under this situation, $δ < 0$.

Clearly, $\beta \gamma N\left( {{L_A}x_A^2 - {L_B}x_B^2} \right) < 0$, $\frac{{\beta N}}{2}\left( {{L_A}\left( {1 + \delta } \right){x_A} - {L_B}\left( {1 - \delta } \right){x_B}} \right) < 0$, $\frac{{\beta \gamma N{x_A}{x_B}}}{2}\left( {{L_B} - {L_A}} \right) > 0$, $\rho \left( {\frac{1}{{{x_B}}} - \frac{1}{{{x_A}}}} \right) < 0$. However, also note that,

$$ \beta \gamma N\left( {{L_A}x_A^2 - {L_B}x_B^2} \right) + \frac{{\beta \gamma N{x_A}{x_B}}}{2}\left( {{L_B} - {L_A}} \right) < \beta \gamma N\left( {{L_A}{x_A}{x_B} - {L_B}{x_B}{x_A}} \right) + 2*\frac{{\beta \gamma N{x_A}{x_B}}}{2}\left( {{L_B} - {L_A}} \right) = 0 $$

Thus, the left hand of (17) is negative, which contradicts the fact that Eq. (17) holds.

1.3 Proof for corollary 2.1

Proof : From Eq. (14), we have

$$ {{\partial } \left/ {{\partial \gamma }} \right.}\left[ { - r + \beta {L_A}\gamma N{x_A}^2 + \frac{{\beta N{L_A}\left( {1 + \delta } \right)}}{2}{x_A} - \frac{\beta }{2}\gamma N{L_A}{x_A}{x_B} - \frac{\rho }{{{x_A}}}} \right] = 0 $$

(A-1)

Solving (A-1) further, we have

$$ \frac{{\partial {x_A}}}{{\partial \gamma }} = \frac{{{x_A}{x_B}/2 + \left( {\partial {x_B}/\partial \gamma } \right)\gamma {x_A}/2 - x_A^2}}{{{D_A}}} $$

(A-2)

Similarly, from Eq. (15), we have

$$ \frac{{\partial {x_B}}}{{\partial \gamma }} = \frac{{{x_A}{x_B}/2 + \left( {\partial {x_A}/\partial \gamma } \right)\gamma {x_B}/2 - x_B^2}}{{{D_B}}} $$

(A-3)

where D _A =$2\gamma {x_A} + (1 + \delta )/2 - \gamma {x_B}/2 + \rho /(\beta {L_A}Nx_A^2)$, ${D_B} = 2\gamma {x_B} + (1 - \delta )/2 - \gamma {x_A}/2 + \rho /(\beta {L_B}Nx_B^2)$.

From (A-2) and (A-3), we have

$$ \frac{{\partial {x_A}}}{{\partial \gamma }} = \frac{{2{D_B}{x_A}\left( {{x_B} - 2{x_A}} \right) + \gamma {x_A}{x_B}\left( {{x_A} - 2{x_B}} \right)}}{{4\left( {{D_A}{D_B} - {\gamma^2}{x_A}{x_B}/4} \right)}} $$

(A-4)

and

$$ \frac{{\partial {x_B}}}{{\partial \gamma }} = \frac{{2{D_A}{x_B}\left( {{x_A} - 2{x_B}} \right) + \gamma {x_A}{x_B}\left( {{x_B} - 2{x_A}} \right)}}{{4\left( {{D_A}{D_B} - {\gamma^2}{x_A}{x_B}/4} \right)}} $$

(A-5)

Note that, for L _B  > L _A , $1 > {x_A} > {x_B} > 0$, and -1 < δ < 0. Thus, we have D _A  > 0 and D _B  > 0.

$$ \begin{array}{*{20}{c}} {\left[ {{{D}_{A}}{{D}_{B}} - {{\gamma }^{2}}{{x}_{A}}{{x}_{B}}/4} \right] = \Psi (\gamma ) + \frac{\rho }{{2\beta {{L}_{A}}N{{x}_{A}}^{2}}}\left\{ {(1 - \delta ) - \gamma {{x}_{A}}} \right\}} \\ { + \frac{{\rho \gamma }}{{\beta {{L}_{B}}N{{x}_{B}}^{2}}}\left\{ {2{{x}_{A}} - \frac{{{{x}_{B}}}}{2}} \right\} + \frac{\rho }{{\beta {{L}_{B}}N{{x}_{B}}^{2}}}\left\{ {\frac{{(1 + \delta )}}{2} + \frac{\rho }{{\beta {{L}_{A}}N{{x}_{A}}^{2}}}} \right\}} \\ { + \gamma {{x}_{B}}\left[ {\gamma \left( {4{{x}_{A}} - {{x}_{B}}} \right) + \frac{{2\rho }}{{\beta {{L}_{A}}N{{x}_{A}}^{2}}}} \right],{\text{where}}} \\ {\Psi (\gamma ) = \frac{3}{4}\gamma \left( {{{x}_{A}} + {{x}_{B}}} \right) - \frac{5}{4}\delta \gamma \left( {{{x}_{A}} - {{x}_{B}}} \right)} \\ { + \left\{ {\frac{1}{4} - \frac{{{{\delta }^{2}}}}{4} - {{\gamma }^{2}}{{x}_{A}}^{2}} \right\}} \\ \end{array} $$

Note that: $\frac{\rho }{{2\beta {L_A}N{x_A}^2}}\left\{ {(1 - \delta ) - \gamma {x_A}} \right\} > 0$, $\frac{{\rho \gamma }}{{\beta {L_B}N{x_B}^2}}\left\{ {2{x_A} - \frac{{{x_B}}}{2}} \right\} > 0$, $\frac{\rho }{{\beta {L_B}N{x_B}^2}}\left\{ {\frac{{(1 + \delta )}}{2} + \frac{\rho }{{\beta {L_A}N{x_A}^2}}} \right\} > 0$, and $\gamma {x_B}\left[ {\gamma \left( {4{x_A} - {x_B}} \right) + \frac{{2\rho }}{{\beta {L_A}N{x_A}^2}}} \right] > 0$. Now, we prove $\Psi (\gamma ) > 0$ to show ${D_A}{D_B} - {\gamma^2}{x_A}{x_B}/4 > 0$.

Let δ = (1–γ).k, where $k = \frac{{{L_A} - {L_B}}}{{{L_A} + {L_B}}} < 0$.

$$ \begin{array}{*{20}{c}} {\Psi (\gamma ) = \frac{3}{4}\gamma \left( {{{x}_{A}}^{*} + {{x}_{B}}^{*}} \right) - \frac{{5k}}{4}\gamma (1 - \gamma )\left( {{{x}_{A}}^{*} - {{x}_{B}}^{*}} \right)} \hfill \\ {\quad \quad \quad + \left\{ {\frac{1}{4} - \frac{{{{{(1 - \gamma )}}^{2}}{{k}^{2}}}}{4} - {{\gamma }^{2}}{{x}_{A}}^{2}} \right\}.\:{\text{Assume}}\theta = - k.} \hfill \\ {\Psi (\gamma ) = \left[ {\left( {\frac{1}{4} + \frac{3}{4}\gamma {{x}_{B}}} \right)} \right] + \left[ {\gamma {{x}_{A}}\left( {\frac{3}{4} - \gamma {{x}_{A}}} \right)} \right]} \hfill \\ {\quad \quad \quad + \left\{ {\frac{{5\gamma (1 - \gamma )\left( {{{x}_{A}}^{*} - {{x}_{B}}^{*}} \right)}}{4}} \right\}\theta - \left\{ {\frac{{{{{(1 - \gamma )}}^{2}}}}{4}} \right\}{{\theta }^{2}}} \hfill \\ \end{array} $$

First, see that ${ }\frac{1}{4} + \frac{3}{4}\gamma {x_B} \geqslant \frac{1}{4}$ and $\left\{ {\frac{{5\gamma (1 - \gamma )\left( {{x_A}^{*} - {x_B}^{*}} \right)}}{4}} \right\}\theta \geqslant 0$. Now, let ${\text P}{(}\gamma {)} = \left[ {\gamma {x_A}\left( {\frac{3}{4} - \gamma {x_A}} \right)} \right] - \left\{ {\frac{{{{(1 - \gamma )}^2}}}{4}} \right\}\theta$

Since 0 ≤ x _A  ≤ 1, and 0 ≤ θ ≤ 1, we have that

$$ {\text P}\left( \gamma \right) = \left[ {\gamma {x_A}\left( {\frac{3}{4} - \gamma {x_A}} \right)} \right] - \left\{ {\frac{{{{\left( {1 - \gamma } \right)}^2}}}{4}} \right\}\theta \geqslant \left[ {\gamma {x_A}\left( {\frac{3}{4} - \gamma {x_A}} \right)} \right] - \left\{ {\frac{{{{\left( {1 - \gamma {x_A}} \right)}^2}}}{4}} \right\} = - \frac{5}{4}{\left( {\gamma {x_A} - \frac{1}{2}} \right)^2} + \frac{1}{{16}} $$

For 0 ≤ γx _A ≤ 1, we thus have: ${\text P}\left( \gamma \right) \geqslant - \frac{5}{4}{\left( {\gamma {x_A} - \frac{1}{2}} \right)^2} + \frac{1}{{16}} \geqslant - \frac{1}{4}$

In other words, $\Psi \left( \gamma \right) \geqslant \left[ {\left( {\frac{3}{4}\gamma {x_B}} \right)} \right] + \left\{ {\frac{{5\gamma \left( {1 - \gamma } \right)\left( {{x_A}^{*} - {x_B}^{*}} \right)}}{4}} \right\}\theta \geqslant 0$

Now that Ψ(γ)>0; Hence, $\forall \;0 \leqslant \gamma \leqslant 1,$ and L _B >L _A , the denominators of $\frac{{\partial {{\text{x}}_{\text{A}}}}}{{\partial \gamma }}{\text{and }}\frac{{\partial {{\text{x}}_{\text{B}}}}}{{\partial \gamma }}:4\left[ {{D_A}{D_B} - \frac{1}{4}{\gamma^2}{x_A}{x_B}} \right] > 0$

The numerator of $\begin{array}{*{20}{c}} {\frac{{\partial {{{\text{x}}}_{{\text{A}}}}}}{{\partial \gamma }}\,{\text{is}}\,\frac{{\partial {{{\text{x}}}_{{\text{A}}}}}}{{\partial \gamma }}2{{{\text{x}}}_{{\text{A}}}}\left( {2\gamma {{x}_{B}} + \frac{{1 - \delta }}{2} - \frac{{\gamma {{x}_{A}}}}{2} + \frac{\rho }{{\beta {{L}_{B}}Nx_{B}^{2}}}} \right)\left( {{{x}_{B}} - 2{{x}_{A}}} \right) + \gamma {{x}_{A}}{{x}_{B}}\left( {{{x}_{A}} - 2{{x}_{B}}} \right),} \hfill \\ { = 2{{{\text{x}}}_{{\text{A}}}}\left( {\frac{{1 - \delta }}{2} - \frac{{\gamma {{x}_{A}}}}{2} + \frac{\rho }{{\beta {{L}_{B}}Nx_{B}^{2}}}} \right)\left( {{{x}_{B}} - 2{{x}_{A}}} \right) + 2\gamma {{x}_{A}}{{x}_{B}}\left( {{{x}_{B}} - {{x}_{A}}} \right) - 5\gamma x_{A}^{2}{{x}_{B}} < 0\,{\text{since }}{{{\text{x}}}_{{\text{A}}}} > {{x}_{B}}.} \hfill \\ \end{array}$

Thus, we could conclude that $\frac{{\partial {{\text{x}}_{\text{A}}}}}{{\partial \gamma }} < 0.$

The numerator of $\frac{{\partial {{\text{x}}_{\text{B}}}}}{{\partial \gamma }}$ is: $\begin{array}{*{20}{c}} {2{{{\text{x}}}_{{\text{B}}}}\left( {2\gamma {{x}_{A}} + \frac{{1 + \delta }}{2} - \frac{{\gamma {{x}_{B}}}}{2} + \frac{\rho }{{\beta {{L}_{A}}Nx_{A}^{2}}}} \right)\left( {{{x}_{A}} - 2{{x}_{B}}} \right) + \gamma {{x}_{A}}{{x}_{B}}\left( {{{x}_{B}} - 2{{x}_{A}}} \right)} \hfill \\ { = 2{{{\text{x}}}_{{\text{B}}}}\left( {\frac{{\gamma {{x}_{A}}}}{2} + \frac{{1 + \delta }}{2} - \frac{{\gamma {{x}_{B}}}}{2} + \frac{\rho }{{\beta {{L}_{A}}Nx_{A}^{2}}}} \right)\left( {{{x}_{A}} - 2{{x}_{B}}} \right) + \gamma {{x}_{A}}{{x}_{B}}\left( {{{x}_{A}} - 5{{x}_{B}}} \right)} \hfill \\ \end{array}$

Thus when ${x_A} < 2{x_B}$, the numerator is negative, and $\frac{{\partial {x_B}}}{{\partial \gamma }} < 0$ ; when ${x_A} > 5{x_B}$ the numerator is positive, and $\frac{{\partial {x_B}}}{{\partial \gamma }} > 0$.

1.3.1 Proof for proposition 3

Proof : The equilibrium vulnerability level x ^D is a solution to (16), and the equilibrium vulnerability level x ^C is a solution to (20). Note that, (16) and (20) are only different in the right hand of the equations. Letting $\chi (x) = r + \frac{\rho }{x} - \frac{{\beta NL}}{2}x$, we have $\chi ({x^D}) = \frac{{\beta NL\gamma }}{2}{x^D}$and $\chi ({x^C}) = 0$. Since $\chi '(x)< 0$ and $\frac{{\beta NL\gamma }}{2}{x^D} > 0$, we have x ^D < x ^C. We can further conclude that S ^D > S ^C.

1.3.2 Proof for proposition 4

Proof : Deducting (19) from (18), we have

$$ \beta \gamma N\left( {{L_A}x_A^2 - {L_B}x_B^2} \right) + \frac{{N\beta }}{2}\left( {{L_A}{x_A}\left( {1 + \delta } \right) - {L_B}{x_B}\left( {1 - \delta } \right)} \right) + \rho \left( {\frac{1}{{{x_B}}} - \frac{1}{{{x_A}}}} \right) = 0 $$

We prove the statement that “if L _A  < L _B , then x _A  > x _B ” by using a contradiction argument.

Suppose if L _A  < L _B , then x _A  < x _B . Obviously,$\beta \gamma N\left( {{L_A}x_A^2 - {L_B}x_B^2} \right) < 0$, $\frac{{N\beta }}{2}\left( {{L_A}{x_A}\left( {1 + \delta } \right) - {L_B}{x_B}\left( {1 - \delta } \right)} \right) < 0$, and $\rho \left( {\frac{1}{{{x_B}}} - \frac{1}{{{x_A}}}} \right) < 0$, so the left hand side of (1) is negative, which contradicts with the fact that the left hand side of (1) should equal 0.