Nowadays, both the amount of cyberattacks and their sophistication have considerably increased, and their prevention is of concern of most of organizations. Cooperation by means of information sharing is a promising strategy to address this problem, but unfortunately it poses many challenges. Indeed, looking for a win-win environment is not straightforward and organizations are not properly motivated to share information. This work presents a model to analyse the benefits and drawbacks of information sharing among organizations that presents a certain level of dependency. The proposed model applies functional dependency network analysis to emulate attacks propagation and game theory for information sharing management. We present a simulation framework implementing the model that allows for testing different sharing strategies under several network and attack settings. Experiments using simulated environments show how the proposed model provides insights on which conditions and scenarios are beneficial for information sharing.
Several works have proposed the use of game theory to analyse the trade-off in terms of incentives and costs of sharing information among entities. Naghizadeh et Liu @cite_21 propose folk theorems and use an analytical method to study how the role of private and public monitoring through inter-temporal incentives can support degree of cooperation. Similar to this work, we also propose a game theory based model where utilities of sharing information are calculated upon gains and costs. However, instead of using historical public available actions, we propose immunization factor and reputation as the main variables for incentive sharing. Furthermore, the work in @cite_21 identifies the cost of disclosure as one of the main drawbacks related with information sharing. While we also consider privacy and disclosure costs as two key drawbacks for sharing, we also introduce a third variable that affects costs, i.e. trust.
@cite_21
2579399277
Sharing of security information among organizations has often been proposed as a method for improving the state of cyber-security for all. However, such disclosure entails costs for the reporting entity, including a drop in market value, loss of customer confidence, and bureaucratic burdens. By adopting a game-theoretic approach for understanding firms' incentives, we first show that in one shot interactions, disclosure costs act as disincentives for sharing, leading to no information sharing at equilibrium. We then consider a repeated game formulation that enables the use of inter-temporal incentives (i.e., the conditioning of future decisions on the history of past interactions) to support firms' cooperation on information sharing. We show that the nature of the monitoring available to firms greatly affects the possibility of sustaining nearly efficient outcomes through repeated interactions. Specifically, we first illustrate the limitations arising when firms' have independent and imperfect private monitoring technologies. We then consider the role of a public monitoring assessment system, and show that despite using the same imperfect technology as the individual firms, the monitor can facilitate cooperation among participants. Our results therefore illustrate the impact of a public rating reputation system on the viability of security information sharing agreements.