Seminar-Jay Pil Choi

Title: Internet Security, Vulnerability Disclosure, and Software Provision

Abstract: This paper presents a simple model to investigate issues related to the economics of Internet security. Large networks are typically more vulnerable to security breaches because the success of the network provides hackers with a greater incentive to exploit potential vulnerabilities. Our model incorporates this "negative network effect" as a central feature of the model and approaches the problem from the perspective of economic incentives facing software vendors, hackers, and users.In particular, we analyze software vendors' private incentives to make an upfront investment in the quality of the software to reduce potential vulnerabilities and to announce vulnerabilities if they are found.We compare the market outcome to the socially optimal one.We also discuss implications of our model for formulating appropriate public policies to enhance information security