风险相互依赖下的信息系统安全投资协调优化模型（英文）

Optimization and coordination model of information system security investment for interdependent risk

结合风险管理理论和博弈理论,运用定量化模型研究了风险关联对企业信息系统安全投资的影响.通过对比非合作博弈和社会最优下的自我防御投资和网络安全保险水平,提出相应的协调机制.研究结果表明:当关联性风险趋于很小时,自我防御投资水平随其潜在安全损失的上升而增大;企业在进行信息系统安全投资时往往会忽略对其他企业的边际外部成本或收益的影响,这种负外部性特征会导致企业自我防御投资和网络安全保险水平均低于社会最优化水平.政府通过补贴企业自我防御投资可以在一定程度上协调企业的风险管理决策,进而改善企业安全水平,有效提高社会福利.

The impact of risk correlation on firm＇s investments in information system security is studied by using quantification models combining the ideas of the risk management theory and the game theory. The equilibrium levels of self-protection and insurance coverage under the non- cooperative condition are compared with socially optimal solutions, and the associated coordination mechanisms are proposed. The results show that self-protection investment increases in response to an increase in potential loss when the interdependent risk is small; the interdependent risk of security investments often induce firms to underinvest in security relative to the socially efficient level by ignoring marginal external costs or benefits conferred on others. A subsidy on self-protection investment from the government can help coordinate a firm＇s risk management decision and, thereby, improve individual security level and overall social welfare.