The impact of information gathering on cybersecurity investment

Abstract

This thesis presents an overview about the interplay of cybersecurity investment, information asymmetry and information gathering. It investigates the impact of asymmetric information between consumer, vendor and hacker. To determine the effect, this thesis draws upon the cybersecurity models of Al- Humaigani and Dunn (2003), Gordon and Loeb (2002) and Huang, Hu, and Behara (2008). Thereupon, possible solution methods for asymmetric information are analysed. These are in particular information sharing and bug bounty programs. The influence of information sharing on investment is modelled based on network theory. In order to make the quality of a software assessable, bug bounty programs work as a signaling device. Both information gathering programs reduce asymmetric information. While information sharing is more focussed on asymmetries between consumers, bug bounty programs help to reduce asymmetry between vendor and consumer. The magnitude of the effect is dependent on the characteristics of the model, such as risk-averseness.