Implications of False Alarms in Dynamic Games on Cyber-Security

Cyber-threats including computer viruses, data breach, and denial-of-service attacks have arisen, and they have to be well-handled. Imperfect prevention of cyber-attacks implies that defense of cyber-attacks is inevitably involved with false alarms. We consider a dynamic game in which a defender is penalized for false alarms. Characterizing its equilibrium, we look for its implications in various circumstances. Specifically, we consider government intervention, the cyber-insurance market, and operational risk. We suggest a simple form of government intervention that achieves socially optimal outcome. Our model shows that both demand and supply of cyber-insurance can be low, which explains underdevelopment of the cyber-insurance market. Analysis of an extended model with operational risk shows that reducing operational risk decreases cyber-risks, but requires some tolerance of false alarms