Optimal policies for information sharing in information system security

Abstract

Information sharing has become a significant part of information system security endeavor, as many firms have come to realize that it is difficult to defend against the increasingly sophisticated information security attacks with the limited resources of one single firm. The sharing of information security related knowledge and experience helps firms better prepare for the upcoming information security challenges. However, the practice of information sharing is far less prevalent when compared with other information security methods. In this paper, we develop a framework for information sharing decisions of a firm in the context of information system security. We find through analytical and numerical analyses that the optimal level information sharing is a function of the cost, budget and expected cost of perfect protection for a given firm. We also examine the value of information sharing in information security, and identify how such value varies over different investment environments.