Security investment and information sharing under an alternative security breach probability function

Abstract

Nowadays, in order to protect information assets, many firms have gradually realized the importance of security investment and information sharing. It is worth pointing out that security breach probability functions play a vital role in firms’ strategic choices. This paper investigates how to determine security investment and information sharing for two firms by employing an alternative well-accepted security breach probability function. In particular, assuming that both firms make their decisions individually, we analyze information sharing, aggregate attack, aggregate defense and the security breach probability at equilibrium. Then we compare these results with those in three (partially) centralized decision cases where a social planner regulates security investment, information sharing or both of them. Between the individual decision case and the partially centralized decision case with the social planner only controlling information sharing, and between the centralized decision case and the other partially centralized decision case, we demonstrate that, although aggregate attack, aggregate defense and the security breach probability remain unchanged, more intervention from the social planner would give rise to higher social welfare. Besides, it turns out that some well-known results of Hausken (Journal of Accounting and Public Policy, 26(6), 639–688, 2007) drastically change in our framework.

Appendices

Appendix A. Firms choose security investment and information sharing

The firm’s and the hacker’s expected utilities are respectively

$$ \begin{array}{*{20}c} {{F_1}=\left[ {{v_1}-s\left( {{v_1},z_1^a,c_1^a} \right)} \right]{L_1}-{z_1}-\left( {{\kappa_1}s_1^2-{\kappa_2}s_2^2-{\kappa_3}{s_1}{s_2}} \right)} \\ {{F_2}=\left[ {{v_2}-s\left( {{v_2},z_2^a,c_2^a} \right)} \right]{L_2}-{z_2}-\left( {{\kappa_1}s_2^2-{\kappa_2}s_1^2-{\kappa_3}{s_1}{s_2}} \right)} \\ {H=\left[ {s\left( {{v_1},z_1^a,c_1^a} \right)-{v_1}} \right]{H_1}+\left[ {s\left( {{v_2},z_2^a,c_2^a} \right)-{v_2}} \right]{H_2}-{c_1}-{c_2}} \\ \end{array} $$

where $s\left( {{v_1},z_1^a,c_1^a} \right)={v_1}{{\left( {\gamma c_1^a+1} \right)}^{\phi }}{{\left( {\alpha z_1^a+1} \right)}^{{-\beta }}}$, $s\left( {{v_2},z_2^a,c_2^a} \right)={v_2}{{\left( {\gamma c_2^a+1} \right)}^{\phi }}{{\left( {\alpha z_2^a+1} \right)}^{{-\beta }}}$, c ₁ ^a = c ₁ + ρc ₂, $z_1^a={z_1}+\eta {s_2}+\rho \left( {{z_2}+\eta {s_1}} \right)$ and c ₂ ^a = c ₂ + ρc ₁, $z_2^a={z_2}+\eta {s_1}+\rho \left( {{z_1}+\eta {s_2}} \right)$.

The first order conditions are given by

$$ \begin{array}{*{20}c} {\partial {F_1}/\partial {z_1}=\alpha \beta {v_1}{L_1}{{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}-1=0} \hfill \\ {\partial {F_2}/\partial {z_2}=\alpha \beta {v_2}{L_2}{{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}-1=0} \hfill \\ \end{array} $$

(A1)

$$ \begin{array}{*{20}c} {\partial {F_1}/\partial {s_1}=\alpha \beta {v_1}{L_1}\rho \eta {{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}-2{\kappa_1}{s_1}+{\kappa_3}{s_2}=0} \hfill \\ {\partial {F_2}/\partial {s_2}=\alpha \beta {v_2}{L_2}\rho \eta {{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}-2{\kappa_1}{s_2}+{\kappa_3}{s_1}=0} \hfill \\ \end{array} $$

(A2)

$$ \begin{array}{*{20}c} {\partial H/\partial {c_1}=\gamma \phi {v_1}{H_1}{{{\left( {\gamma c_1^a+1} \right)}}^{{\phi -1}}}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta }}}+\rho \gamma \phi {v_2}{H_2}{{{\left( {\gamma c_2^a+1} \right)}}^{{\phi -1}}}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta }}}-1=0} \hfill \\ {\partial H/\partial {c_2}=\gamma \phi {v_2}{H_2}{{{\left( {\gamma c_2^a+1} \right)}}^{{\phi -1}}}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta }}}+\rho \gamma \phi {v_1}{H_1}{{{\left( {\gamma c_1^a+1} \right)}}^{{\phi -1}}}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta }}}-1=0} \hfill \\ \end{array} $$

(A3)

Substituting (A1) into (A2) yields

$$ {s_1}={s_2}=\rho \eta {{\left( {2{\kappa_1}-{\kappa_3}} \right)}^{-1 }}. $$

(A3) gives

$$ \gamma \phi {v_1}{H_1}{{\left( {\gamma c_1^a+1} \right)}^{{\phi -1}}}{{\left( {\alpha z_1^a+1} \right)}^{{-\beta }}}=\gamma \phi {v_2}{H_2}{{\left( {\gamma c_2^a+1} \right)}^{{\phi -1}}}{{\left( {\alpha z_2^a+1} \right)}^{{-\beta }}}={{\left( {1+\rho } \right)}^{-1 }} $$

(A4)

which, together with (A1), implies

$$ \begin{array}{*{20}c} {\gamma c_1^a+1={{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}{{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ {\gamma c_2^a+1={{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}{{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ \end{array} $$

(A5)

$$ \begin{array}{*{20}c} {\alpha z_1^a+1={{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi }{{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ {\alpha z_2^a+1={{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi }{{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ \end{array} $$

(A6)

It follows from (A4) and (A5) that

$$ \begin{array}{*{20}c} {{c_1}={{{\left( {{{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\gamma \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\gamma \left( {1+\rho } \right)} \right]}}^{-1 }}} \hfill \\ {{c_2}={{{\left( {{{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\gamma \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\gamma \left( {1+\rho } \right)} \right]}}^{-1 }}} \hfill \\ \end{array} $$

(A7)

$$ \begin{array}{*{20}c} {{z_1}={{{\left( {{{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\alpha \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\alpha \left( {1+\rho } \right)} \right]}}^{-1 }}-\eta {s_2}} \hfill \\ {{z_2}={{{\left( {{{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left[ {\gamma \phi \left( {1+\rho } \right)} \right]}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\alpha \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\alpha \left( {1+\rho } \right)} \right]}}^{-1 }}-\eta {s_1}} \hfill \\ \end{array} $$

(A8)

We now validate the second order conditions of the equilibrium. Noting the first order conditions (A1) and (A2), one can easily get at equilibrium

$$ \begin{array}{*{20}c} {{\partial^2}{F_1}/\partial z_1^2=-\alpha \left( {\beta +1} \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }} < 0} \hfill \\ {{\partial^2}{F_1}/\partial s_1^2=-\alpha \rho \eta \left( {\beta +1} \right)\left( {2{\kappa_1}{s_1}-{\kappa_3}{s_2}} \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}-2{\kappa_1} < 0} \hfill \\ {{\partial^2}{F_1}/\partial {z_1}\partial {s_1}=-\alpha \rho \eta \left( {\beta +1} \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}} \hfill \\ \end{array} $$

and further

$$ \begin{array}{*{20}c} {\left[ {{\partial^2}{F_1}/\partial z_1^2} \right]\left[ {{\partial^2}{F_1}/\partial s_1^2} \right]-{{{\left[ {{\partial^2}{F_1}/\partial {z_1}\partial {s_1}} \right]}}^2}} \hfill \\ {={\alpha^2}{{{\left( {1+\beta } \right)}}^2}\left[ {\rho \eta \left( {2{\kappa_1}{s_1}-{\kappa_3}{s_2}} \right)-{\rho^2}{\eta^2}} \right]{{{\left( {\alpha z_1^a+1} \right)}}^{-2 }}+2{\kappa_1}\alpha \left( {1+\beta } \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }} > 0} \hfill \\ \end{array} $$

for appropriate interdependence ρ. Therefore, the second order condition for F ₁ is satisfied. Analogously, the second order condition for F ₂ can be validated.

Noting the first order condition (A4), one can get

$$ \begin{array}{*{20}c} {{\partial^2}H/\partial c_1^2=\gamma \left( {\phi -1} \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\gamma c_1^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\gamma c_2^a+1} \right)}}^{-1 }}} \right]\leq 0} \hfill \\ {{\partial^2}H/\partial c_2^2=\gamma \left( {\phi -1} \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\gamma c_2^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\gamma c_1^a+1} \right)}}^{-1 }}} \right]\leq 0} \hfill \\ {\partial {H^2}/\partial {c_1}\partial {c_2}=\gamma \rho \left( {\phi -1} \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\gamma c_1^a+1} \right)}}^{-1 }}+{{{\left( {\gamma c_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ \end{array} $$

and further

$$ \begin{array}{*{20}c} {\left[ {{\partial^2}H/\partial c_1^2} \right]\left[ {{\partial^2}H/\partial c_2^2} \right]-{{{\left[ {\partial {H^2}/\partial {c_1}\partial {c_2}} \right]}}^2}} \hfill \\ {={\gamma^2}{{{\left( {\phi -1} \right)}}^2}{{{\left( {\gamma c_1^a+1} \right)}}^{-1 }}{{{\left( {\gamma c_2^a+1} \right)}}^{-1 }}{{{\left( {1+\rho } \right)}}^{-2 }}\left( {1+{\rho^4}-2{\rho^2}} \right)\geq 0} \hfill \\ \end{array} $$

for appropriate interdependence ρ. Hence, the second order condition for H is satisfied as well.

Appendix B. The social planner only controls security investment

When only security investment is controlled by the social planner, (A2) and (A3) remain valid. (A1) becomes

$$ \begin{array}{*{20}c} {\partial F/\partial {z_1}=\alpha \beta {v_1}{L_1}{{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}+\rho \alpha \beta {v_2}{L_2}{{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}-1=0} \hfill \\ {\partial F/\partial {z_2}=\rho \alpha \beta {v_1}{L_1}{{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}+\alpha \beta {v_2}{L_2}{{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}-1=0} \hfill \\ \end{array} $$

which implies

$$ \alpha \beta {v_1}{L_1}{{\left( {\gamma c_1^a+1} \right)}^{\phi }}{{\left( {\alpha z_1^a+1} \right)}^{{-\beta -1}}}=\alpha \beta {v_2}{L_2}{{\left( {\gamma c_2^a+1} \right)}^{\phi }}{{\left( {\alpha z_2^a+1} \right)}^{{-\beta -1}}}={{\left( {1+\rho } \right)}^{-1 }}. $$

(B1)

Substituting (B1) into (A2) results in

$$ {s_1}={s_2}=\rho \eta {{\left[ {\left( {1+\rho } \right)\left( {2{\kappa_1}-{\kappa_3}} \right)} \right]}^{-1 }}. $$

Combining (B1) with (A4) gives

$$ \begin{array}{*{20}c} {\gamma c_1^a+1={{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ {\gamma c_2^a+1={{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ \end{array} $$

(B2)

$$ \begin{array}{*{20}c} {\alpha z_1^a+1={{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi}\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left( {\gamma \phi } \right)}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ {\alpha z_2^a+1={{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi}\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{1-\phi }}}{{{\left( {\gamma \phi } \right)}}^{\phi }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \hfill \\ \end{array} $$

(B3)

It follows from (B2) and (B3) that

$$ \begin{array}{*{20}c} {{c_1}={{{\left( {\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\gamma \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\gamma \left( {1+\rho } \right)} \right]}}^{-1 }}} \hfill \\ {{c_2}={{{\left( {\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_2}L_2^{{-\beta }}H_2^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_1}L_1^{{-\beta }}H_1^{{1+\beta }}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\gamma \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\gamma \left( {1+\rho } \right)} \right]}}^{-1 }}} \hfill \\ \end{array} $$

(B4)

$$ \begin{array}{*{20}c} {{z_1}={{{\left( {\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\alpha \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\alpha \left( {1+\rho } \right)} \right]}}^{-1 }}-\eta {s_2}} \hfill \\ {{z_2}={{{\left( {\left( {1+\rho } \right){{{\left( {\alpha \beta } \right)}}^{{-\beta }}}{{{\left( {\gamma \phi } \right)}}^{{1+\beta }}}} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}\left[ {{{{\left( {{v_2}L_2^{{1-\phi }}H_2^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}-\rho {{{\left( {{v_1}L_1^{{1-\phi }}H_1^{\phi }} \right)}}^{{\frac{1}{{1+\beta -\phi }}}}}} \right]{{{\left[ {\alpha \left( {1-{\rho^2}} \right)} \right]}}^{-1 }}-{{{\left[ {\alpha \left( {1+\rho } \right)} \right]}}^{-1 }}-\eta {s_1}} \hfill \\ \end{array} $$

(B5)

Now, consider the second order conditions at equilibrium. In a similar way, we can obtain ${\partial^2}{F_1}/\partial s_1^2 <0\;\mathrm{and}\;{\partial^2}{F_2}/\partial s_2^2<0$.

Given (B1), it is easy to derive that

$$ \begin{array}{*{20}c} {{\partial^2}F/\partial z_1^2=-\alpha \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]<0} \hfill \\ {{\partial^2}F/\partial z_2^2=-\alpha \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}} \right]<0} \hfill \\ {{\partial^2}F/\partial {z_1}\partial {z_2}=-\alpha \rho \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ \end{array} $$

and

$$ \begin{array}{*{20}c} {\left[ {{\partial^2}F/\partial z_1^2} \right]\left[ {{\partial^2}F/\partial z_2^2} \right]-{{{\left[ {{\partial^2}F/\partial {z_1}\partial {z_2}} \right]}}^2}} \hfill \\ {={\alpha^2}{{{\left( {1+\beta } \right)}}^2}{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}{{{\left( {1+\rho } \right)}}^{-2 }}\left( {1+{\rho^4}-2{\rho^2}} \right)>0} \hfill \\ \end{array}. $$

Analogously, the second order condition for H can be validated.

Appendix C. The social planner just controls information sharing

When only information sharing is controlled by the social planner, (A1) and (A3) remain valid. (A2) becomes

$$ \begin{array}{*{20}c} {\partial F/\partial {s_1}=\rho \alpha \beta {v_1}{L_1}\eta {{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}+\alpha \beta {v_2}{L_2}\eta {{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}} \hfill \\ {\quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad -2\left( {{\kappa_1}-{\kappa_2}} \right){s_1}+2{\kappa_3}{s_2}=0} \hfill \\ {\partial F/\partial {s_2}=\alpha \beta {v_1}{L_1}\eta {{{\left( {\gamma c_1^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_1^a+1} \right)}}^{{-\beta -1}}}+\rho \alpha \beta {v_2}{L_2}\eta {{{\left( {\gamma c_2^a+1} \right)}}^{\phi }}{{{\left( {\alpha z_2^a+1} \right)}}^{{-\beta -1}}}} \hfill \\ {\quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad \quad -2\left( {{\kappa_1}-{\kappa_2}} \right){s_2}+2{\kappa_3}{s_1}=0} \hfill \\ \end{array} $$

(C1)

Substituting (A1) into (C1) gives

$$ {s_1}={s_2}=\eta \left( {1+\rho } \right){{\left[ {2\left( {{\kappa_1}-{\kappa_2}-{\kappa_3}} \right)} \right]}^{-1 }}. $$

Aggregate defense and aggregate attack are derived from (A1) and (A3), both of which remain unchanged. Hence, security investment and cyber attacks are given by (A7) and (A8) respectively after substituting s ₁ and s ₂.

Noting (A1), we have

$$ \begin{array}{*{20}c} {{\partial^2}F/\partial s_1^2=-\alpha {\eta^2}\left( {1+\beta } \right)\left[ {{\rho^2}{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]-2\left( {{\kappa_1}-{\kappa_2}} \right)<0} \hfill \\ {{\partial^2}F/\partial s_2^2=-\alpha {\eta^2}\left( {1+\beta } \right)\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]-2\left( {{\kappa_1}-{\kappa_2}} \right)<0} \hfill \\ {{\partial^2}F/\partial {s_1}\partial {s_2}=-\alpha \rho {\eta^2}\left( {1+\beta } \right)\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]+2{\kappa_3}} \hfill \\ \end{array} $$

and

$$ \begin{array}{*{20}c} {\left[ {{\partial^2}F/\partial s_1^2} \right]\left[ {{\partial^2}F/\partial s_2^2} \right]-{{{\left[ {{\partial^2}F/\partial {s_1}\partial {s_2}} \right]}}^2}} \hfill \\ {=2\alpha {\eta^2}\left( {1+\beta } \right)\left[ {\left( {{\kappa_1}-{\kappa_2}} \right)\left( {1+{\rho^2}} \right)+2{\kappa_3}\rho )} \right]\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ {+{\alpha^2}{\eta^4}{{{\left( {1+\beta } \right)}}^2}{{{\left( {1-{\rho^2}} \right)}}^2}{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}+4\left[ {{{{\left( {{\kappa_1}-{\kappa_2}} \right)}}^2}-\kappa_3^2} \right]>0} \hfill \\ \end{array} $$

for appropriate interdependence ρ since κ ₁ ≥ κ ₂ + κ ₃. It is obvious that ${\partial^2}{F_1}/\partial z_1^2<0$ and ${\partial^2}{F_2}/\partial z_2^2<0$. As above, the second order condition for H can be validated in the same way.

Appendix D. The social planner controls both security investment and information sharing

When the social planner controls security investment and information sharing, (B1), (C1) as well as (A4) are valid. Substituting (B1) into (C1) yields

$$ {s_1}={s_2}=\eta {{\left[ {2\left( {{\kappa_1}-{\kappa_2}-{\kappa_3}} \right)} \right]}^{-1 }}. $$

Aggregate defense and aggregate attack in this case are equal to those when the social planner just controlling security investment, which are determined by (B1) and (A4). The security investment and cyber attacks can be obtained similarly, shown in (B4) and (B5) where s ₁ and s ₂ are replaced. The second order condition for the social planner is satisfied if the following symmetric matrix is negative definite,

$$ J\left( \rho \right)=\left( {\begin{array}{*{20}c} {{\partial^2}F/\partial z_1^2} \hfill & {{\partial^2}F/\partial {z_1}\partial {z_2}} \hfill & {{\partial^2}F/\partial {z_1}\partial {s_1}} \hfill & {{\partial^2}F/\partial {z_1}\partial {s_2}} \hfill \\ {{\partial^2}F/\partial {z_2}\partial {z_1}} \hfill & {{\partial^2}F/\partial z_2^2} \hfill & {{\partial^2}F/\partial {z_2}\partial {s_1}} \hfill & {{\partial^2}F/\partial {z_2}\partial {s_2}} \hfill \\ {{\partial^2}F/\partial {s_1}\partial {z_1}} \hfill & {{\partial^2}F/\partial {s_1}\partial {z_2}} \hfill & {{\partial^2}F/\partial s_1^2} \hfill & {{\partial^2}F/\partial {s_1}\partial {s_2}} \hfill \\ {{\partial^2}F/\partial {s_2}\partial {z_1}} \hfill & {{\partial^2}F/\partial {s_2}\partial {z_2}} \hfill & {{\partial^2}F/\partial {s_2}\partial {s_1}} \hfill & {{\partial^2}F/\partial s_2^2} \hfill \\ \end{array}} \right) $$

where

$$ \begin{array}{*{20}c} {{\partial^2}F/\partial {z_1}\partial {s_1}=-\alpha \rho \eta \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ {{\partial^2}F/\partial {z_1}\partial {s_2}=-\alpha \eta \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{\rho^2}{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ {{\partial^2}F/\partial {z_2}\partial {s_1}=-\alpha \eta \left( {1+\beta } \right){{{\left( {1+\rho } \right)}}^{-1 }}\left[ {{\rho^2}{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ {{\partial^2}F/\partial {z_2}\partial {s_2}=-\rho \alpha \eta \left( {1+\beta } \right)\left[ {{{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+{{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}} \right]} \hfill \\ \end{array} $$

and other partial derivatives are equal to the preceding after substituting aggregate defense and aggregate attack here. Exchanging the second and the fourth rows and simultaneously exchanging the second and the fourth columns of J(0) yield

$$ \widehat{J}(0)=\left( {\begin{array}{*{20}c} A \hfill & {{O_{{2\times 2}}}} \hfill \\ {{O_{{2\times 2}}}} \hfill & B \hfill \\ \end{array}} \right), $$

where O _2×2 is zero matrix,

$$ A=\alpha \left( {1+\beta } \right){{\left( {\alpha z_1^a+1} \right)}^{-1 }}\left( {\begin{array}{*{20}c} {-1} \hfill & {-\eta } \hfill \\ {-\eta } \hfill & {-1} \hfill \\ \end{array}} \right) $$

and

$$ B=\left( {\begin{array}{*{20}c} {-\alpha {\eta^2}\left( {1+\beta } \right){{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}-2\left( {{\kappa_1}-{\kappa_2}} \right)} \hfill & {2{\kappa_3}} \hfill \\ {2{\kappa_3}} \hfill & {-\alpha {\eta^2}\left( {1+\beta } \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}-2\left( {{\kappa_1}-{\kappa_2}} \right)} \hfill \\ \end{array}} \right) $$

Obviously, A has two negative eigenvalues. Since

$$ \begin{array}{*{20}c} {\det B=\left[ {\alpha {\eta^2}\left( {1+\beta } \right){{{\left( {\alpha z_2^a+1} \right)}}^{-1 }}+2\left( {{\kappa_1}-{\kappa_2}} \right)} \right]\left[ {\alpha {\eta^2}\left( {1+\beta } \right){{{\left( {\alpha z_1^a+1} \right)}}^{-1 }}+2\left( {{\kappa_1}-{\kappa_2}} \right)} \right]-4\kappa_3^2} \hfill \\ {\quad \quad >4\left[ {{{{\left( {{\kappa_1}-{\kappa_2}} \right)}}^2}-\kappa_3^2} \right]\geq 0} \hfill \\ \end{array}, $$

and tr(B) < 0, symmetric matrix B also has two negative eigenvalues. Therefore, all eigenvalues of $\widehat{J}(0)$ are negative, which implies that J(0) is negative definite since J(0) and $\widehat{J}(0)$ have the same eigenvalues. By the continuity of J(ρ) with respect to ρ, J(ρ) is negative definite for ρ with a small magnitude (for any non-zero vector X, X ^T J(0)X > 0 ⇒ X ^T J(ρ)X > 0 as long as the magnitude of ρ is small). The second order condition for the hacker can be validated similarly.