信息系统安全利益相关者之间的博弈关系分析和激励策略研究

In recent years, firms increase information system security investment and employ more advanced security technologies, but security events don’t decrease but have a trend of increase. The main reason for this phenomenon is that the information system security environment comprises not only technical factors, but also the government, security software vendors, security service providers, firms, hackers and other stakeholders. Firms blindly pursue advanced technology, ignore the game relationship between these stakeholders, and fail to better design incentive strategies. Therefore, based on these stakeholders’ economic motivations, this project studies incentive strategies of information system security. Firstly, the government can reward, fine, and enforce firms who buy security software to promote them to patch, and this project designs sole use, combination use, and targeted use of these incentive strategies and compares their effects by game analysis. Secondly, this project designs incentive strategies of price adjustments and software versions variety adopted by security software vendors to firms and analyzes and compares them by game theory. Finally, this project analyzes and compares security service providers’ incentive strategies for security software vendors, which include instant disclosure, no disclose and delayed disclosure of vulnerabilities. Through the research of this project, it is expected to enrich the theoretical studies of information security economics and to provide new theory and method support for information system security management.

近年来，企业信息系统安全投资越来越多，所运用的安全技术越来越先进，但安全事件非但没有减少，反而呈上升趋势。造成这种现象的主要原因在于，信息系统安全环境不仅由技术要素构成，还涉及政府、安全软件供应商、安全服务提供商、企业和黑客等利益相关者，企业一味追求先进技术，忽视了利益相关者之间的博弈关系，没能较好地设计激励策略。为此，本项目基于利益相关者的经济动机，研究信息系统安全激励策略。首先，政府可对购买安全软件的企业采取奖励、罚款及强制措施促使其安装补丁，设计这些激励策略的单一、组合及定向运用，并通过博弈分析比较其效果。其次，设计安全软件供应商对企业采取价格调节和软件版本多样化等激励策略，并进行博弈分析和比较。最后，分析和比较安全服务提供商对安全软件供应商采取的即时披露、不披露和延迟披露漏洞等激励策略。通过本项目的研究，以期丰富信息安全经济学的理论研究，为信息系统安全管理提供新颖的理论和方法支持。

与传统技术方案相比，信息系统安全经济学能从多方利益相关者之间的冲突中洞悉信息系统安全问题，以便从一个新颖的视角寻求信息系统安全解决方案。本项目综合考虑多方利益主体及其相互关系，设计合理的信息系统安全激励策略，制定信息系统安全投资方案。本项目在黑客定向攻击下，研究了企业所处的市场结构对企业信息系统安全投资策略选择的影响；在黑客定向攻击下，研究了两个竞争企业的信息安全投资和信息分享的动态策略；在考虑黑客随机攻击下，分析两个竞争企业的商业模式选择问题；研究了信息系统安全的应用场景和理论基础。本项目研究成果录用和发表在国际期刊《IIE Transactions》、《Decision Analysis》、《Information Technology and Management》、《Operations Research Letters》、《International Journal of Production Research》和《Omega》。通过本项目的研究，可以丰富信息安全经济学的理论研究，为信息系统安全管理提供新颖的理论和方法支持。