Outsourcing Internet Security: The Effect of Transaction Costs on Managed Service Providers

摘要

Transaction costs are a significant factor in outsourcing decisions. In the case of Internet security, outsourcing has higher transaction costs for two major reasons: (1) the outsourcing process is not yet standardized and (2) there is uncertainty about the frequency and impact of cyber attacks creating large variations in coordination costs - cyber attacks may be rare and non-eventful during most periods but intensive and eventful during some periods. In this paper we study the effects of transaction costs on provider pricing strategies aiming toward guidelines that are beneficial for both buyers and providers. We structure a game-theoretic model that incorporates the two special features of transaction costs for security outsourcing. When transaction costs are high, Managed Security Service Providers (MSSPs) have to charge a lower overall price for their services to balance these costs. The same result holds when the uncertainty associated with transaction cost increases. Our conclusion is that while performance-based contracts have to be employed to create an efficient risk-sharing mechanism, market competition provides incentives for MSSPs to share transaction costs with buyers.