A Game Theoretic Economics Framework to understanding Information Security Oursourcing Market

摘要

On information security outsourcing market, an important reason that firms donot want to let outside firms(usually called MSSPs-Managed Security ServiceProviders) to take care of their security need is that they worry about servicequality MSSPs provide because they cannot monitor effort of the MSSPs. SinceMSSPs action is unobservable to buyers, MSSPs can lower cost by working lesshard than required in the contract and get higher profit. In the asymmetricinformation literature, this possible secret shirking behavior is termed asmoral hazard problem. This paper considers a game theoretic economic frameworkto show that under information asymmetry, an optimal contract can be designedso that MSSPs will stick to their promised effort level. We also show that theoptimal contract should be performance-based, i.e., payment to MSSP should baseon performance of MSSP's security service period by period. For comparison, wealso showed that if the moral hazard problem does not exist, the optimalcontract does not depend on MSSP's performance. A contract that specifiesconstant payment to MSSP will be optimal. Besides these, we show that for nomatter under perfect information scenario or imperfect information scenario,the higher the transaction cost is, the lower payment to MSSPs will be.