Information Systems Research, 2011, Volume 22,
Issue 3, Page 606-623.
This paper analyzes interactions between a firm that seeks to discriminate between normal users and hackers that try to penetrate and compromise the firm's information assets. We develop an analytical model in which a variety of factors are balanced to best manage the detection component within information security management. The approach not only considers conventional factors such as detection rate and false-positive rate, but also factors associated with hacker behavior that occur in response to improvements in the detection system made by the firm. Detection can be improved by increasing the system's discrimination ability (i.e., the ability to distinguish between attacks and normal usage) through the application of maintenance effort. The discrimination ability deteriorates over time due to changes in the environment. Also, there is the possibility of sudden shocks that can sharply degrade the discrimination ability. The firm's cost increases as hackers become more knowledgeable by disseminating security knowledge within the hacker population. The problem is solved to reveal the presence of a steady-state solution in which the level of system discrimination ability and maintenance effort are held constant. We find an interesting result where, under certain conditions, hackers do not benefit from disseminating security knowledge among one another. In other situations, we find that hackers benefit because the firm must lower its detection rate in the presence of knowledge dissemination. Other insights into managing detection systems are provided. For example, the presence of security shocks can increase or decrease the optimal discrimination level as compared to the optimal level without shocks.