As both public and private entities increasingly rely on the Internet, communications systems, and electronically-transmitted data to perform business functions, vast amounts of data are stored online and are becoming vulnerable to hackers and other cyber threats. Governments must assume an active role in maintaining the reliability and security of the global cyber infrastructure. However, securing the cyber infrastructure presents difficult challenges since it requires coordinating the efforts of government, the private sector, and society. Dr. Terrence August, Associate Professor at the Rady School of Management at the University of California, San Diego, is tackling cybersecurity from a microeconomics approach, evaluating the different incentives offered to different parties in providing security for networks. When misaligned incentives lead to outcomes with destructive social consequences, there is a natural call for government involvement. Currently though, the government's strategy has been mostly suggestive. However, in the face of increasing security attacks and associated economic losses, the government may need to adopt a more hands-on approach to securing the Internet. Dr. August is developing models to gauge the equilibrium level of security and determine the ideal level of government involvement. To strategically craft policies aimed at the protection of the Internet, we must develop a better understanding of how the decisions of individual parties affect aggregate measures of security and social welfare. This is precisely where Dr. August’s research lies. He has built some of the foundational economic models that rigorously study how the level of cybersecurity is the result of economic agents making self-interested decisions. Protecting our Internet and communication systems is one of the highest priorities, for both the public and private industry, especially in the face of recent cyber attacks that exposed the vulnerability of networks.

People within the field now approach cybersecurity from many different perspectives and at many different levels, but historically they have focused on a technical perspective. Dr. Terrence August, Associate Professor at the Rady School of Management, housed at the University of California, San Diego, is studying cybersecurity from a microeconomic perspective, trying to understand the incentives of different parties in applying protection of computer systems in order to determine how security arises in equilibrium. For example, does it make economic sense for a company to download and install a security patch update for their system? He is asking what goes into making the patching decision, which parties are involved, what are the incentives for each party, and how much effort is reasonable to invest to protect a product? He is also exploring the government’s role in applying legislation surrounding security, and whether a producer of software should have any liability on users’ economic losses should an attack occur. What should the standards for security be, both for the government and for a company, based on all of the varying interests of involved parties, and how do incentives come into play when those decisions are being made? Dr. August is researching the components that go into making cybersecurity decisions in order to better understand the role for economic incentives, and to be able to adjust those incentives to reach “better” equilibria that helps protects systems and electronically-stored data. A basic understanding of this complex system is critical for developing policy decisions.

Current research projects are motivated by three major research questions:

1. Does imposing liability on software vendors improve information security risk, and what is the appropriate role for government policy?

   a. This project is directed at identifying what role government should be responsible for in regulating cybersecurity. Should there be minimum standards imposed, and if so what are those standards? Dr. August is approaching this from an economic perspective, considering both government, vendor, and user interests. Absurdly high standards would ultimately lead to economic inefficiency.

2. How do various software deployment models (e.g., SaaS (software hosted by a vendor network) versus on-premises (software installed on user hardware)) impact security with distinct risk profiles?

   a. Hackers or Internet users with malicious intent have different incentives based on which interface or software systems their targets use. Would it make sense to develop malicious programs that attack the most common software platform to increase spread, or the most vulnerable platform to ensure ease of infection? The incentive to attack Windows, for example, which is an operating system run on the majority of computers around the world, is different from incentives to attack the Sony playstation network, which is hosted on Sony servers. Dr. August is researching how these different malicious objectives interact with the security strengths and weaknesses of each software model.

3. When accounting for underlying economic incentives, can open-source business models lead to heightened security, and under which specific market conditions do they have greatest efficacy?

   a. In typical downloaded application, the computers running the software install a program and run the binary code executed on that system. In open-source software, not only can a user run the software, but they also have access to the source code, which enables modification. The Apache HTTP Server, for example, is an open-source web server that employs a large community of users who contribute to improving the software by helping to maintain it. Because you can see the actual code, it is easier to detect bugs / flaws. This lies in stark contrast to Salesforce whose CRM solution is only offered as a SaaS option. Not only is the source code not available, but even the binaries themselves are only run on Salesforce servers. Notably, such a model permits far less piracy. Considering the continuum from openness to closedness, Dr. August is examining the interaction between the levels of (code) accessibility and security. If the model of a product is changed, the economic impacts are also changed, such as the relationship between profitability and security, making it important to understand the mechanics.