Economic Incentives to Increase Security in the Internet: The Case for Insurance

TLDR

Internet entities face interdependent epidemic risks, yet they underinvest in security because they ignore benefits conferred on others. The study seeks to design incentives that motivate Internet entities to invest at a socially efficient level. The authors propose insurance as a mechanism to align individual incentives with social efficiency. Insurance effectively increases self‑protection and overall Internet security, making it a key component of risk management.

Abstract

Entities in the Internet, ranging from individuals and enterprises to service providers, face a broad range of epidemic risks such as worms, viruses, and botnet-driven attacks. Those risks are interdependent risks, which means that the decision by an entity to invest in security and self-protect affects the risk faced by others (for example, the risk faced by an individual decreases when its providers increases its investments in security). As a result of this, entities tend to invest too little in self-protection, relative to the socially efficient level, by ignoring benefits conferred on by others. In this paper, we consider the problem of designing incentives to entities in the Internet so that they invest at a socially efficient level. In particular, we find that insurance is a powerful incentive mechanism which pushes agents to invest in self-protection. Thus, insurance increases the level of self-protection, and therefore the level of security, in the Internet. As a result, we believe that insurance should be considered as an important component of risk management in the Internet.