黑客参与下企业信息安全投资与定价决策研究

Research on Firm Information Security Investment and Pricing Decision with Hacker Participation

摘要: 随着信息网络通信技术的发展，企业面临着越来越多的信息安全挑战。由于市场规模有限，商业环境的日渐复杂，企业之间往往存在一定程度的竞争。随着消费者越来越关注信息安全，企业之间的竞争也从单方面的价格竞争发展到价格和安全的双重竞争，价格和安全共同影响着企业的市场规模。在这样的背景下，本文将策略黑客作为理性参与者，构建了价格和安全双重竞争的企业和策略黑客之间的博弈理论模型，通过逆向归纳法求解得到企业在单独决策和联合决策下的均衡决策。紧接着，本文采用比较静态分析的方法，详细探讨了价格竞争、安全竞争等核心要素对于企业均衡决策和期望收益的影响。此外，通过对比两种模式下的均衡决策，发现企业在单独决策时存在安全努力扭曲问题。因此，本文提出了基于安全努力的合作机制来协调企业的安全努力，从而达到社会最优安全水平。最后，本文分析了上述核心要素对于该机制的影响并验证了该机制的有效性。

Abstract: With the development of information network communication technology, firms are facing more and more information security challenges. Due to the limited size of the market and the increasing complexity of the business environment, there is often a certain degree of competition between firms. As consumers become more and more concerned about information security, the competition among firms has developed from unilateral price competition to dual competition of price and security, with price and security jointly affecting the market size of firms. In such a background, this paper takes strategic hackers as rational participants, constructs a game theoretical model between firms and strategic hackers with dual competition of price and security, and solves the equilibrium decisions of firms under individual decision and joint decision by backward induction. After that, this paper adopts the method of comparative static analysis to explore in detail the impact of core elements such as price competition and security competition on the equilibrium decision and expected payoff of firms. In addition, by comparing the equilibrium decisions under the two models, we found that there exists the distortion problem of the security effort under the In-house model. To address this problem, we propose the cooperative mechanism based on security efforts to coordinate the security efforts of firms so as to achieve the socially optimal security level. Finally, we analyze the effect of the above core elements on the mechanism and verify the effectiveness of the mechanism.