信息安全外包市场的博弈分析
A Game Theoretic Economics Framework to understanding Information Security Oursourcing Market
摘要：
在信息安全外包市场上，企业不想让外部公司（通常称为MSSP管理的安全服务提供商）来照顾他们的安全需求的一个重要原因是，他们担心MSSP提供的服务质量，因为他们无法监控MSSP的工作。由于MSSP的行为对买方来说是不可观察的，MSSP可以通过比合同要求的更少的努力来降低成本，并获得更高的利润。在信息不对称的文献中，这种可能的秘密逃避行为被称为道德风险问题。本文通过一个博弈论的经济学框架，证明了在信息不对称的条件下，可以设计一个最优契约，使得MSSP能够坚持他们承诺的努力水平。我们还表明，最优合同应该是基于性能的，即，对MSSP的付款应根据MSSP的安全服务的执行情况进行分期付款。为了比较，我们还表明，如果道德风险问题不存在，最优合同不依赖于MSSP的性能。一个合同，规定不断支付给MSSP将是最佳的。此外，本文还证明了无论是在完全信息情形下还是在不完全信息情形下，交易成本越高，对移动通信服务提供商的支付越低。
英文摘要：
On information security outsourcing market, an important reason that firms do not want to let outside firms(usually called MSSPs-Managed Security Service Providers) to take care of their security need is that they worry about service quality MSSPs provide because they cannot monitor effort of the MSSPs. Since MSSPs action is unobservable to buyers, MSSPs can lower cost by working less hard than required in the contract and get higher profit. In the asymmetric information literature, this possible secret shirking behavior is termed as moral hazard problem. This paper considers a game theoretic economic framework to show that under information asymmetry, an optimal contract can be designed so that MSSPs will stick to their promised effort level. We also show that the optimal contract should be performance-based, i.e., payment to MSSP should base on performance of MSSP's security service period by period. For comparison, we also showed that if the moral hazard problem does not exist, the optimal contract does not depend on MSSP's performance. A contract that specifies constant payment to MSSP will be optimal. Besides these, we show that for no matter under perfect information scenario or imperfect information scenario, the higher the transaction cost is, the lower payment to MSSPs will be.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
