Security investment games of interdependent organizations

In various computer security settings, such as when customers use the same passwords at several independent Web sites, security decisions made by one organization may have significant impact on the security of another. We develop a model for security decision-making in inter-dependent organizations described by a linear influence network. In this model, a matrix represents how one organization's investments are augmented by some linear function of its neighbors investments. Each element of the matrix, representing the strength of influence of one organization on another, can be positive or negative and need not be symmetric with respect to two organizations. A simple matrix condition implies the existence and uniqueness of Nash equilibria, which can be reached by a natural iterative algorithm. We demonstrate that there are ways of improving the matrix such that two organizations decrease their investments while all others maintain the same level of investment. We apply this framework to the setting of Web site security with shared passwords.