Information security decisions of security-interdependent firms in the presence of consumer sensitivity

Abstract

Firms suffer security-interdependent risks while applying network technology, causing severe customer churn. This paper studies the security and price decisions of security-interdependent firms that face security-sensitivity consumers. We show that one firm's product price increases (decreases) with the other's security efforts under positive (negative) interdependence. Firms can overinvest or underinvest in security due to security interdependence. Two mechanisms are proposed to solve this distortion. In the Reward mechanism, the firms reward (penalize) the other under the positive (negative) interdependence. In the Outsourcing mechanism, the security service providers raise (reduce) the compensations with consumer sensitivity.