Designing Rating Systems to Promote Mutual Security for Interconnected Networks
Interconnected Autonomous Systems (ASs) often share security risks. However, an AS lacks the incentive to make (sufficient) security investments if the cost exceeds its own benefit even though doing that would be socially beneficial. In this paper, the authors develop a systematic and rigorous framework for analyzing and significantly improving the mutual security of a collection of ASs that interact frequently over a long period of time. Using this framework, they show that simple incentive schemes based on rating systems can be designed to encourage the ASs' security investments, thereby significantly improving their mutual security. When designing the optimal rating systems, they explicitly consider that monitoring the ASs' investment actions is imperfect and that the cyber-environment exhibits unique characteristics.