1st International Conference on Game Theory for Networks

Research Article

Uncertainty in the weakest-link security game

  • @INPROCEEDINGS{10.1109/GAMENETS.2009.5137460,
        author={Jens Grossklags and Benjamin Johnson},
        title={Uncertainty in the weakest-link security game},
        proceedings={1st International Conference on Game Theory for Networks},
  • Jens Grossklags
    Benjamin Johnson
    Year: 2009
    Uncertainty in the weakest-link security game
    DOI: 10.1109/GAMENETS.2009.5137460
Jens Grossklags1,*, Benjamin Johnson2,*
  • 1: School of Information, University of California, Berkeley, CA 94720, USA
  • 2: CyLab, Carnegie Mellon University, Pittsburgh, PA 15213, USA
*Contact email: jensg@ischool.berkeley.ed, johnsonb@andrew.cmu.edu


Individuals in computer networks not only have to invest to secure their private resources from potential attackers, but have to be aware of the existing interdependencies that exist with other network participants. Indeed, a user's security is frequently negatively impacted by protection failures of even just one other individual, the weakest link. In this paper, we are interested in the impact of bounded rationality and limited information on user payoffs and strategies in the presence of strong weakest-link externalities. As a first contribution, we address the problem of bounded rationality by proposing a simple but novel modeling approach. We anticipate the vast majority of users to be unsophisticated and to apply approximate decision-rules that fail to accurately appreciate the impact of their decisions on others. Expert agents, on the other hand, fully comprehend to which extent their own and others' security choices affect the network as a whole, and respond rationally. The second contribution of this paper is to address how the security choices by users are mediated by the information available on the severity of the threats the network faces. We assume that each individual faces a randomly drawn probability of being subject to a direct attack. We study how the decisions of the expert user differ if all draws are common knowledge, compared to a scenario where this information is only privately known. We further propose a metric to quantify the value of information available: the payoff difference between complete and incomplete information conditions, divided by the payoff under the incomplete information condition. We study this ratio metric graphically and isolate parameter regions where being more informed creates a payoff advantage for the expert agent.