Protecting shared information in networks: a network security game with strategic attacks

A digital security breach, by which confidential information is leaked, does not only affect the agent whose system is infiltrated, but is also detrimental to other agents socially connected to the infiltrated system. Although it has been argued that these externalities create incentives to under-invest in security, this presumption is challenged by the possibility of strategic adversaries attacking the least protected agents. In this paper we study a new model of security games in which agents share tokens of information in a network. The agents have the opportunity to invest in security to protect against an attack that can either be strategic or random. In presence of a random attack under-investments indeed prevail. In presence of a strategic attack, we show that when dependencies among agents are low, because the information network is sparse or because the probability that information is shared is small, agents in fact tend to invest more in security than socially optimal. These over-investments pass on to under-investments when information sharing is more likely.