Economics CS 261: Computer Security Scribe Notes December 2, 2009 Scribed by: Emil Stefanov Externalities - "Security is economics" o For example, the global utility of fax machines scales with the number of people who have fax machines. If only a few people have them, they are not very useful. If everyone has them then they become very useful. - Economics says that prices of goods don’t include externalities and the market is not optimal. - An example externality is computer users who care to protect their data, but may not be interested in protecting their computer from worms that attack others. - The first inventor of a product can set the standard and quality and make it really hard for others to improve on it because people get used to the first design. - Externality for egress filtering (this is a type of internet traffic filtering where the ISP’s drop packets for which their source address does not correspond to the location they came from). o If the ISP does filtering, everyone else benefits a little bit but the ISP does not benefit much. - DDOS - more general phenomena of Botnets - An economics person would say we should combat externalities by reflecting them in the cost that the market participants bear (e.g., impose a cost on the factory that causes the pollution). - When thinking about this o A preliminary approach might be to make computer owners liable  If you’re your grandparents’ computer is infected, is it really their fault or should someone else take the blame?  When some credit company's numbers get hacked should the Botnet clients be liable? Those clients can run on computers of uniformed users. o Who should be liable for what? o It is really easy to get into arguments and it’s hard to figure out what is the true cost of something. - Suppose I know nothing about security what should I do? o Many people say "buy a Mac" o Macs have much less worms (orders of magnitude) o It is expected that virus writers would target the more popular systemsWindows/Mac Game Theory Let’s model viruses that target Windows/Mac as a game (game theory): Variables - Windows market share: f - Value of compromising a host: v (Windows or Mac, it doesn’t matter) Payoff Matrix for Attacker: Defend Windows Defend Mac Attack Windows 0 fv Attack Mac (1-f)v 0 Game theory says that the optimal strategy is to attack windows with probability f and Mac with probability 1-f. Improved model Variables - Windows market share: f - Value of compromising a host: v (Windows or Mac, it doesn’t matter) - The defender (e.g., anti-virus) wins p of the time and the attacker wins 1-p of the time. Payoff Matrix for Attacker Defend Windows Defend Mac Attack Windows (1-p)fv fv Attack Mac (1-f)v (1-p)(1-f)v Game theory says the following about the dominant strategy: If f/(1-f) > 1/(1-p) then Attacker's dominant strategy is: Attack Windows 100% of time. For example: If p=95%, then critical value for f is 100%-4.8% (for the equation above). If p=80%, then … 100%-16.7%. The paper talks about the market for melons. This means that: - Sellers have perfect information about a product they are buying - Buyer has imperfect information (some information, but not as good as the sellers).Conclusion: This situation drives sellers to sell low quality lemons and buyers to buy the low quality melons -- drives the market to lower quality (the least common denominator). In security: If we have a lemon market, then the market will drive to low security products for lower prices because the buyers have no way of distinguishing the secure from the unsecure products (they have imperfect information). Imperfect Information in Markets Buyer knows Buyer ignorant Seller knows Efficient markets Market for lemons Ex: insurance Encryption software (an expert is selling it), software products in general Seller Ignorant Market for lines Ex: Privacy (I am the seller selling my information to get a service) Ignorance Ex: anti-virus (maybe a little bit), many software products - Signaling o For example Peacock tails:  The peacocks that have an easier time to survive can spend more energy on more attractive tails so the females are right to prefer the better tails. o Another example:  Banks spend unnecessary amount of money for great looking vaults. Makes it hard for crook banks to fake being real banks because they can't spend that much money on a vault. o Maybe yet another example:  A college degree just signals that you can do it not that it actually helped you. Just a