Attack-Deterring and Damage-Control Investments in Cybersecurity

摘要: This paper studies investment in cybersecurity, where both the software vendor and consumers can invest security. In addition, undertake attack-deterring damage-control investments. I show that full liability, under which is liable for all damages, does not achieve efficiency and, particular, underinvests attack deterrence overinvests damage control. Instead, joint use of an optimal standard, establishes a minimum compliance framework, partial liability restore efficiency. suggests policies encourage only firms, but also to security might be desirable.