SingRu Celine Hoe

Impact of security risks on cloud computing adoption

Cloud computing has been a paradigm shift in the information technology domain. It offers potential benefits to users in terms of instant availability, scalability and resource sharing, while potentially posing security issues. Especially, recent events like Amazons system failure increased the concerns related to cloud computing1. Given these security and reliability concerns, we explore the optimal decision rule for moving certain IT function to public clouds. We formulate the problem as an entrepreneurial decision for an optimal stopping time at which the entrepreneur shall migrate to the cloud computing paradigm. Two different models are presented. Recognizing that an important and specific issue related to different computing paradigm is the potential “security” risk posed by each technology, we consider security risks in both models. The first model approaches the optimal adoption problem from assessing the cloud computing adoption under project value uncertainty. The entrepreneur has the timing flexibility and solves his optimal adoption decision under uncertainty. The optimal adoption rule obtained is a threshold strategy. A firm should adopt the cloud computing only if the value from the adoption exceeds the threshold level. The second model builds on a comprehensive assessment of two different computing paradigms. The entrepreneur can either keep the traditional on-site computing paradigm or migrate to the cloud computing paradigm. His problem is to make the paradigm shift optimally. We model such a problem as optimally swapping two “risky” assets, which refer to benefits of the traditional on-site computing paradigm and those of the cloud computing paradigm. The term “risky” captures the fact that actual benefits can only be resolved through time, and thus estimates of benefits are embedded with uncertainty. We obtain the optimal swapping rule as a threshold strategy, defined in terms of the two benefit ratio. A firm should only shift the part of its business to the cloud computing service if the ratio, the benefit from the cloud computing paradigm over that from the traditional on-site computing paradigm, exceeds the threshold. In both models, both the extent of riskiness (i.e. uncertainty) and the significance of security risks (both in terms of potential occurrence probability and the severity of damage) affect the threshold level, thus the entrepreneurial adoption decision.

A game-theoretical approach for finding optimal strategies in a botnet defense model

Botnets are networks of computers infected with malicious programs that allow cybercriminals/botnet herders to control the infected machines remotely without the users knowledge. In many cases, botnet herders are motivated by economic incentives and try to significantly profit from illegal botnet activity while causing significant economic damage to society. To analyze the economic aspects of botnet activity and suggest feasible defensive strategies, we provide a comprehensive game theoretical framework that models the interaction between the botnet herder and the defender group (network/computer users). In our framework, a botnet herders goal is to intensify his intrusion in a network of computers for pursuing economic profits whereas the defender groups goal is to defend botnet herders intrusion. The percentage of infected computers in the network evolves according to a modified SIS (susceptible-infectious-susceptible) epidemic model. For a given level of network defense, we define the strategy of the botnet herder as the solution of a control problem and obtain the optimal strategy as a feedback on the rate of infection. In addition, using a differential game model, we obtain two possible closed-loop Nash equilibrium solutions. They depend on the effectiveness of available defense strategies and control/strategy switching thresholds, specified as rates of infection. The two equilibria are either (1) the defender group defends at maximum level while the botnet herder exerts an intermediate constant intensity attack effort or (2) the defender group applies an intermediate constant intensity defense effort while the botnet herder attacks at full power.

Real Options Games in Complete and Incomplete Markets with Several Decision Makers

We consider optimal investment policies for irreversible capital investment projects under uncertainty in a monopoly situation and in a Stackelberg leader-follower game. We consider two types of payoffs: lump-sum and cash flows. The decisions are the times to enter into the market. The problems belong to the class of optimal stopping times, for which the right approach is that of variational inequalities (V.I.s). In the case of complete markets, payoffs are expected values with respect to the risk-neutral probability. In the case of incomplete markets, the risk-neutral probability is not defined. We consider an investor maximizing his/her utility function, and we consider the investment in the project as an additional decision, besides portfolio investment and consumption decisions. This decision remains a stopping time, conversely to the portfolio investment and consumption decisions (continuous controls). The game problem raises new difficulties. The leaders V.I. has a nondifferentiable obstacle. The weak formulation of the V.I. handles this difficulty. In some cases, the solution of the V.I. may be continuously differentiable although the obstacle is not. An additional difficulty occurs for lump-sum payoffs in the case of incomplete markets. We cannot compare gains and losses at different times. We propose an alternative approach, using equivalence (indifference) considerations. In the case of payoffs characterized by cash flows, this difficulty does not exist, but an intermediary problem arises which has a nice interpretation as a differential game. The solutions thus obtained for the Stackelberg game are not intuitive. Therefore, competition has important consequences on investment decisions.

REAL OPTIONS WITH COMPETITION AND REGIME SWITCHING

In this paper, we examine irreversible investment decisions in duopoly games with a variable economic climate. Integrating timing flexibility, competition, and changes in the economic environment in the form of a cash flow process with regime switching, the problem is formulated as a stopping‐time game under Stackelberg leader‐follower competition, in which both players determine their respective optimal market entry time. By extending the variational inequality approach, we solve for the free boundaries and obtain optimal investment strategies for each player. Despite the lack of regularity in the leaders obstacle and the cash flow regime uncertainty, the regime‐dependent optimal policies for both the leader and the follower are obtained. In addition, we perform comprehensive numerical experiments to demonstrate the properties of solutions and to gain insights into the implications of regime switching.

A Game Theoretical Analysis of Lemonizing Cybercriminal Black Markets

It is known that cybercriminal black markets that trade in illicit digital goods and services belong to markets for lemons due to the information asymmetry of quality of goods and services between sellers and buyers. Based on the seminal work of Akerlof [1], Franklin et al. [3] suggests that “Lemonizing the Market” be an effective way to crack down the well-developed cybercriminal underground market. In our work, we provide a game theoretical framework to analyze whether cybercriminal black markets can be effectivitely lemonized. First, we investigate if signaling quality through an extra provision, such as the offer of trial periods or a money-back guarantee, observed in this marketplace (see the Panda security report [6]) provides cybercriminals selling real illicit data (i.e., the peach group) with a solution to address the lemon market problem. We also study the relation between the market lemonization and the cost constraint on seller’s implementation of signaling of quality. We find that, because of the effectiveness of resolving quality uncertainty through perfect signaling of quality, law enforcement cannot clamp down the operation of this underground economy through “Lemonizing the Market” by joining the group of “pure lemons”, that is, joining the group of sellers with no crime products offered to sell (i.e., ripoff sellers). If no information of quality is disclosed, the market demand shrinks increasingly as lemons in the market increases. However, to secure the market demand, cybercriminals with real illicit data for sale always attempt to implement quality signaling to single out their quality products, accepting a higher amount of cost constraints on applying quality signaling as the portion of lemons in the market escalates.

The impact of competitive advantage on the investment timing in Stackelberg leader–follower game

ABSTRACT This short note clarifies how the Stackelberg leader’s competitive advantage after the follower’s entry affects the leader’s optimal market entry decision and Stackelberg strategic interactions under uncertainty. Although the Stackelberg leader’s first investment threshold remains constant and coincides with the monopolist’s investment trigger, his second (third) investment threshold, which defines the exit (entry) of the first (second) investment interval, increases with an increased competitive advantage. With an increased competitive advantage, the probability of sequential investment equilibrium (simultaneous investment equilibrium) increases (decreases) irrespective of the level of volatility. Moreover, for a given level of competitive advantage, an increase in the volatility tends to decrease (increase) the probability of simultaneous investment equilibrium (sequential investment equilibrium). For a richer set of results, endogenous firm roles are examined and analyzed as well. The leader’s preemptive threshold is negatively affected by his competitive advantage.

Studying dynamic equilibrium of cloud computing adoption with application of Mean Field Games

Computing is undergoing a substantial shift from client/server to the cloud. The enthusiasm for cloud infrastructures is not only present in the business world, but also extends to government agencies. Managers of both segments thus need to have a clear view of how this new era will evolve in the coming years, in order to appropriately react to a changing economic and technological environment. In this study, we explore the dynamic equilibrium of cloud computing adoption through the application of Mean Field Games. In our formulation, each agent (i.e., each firm or government agency) arbitrates between “continuing to implement the traditional on-site computing paradigm” and “moving to adopt the cloud computing paradigm”. To decide on his level of moving to the cloud computing paradigm, each agent will optimize a total cost that consists of two components: the effort cost of moving to the cloud computing paradigm and the adoption cost of implementing the cloud computing paradigm. In the formulation, the adoption cost is linked to the general trend of decisions on the computing paradigm adoption. Thus, an agents optimal level of transition to the cloud computing paradigm is not only dependent on his own effort and adoption costs but also affected by the general trend of adoption decisions. The problem is solved by a system of partial differential equations (PDEs), that is, mean field games PDEs, which consists of a backward PDE, the Hamilton Jacobi Bellman equation for a controlled problem, and a forward Fokker-Planck equation transported by the optimal control from the backward HJB equation. Thus, the solution to the forward Fokker-Planck equation enables us to study the dynamic evolution of the density of the cloud computing adoption. It therefore allows us to investigate the impact of the general trend of technology adoption decisions on a firms optimal decision of technology transition.

A trust-score-based access control in assured information sharing systems: An application of financial credit risk score models

Ensuring appropriate user access to information is a key objective of information security on a computer network. We propose a solution in which an individual user is assigned a universal trust score determined by applying the same model financial institutions use to determine an individuals credit risk score. This universal trust score is combined with the Bell-La Padula model to control the individuals access to information across multiple assured information sharing systems.

Real Options with Competition and Incomplete Markets

Ever since the first attempts to model capital investment decisions as options, financial economists have sought more accurate, more realistic real options models. Strategic interactions and market incompleteness are significant challenges that may render existing classical models inadequate to the task of managing the firm’s capital investments. The purpose of this paper is to address these challenges. The issue of incompleteness comes in for the valuation of payoffs due to absence of a unique martingale measure. One approach is to valuate assets by considering a rational utility-maximizing consumer/investor’s joint decisions with respect to portfolio investment strategy and consumption rule. In our situation, we add the stopping time as an additional decision. We employ variational inequalities (V.I.s) to solve the optimal stopping problems corresponding to times to invest. The regularity of the obstacle (payoffs received at the decision time) is a major element for defining the optimal strategy. Due to the lack of smoothness of the obstacle raised by the game problem, the optimal strategy is a two-interval solution, characterized by three thresholds.