THREE ARTICLES ON THE BEHAVIORAL ECONOMICS OF SECURITY INFORMATION SHARING: A THEORETICAL FRAMEWORK, AN EMPIRICAL TEST, AND POLICY RECOMMENDATIONS

This thesis presents a behavioral economics contribution to the security of information systems. It focuses on security information sharing (SIS) between operators of critical infrastructures, such as systemic banks, power grids, or telecommunications. SIS is an activity by which these operators exchange cybersecurity-relevant information, for instance on vulnerabilities, malwares, data breaches, etc. Such information sharing is a low-cost and efficient way by which the defenders of such infrastructures can enhance cybersecurity. However, despite this advantage, economic (dis)incentives, such as the free-rider problem, often reduce the extent to which SIS is actually used in practice. This thesis responds to this problem with three published articles. The first article sets out a theoretical framework that proposes an association between human behavior and SIS outcomes. The second article further develops and empirically tests this proposed association, using data from a self-developed psychometric survey among all participants of the Swiss Reporting and Analysis Centre for Information Assurance (MELANI). SIS is measured by a dual approach (intensity and frequency), and hypotheses on five salient factors that are likely associated with SIS outcomes (attitude, reciprocity, executional cost, reputation, trust) are tested. In the third article, policy recommendations are presented in order to reduce executional costs, which is found to be significantly and negatively associated with SIS. In conclusion, this thesis proposes multiple scientific and practical contributions. It extends the scientific literature on the economics of cybersecurity with three contributions on the human factor in SIS. In addition, regulators will find many recommendations, particularly in the area of governance, to support SIS at the legislative level. This thesis also offers many avenues for practitioners to improve the efficiency of SIS, particularly within Information Sharing and Analysis Centers (ISACs) in charge of producing Cyber Threat Intelligence in order to anticipate and prevent cyberrisks.Cette these presente une contribution de l'economie comportementale a la securite des systemes d'information. Elle s’interesse au mecanisme incitatif permettant de favoriser le partage de l’information utile a la cybersecurite (Security Information Sharing – SIS) entre operateurs d’infrastructures critiques, telles que les banques systemiques, les reseaux electriques ou de telecommunications. Le SIS est une activite par laquelle ces operateurs echangent des informations relatives aux cybermenaces, par exemple sur les vulnerabilites, les logiciels malveillants, les violations de donnees, etc. Ce partage d'informations est un moyen peu couteux et efficace par lequel les defenseurs de ces infrastructures peuvent renforcer la cybersecurite. Toutefois, malgre ces avantages, les (mauvaises) incitations economiques, telles que le probleme du passager clandestin, reduisent souvent l’utilite pratique du SIS. Cette these repond a ce probleme avec trois articles publies. Le premier article presente un cadre theorique qui propose une association entre le comportement humain et les resultats du SIS. Le deuxieme article developpe et teste empiriquement cette proposition d'association a l'aide des donnees d'une enquete psychometrique developpee avec les participants de la Centrale d'enregistrement et d'analyse pour la surete de l'information (MELANI). Le SIS est mesure avec une double approche (intensite et frequence), et des hypotheses sur cinq facteurs importants, probablement associes aux resultats du SIS (attitude, reciprocite, cout d'execution, reputation, confiance), sont testees. Dans le troisieme article, des recommandations politiques sont presentees afin de reduire les couts d'execution, qui s'averent etre associes de maniere significative et negative au SIS. En conclusion, cette these propose de multiples contributions scientifiques et pratiques. Ses resultats elargissent la litterature scientifique sur l'economie de la cybersecurite avec trois contributions sur le facteur humain dans le SIS. En outre, les regulateurs trouveront de nombreuses recommandations, en particulier dans le domaine de la gouvernance, pour soutenir le SIS au niveau legislatif. Cette these offre egalement de nombreux moyens aux praticiens pour ameliorer son efficacite, notamment au sein des Information Sharing and Analysis Center (ISACs) charges de produire du renseignement sur les cybermenaces (Cyber Threat Intelligence) afin d'anticiper et prevenir les cyberrisques.