## 3 Methodology
### Sequential Move Game Model
#### 3.3.1. Solution of the Sequential Move Game Model  
Let \(x^{*}=\frac{1}{1+\omega(1-2p_{1})}\). Then, we have the following proposition:  
**Proposition 3**. : _When \(p_{2}<\frac{1}{2}\),_  
\[ \begin{split}\text{(i) If }\delta<x^{*}\\ \text{BNE}(I_{2})=\begin{cases}\begin{pmatrix}R_{aut}^{M}\,R_{aut}^{L }\,D_{accept}^{aut}\ D_{prect}^{cyb}\end{pmatrix}&\text{ if }C_{cyb}>\beta(2p_{1}-1)\\ \begin{pmatrix}R_{cyb}^{M}\,R_{aut}^{L}\,D_{accept}^{aut}\ D_{reject}^{cyb}\end{pmatrix}&\text{ if }C_{cyb}<\beta(2p_{1}-1) \end{split} \\ \text{(ii) If }\delta>x^{*},\\ \text{BNE}(I_{2})= \begin{cases}\begin{array}{ll}\text{No equilibria}&\text{ if }C_{cyb}<\beta(2p_{1}-1)\\ \begin{pmatrix}R_{aut}^{M}\,R_{aut}^{L}\,D_{prect}^{unt}\ D_{reject}^{cyb}\end{array} \end{cases} &\text{ if }C_{cyb}>\beta(2p_{1}-1)\end{split}\\ \end{split} \tag{5}\]  
Proof. : See Appendix C. \(\square\)  
**Proposition 4**. : _When \(p_{2}>\frac{1}{2}\),_  
\[ \begin{split}\text{(i) If }\delta<x^{*}\text{, then}\\ \text{BNE}(I_{2})=\begin{cases}\begin{pmatrix}R_{cyb}^{M}\,R_{aut}^{L}\,D_{accept}^{ ant}\ D_{accept}^{cyb}\end{pmatrix}&\text{ if }C_{cyb}<2\beta(p_{1}-p_{2})\\ \begin{pmatrix}R_{aut}^{M}\,R_{aut}^{L}\,D_{accept}^{ ant}\ D_{accept}^{cyb}\end{pmatrix}&\text{ if }C_{cyb}>2\beta(p_{1}-p_{2}) \end{split} \\ \end{split} \tag{6}\]  
Proof. : See Appendix D. \(\square\)  
BNE of the sequential move game can be represented by a flowchart based on Propositions 3 and 4, as shown in Figure 4.  
Propositions 3 and 4 provide insights into optimal strategies under different conditions for \(p_{1}\), \(p_{2},\delta\), and \(C_{cyb}\). Here, \(p_{1}\) represents the probability that a malicious insider launching authentication \(\left(R_{aut}^{M}\right)\) to commit malicious acts is detected, while \(p_{2}\) represents the probability that a malicious insider launching a cyberattack \(\left(R_{cyb}^{M}\right)\) is detected. When the probability that a malicious insider using a cyberattack is detected is smaller than \(\frac{1}{2}\), i.e., \(p_{2}<\frac{1}{2}\), two cases arise:  
Case (i): \(\delta<x^{*}\) (i.e., the probability that an insider is malicious is less than the value \(x^{*}\)). If \(C_{cyb}>\beta(2p_{1}-1)\),  
* _Insider Strategy:_ Both malicious and legitimate insiders choose authentication \(\left(R_{aut}^{M}R_{aut}^{L}\right)\). * _Defender Strategy:_ The defender accepts authentication requests \(\left(D_{\text{accept}}^{aut}\right)\) but rejects cyberattacks \(\left(D_{\text{reject}}^{cyb}\right)\). If \(C_{cyb}<\beta(2p_{1}-1)\),* _Insider Strategy:_ Malicious insiders choose cyberattack and legitimate insiders choose authentication \(\left(R_{c\text{y}b}^{M}R_{aut}^{L}\right)\). * _Defender Strategy:_ The defender accepts authentication requests \(\left(D_{\text{accept}}^{\text{aut}}\right)\) but rejects cyberattacks \(\left(D_{\text{reject}}^{c\text{y}b}\right)\). Case (ii): \(\delta>x^{*}\) (i.e., the probability that an insider is malicious is greater than \(x^{*}\)). If \(C_{c\text{y}b}<\beta(2p_{1}-1)\),
* _Outcome:_ No equilibrium exists because the defender cannot effectively balance the cost of rejecting requests and the risk of allowing malicious activity. If \(C_{c\text{y}b}>\beta(2p_{1}-1)\),
* _Insider Strategy:_ Both malicious and legitimate insiders choose authentication (\(R_{aut}^{M}R_{aut}^{L}\)). * _Defender Strategy:_ The defender rejects both authentication requests and cyberattacks \(\left(D_{\text{reject}}^{aut}D_{\text{reject}}^{c\text{y}b}\right)\). For \(p_{2}<\frac{1}{2}\), the defender's strategy depends on the cost of the cyberattack \(\left(C_{c\text{y}b}\right)\) and the probability of discovering a malicious insider. At lower values of \(\delta\), when the probability of malicious insiders is low, the defender is more likely to accept authentication requests while rejecting cyberattacks. At higher \(\delta\), the defender increasingly rejects all requests to safeguard sensitive data.