Contracting Information Security in the Presence of Double Moral Hazard

Cited 24 time in webofscience Cited 0 time in scopus
  • Hit : 364
  • Download : 0
In information security outsourcing, it is the norm that the outsourcing firms and the outsourcers (commonly called managed security service providers, MSSPs) need to coordinate their efforts for better security. Nevertheless, efforts are often private and thus both firms and MSSPs can suffer from double moral hazard. Furthermore, the double moral hazard problem in security outsourcing is complicated by the existence of strong externality and the multiclient nature of MSSP services. In this prescriptive research, we first show that the prevailing contract structure in security outsourcing, bilateral refund contract, cannot solve double moral hazard. Adding breach-contingent sunk cost or external payment cannot solve double moral hazard either. Furthermore, positive externality can worsen double moral hazard. We then propose a new contract structure termed multilateral contract and show that it can solve double moral hazard and induce first-best efforts from all contractual parties when an MSSP serves two or more client firms, regardless of the externality. Firm-side externality significantly affects how payments flow under a multilateral contract when a security breach happens. When the number of client firms for an MSSP increases, we show that the contingent payments under multilateral contracts for any security breach scenario can be easily calculated using an additive method, and thus are computationally simple to implement.
Publisher
INFORMS
Issue Date
2013-06
Language
English
Article Type
Article
Keywords

SOFTWARE-DEVELOPMENT; LINEAR CONTRACTS; MULTIPLE AGENTS; INCENTIVES; WARRANTIES

Citation

INFORMATION SYSTEMS RESEARCH, v.24, no.2, pp.295 - 311

ISSN
1047-7047
DOI
10.1287/isre.1120.0447
URI
http://hdl.handle.net/10203/208698
Appears in Collection
MG-Journal Papers(저널논문)
Files in This Item
There are no files associated with this item.
This item is cited by other documents in WoS
⊙ Detail Information in WoSⓡ Click to see webofscience_button
⊙ Cited 24 items in WoS Click to see citing articles in records_button

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0