查看文章

To efficiently manage information security, firms typically allocate limited budgets to protect their information assets based on asset types and hacker types. This paper builds a game-theoretical model to discuss the strategic interaction between a firm that tries to protect its core and non-core assets and a strategic hacker that can launch a targeted attack or indiscriminate attack. The analysis results show that irrelevant of the hacker types, when the firm’s core assets become more important or more vulnerable, both the firm and the hacker increase their efforts on core assets. Considering hacker types, the hacker who launches a targeted attack will always exert the highest efforts and lowest efforts on the firm’s two types of assets, while exerting moderate efforts when launching an indiscriminate attack. While considering asset types, when the gap between the value of core and non-core assets is large, the hacker …