RESEARCH ARTICLE CORRELATED FAILURES, DIVERSIFICATION, AND INFORMATION SECURITY RISK MANAGEMENT 1 Pei-yu Chen Department of Management Information Systems, Fox School of Business and Management, Temple University, 1801 N. Broad St reet, Philad elphia, PA 19122 U.S.A. {pychen@temp le.edu} Gaurav Kataria Booz & Co., 127 Public Squire, Suite 5300, Cleveland, OH 44114 U.S.A. {[email protected] om} Ramayya Krishnan School of Information Systems and Management, The Heinz College, Carnegie Mellon University, 5000 For bes Av enue, P ittsburgh, PA 15213 U.S.A. {[email protected]} The increasing dependence on information networks for business operations has focused managerial attention on managing risks posed by failure of these networks. In this paper, we develop models to assess the risk of failure on the availability of an information network due to attacks that exploit software vulnerabilities. Software vulnerabilities arise from software installed on the nodes of the network. When the same software stack is installed on multiple nodes on the network, software vulnerabilities are shared among them. These shared vulnerabilities can result in correlated failure of multiple nodes resulting in longer repair times and greater loss of availabilit y of the network. Considering positive network effects (e.g., compatibility) alone without taking the risks of correlated failure and the resulting downtime into account would lead to overinvestment in homogeneous so ftware deployment. Exploiting characteristics unique to information networks, we present a queuing model that allows us to quan tify downtime loss faced by a rm as a function of (1) investment in security technologies to avert attacks, (2) software diversification to limit the risk of correlated failure under attacks , and (3) investment in IT resourc es to repair failures due to a ttacks. The novelty of this method is that we endogenize the failure distribution and the node correlation distribution, and show how the diversification strategy and other security measures/investments may impact these two distributions, which in turn determine the secu rity loss faced by the firm. We analyze and disc uss the effectiveness of diversification strategy under diff erent operating conditions and in the presence of changing vulnerabilities. We also take into account the be nefits and costs of a diver sification strategy. Our analysis provides conditions under which diversification strategy is advantageous. Keywords: Security, diversification, downtime loss, s oftware allocation, network effects, risk management, correlated failures 1 1 H. Raghav Rao was the accepting senior editor for this paper. Ram Gopal served as the associate editor. The appendix for this paper is located in the “Online Supplements” section of the MIS Quarterly’s website (http://www.misq.org) . MIS Quarterly Vol. 35 No. 2 pp. 397-422/June 2011 397
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 1/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 2/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 3/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 4/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 5/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 6/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 7/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 8/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 9/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 10/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 11/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 12/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 13/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 14/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 15/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 16/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 17/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 18/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 19/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 20/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 21/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 22/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 23/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 24/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 25/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 26/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 27/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 28/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 29/30
7/27/2019 Correlated Failures Diver
http://slidepdf.com/reader/full/correlated-failures-diver 30/30
Related Documents
