Modeling and risk analysis of information sharing in the financial infrastructure

Abstract

This chapter defines the community of banks as a Complex Adaptive System of Systems (CASoS) and analyzes the value of information sharing as a general policy to protect the community against cyber attacks. We develop a model of interacting banks that have networks of business relations with a possible overlay network of shared information for cyber security. If a bank suffers a cyber attack, it incurs losses, and there is some probability that its infection will spread through the business network, imposing costs on its neighbors. Losses arising from financial system compromise continue until the problem is detected and remediated. The information sharing system allows detection events to be broadcast and also increases the probability of detecting the experimental probes that might precede the actual attack. Shared information is a public good: One institution’s agreeing to share information speeds responses at other institutions, reducing their probability of initial compromise. Information sharing participation carries with it costs which must be balanced by direct expected gain or subsidized in order for a critical number of banks to agree to share information and to discourage free riding. The analysis described in this chapter examines the incentives that motivate banks to participate in information sharing, the benefits to the financial system that arise from their participation, and the ways in which banks’ incentives might be shaped by policy to achieve a beneficial outcome for the system as a whole.