The effects of loss profiles in interdependent network security

Although system administrators are frequently urged to protect the machines in their network, the fact remains that the decision to mandate protection is far from universal. To better understand this decision, we formulate a model of interdependent network security where there is a system administrator responsible for a network of size n against autonomous attackers attempting to penetrate the network and infect the network machines with viruses or other exploits. We introduce the concept of a loss profile, which encapsulates the idea of variable loss due to infection. Through the application of a simple loss profile to this interdependent network security scenario, we conclude that the decision is dependent upon a number of factors including external and internal vulnerabilities, the types and likelihoods of different amounts of loss, and the interaction of all of these effects. Through this analysis, we form a model for decision-making that is simple to understand and applicable to many other interdependent security scenarios.