The economics of mandatory security breach reporting to authorities
Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to...
Verfasser: | |
---|---|
FB/Einrichtung: | FB 04: Wirtschaftswissenschaftliche Fakultät |
Dokumenttypen: | Artikel |
Medientypen: | Text |
Erscheinungsdatum: | 2016 |
Publikation in MIAMI: | 10.02.2017 |
Datum der letzten Änderung: | 16.04.2019 |
Angaben zur Ausgabe: | [Electronic ed.] |
Quelle: | Journal of Cybersecurity 2 (2016) 1, 29-41 |
Fachgebiet (DDC): | 330: Wirtschaft |
Lizenz: | CC BY-NC 4.0 |
Sprache: | English |
Anmerkungen: | Finanziert durch den Open-Access-Publikationsfonds 2015/2016 der Westfälischen Wilhelms-Universität Münster (WWU Münster). |
Format: | PDF-Dokument |
ISSN: | 2057-2093 |
URN: | urn:nbn:de:hbz:6-53229502051 |
Weitere Identifikatoren: | DOI: 10.1093/cybsec/tyw002 |
Permalink: | https://nbn-resolving.de/urn:nbn:de:hbz:6-53229502051 |
Onlinezugriff: | tyw002.pdf |
Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to authorities. The model assumes that firms (agents) have few incentives to unilaterally report breaches. To enforce the law, regulators (principals) can introduce security audits and sanction noncompliance. However, audits cannot differentiate between concealment and nescience of the agents. Even under optimistic assumptions regarding the effectiveness of mandatory security breach reporting to authorities in reducing individual losses, our model predicts that it may be difficult to adjust the sanction level such that breach notification laws generate social benefit.