A game-theoretic analysis of information sharing and security investment for complementary firms

This paper investigates information sharing and security investments by two firms provided that their information assets are complementary in the sense that their combined information assets are of significant value, whereas the information asset of a single firm is no value to an attacker. In particular, assuming that each firm chooses its security investment and information sharing individually, we obtain some insights about the optimal choices for the firms and the attacker, which form sharp comparisons with those derived from common (substitutive) firms. We further analyse the effect of a social planner on social total costs by assuming that it can control security investments, information sharing and both of them respectively. We demonstrate that an increase in intervention by the social planner may not necessarily be preferable.