Working Paper: CEPR ID: DP6134
Authors: Jaypil Choi; Chaim Fershtman; Neil Gandal
Abstract: Software security is a major concern for vendors, consumers, and regulators since attackers that exploit vulnerabilities can cause substantial damages. When vulnerabilities are discovered after the software has been sold to consumers, the firms face a dilemma. A policy of disclosing vulnerabilities and issuing updates protects only the consumers who install updates, while the disclosure itself facilitates reverse engineering of the vulnerability by hackers. The paper develops a setting that examines the economic incentives facing software vendors and users when software is subject to vulnerabilities. We consider a firm that sells software which is subject to potential security breaches. The firm needs to set the price of the software and state whether it intends to disclose vulnerabilities and issue updates. Consumers differ in their value of the software and the potential damage that hackers may inflict and need to decide whether to purchase the software as well as whether to install updates. Prices, market shares, and profits depend on the disclosure policy of the firm. The paper analyzes the market outcome and derives the conditions under which a firm would disclose vulnerabilities. It then examines the effect of a regulatory policy that requires mandatory disclosure of vulnerabilities. The paper discusses the incentives to invest in product security by investigating how a decline in the number of vulnerabilities and an increase in the probability that the firm will identify vulnerabilities ex-post (before hackers) affect disclosure policy, price and profits.
Keywords: Disclosure Policy; Internet Security; Software Vulnerabilities
JEL Codes: L100; L630
Edges that are evidenced by causal inference methods are in orange, and the rest are in light blue.
| Cause | Effect |
|---|---|
| firm disclosure policy (G38) | consumer behavior (D19) |
| firm disclosure policy (G38) | firm profitability (L21) |
| disclosure of vulnerabilities (K24) | higher price (D49) |
| disclosure of vulnerabilities (K24) | larger market (D40) |
| non-disclosure of vulnerabilities (Y40) | larger market (D40) |
| disclosure of vulnerabilities (K24) | likelihood of attacks by hackers (K24) |
| mandatory disclosure (G38) | social optimality (D61) |
| mandatory disclosure (G38) | decrease in equilibrium price (D41) |
| increased likelihood of attacks (Y50) | diminished software value (C88) |