Outsourcing Information Security: Contracting Issues and Security Implications

DSpace/Manakin Repository

Outsourcing Information Security: Contracting Issues and Security Implications

Show full item record

Title: Outsourcing Information Security: Contracting Issues and Security Implications
Author(s):
Cezar, Asunur;
Cavusoglu, Huseyin;
Raghunathan, Srinivasan
Format: text
Item Type: article
Keywords: Show Keywords
Abstract: A unique challenge in information security outsourcing is that neither the outsourcing firm nor the managed security service provider (MSSP) perfectly observes the outcome, the occurrence of a security breach, of prevention effort. Detection of security breaches often requires specialized effort. The current practice is to outsource both prevention and detection to the same MSSP. Some security experts have advocated outsourcing prevention and detection to different MSSPs. We show that the former outsourcing contract leads to a significant disincentive to provide detection effort. The latter contract alleviates this problem but introduces misalignment of incentives between the firm and the MSSPs and eliminates the advantages offered by complementarity between prevention and detection functions, which may lead to a worse outcome than the current contract. We propose a new contract that is superior to these two on various dimensions.
Publisher: INFORMS
ISSN: 0025-1909
Persistent Link: http://dx.doi.org/10.1287/mnsc.2013.1763
http://hdl.handle.net/10735
Terms of Use: ©2014 INFORMS

Files in this item

Files Size Format View
SOM-FR-SRaghunathan-309483.75.pdf 418.5Kb PDF View/Open

This item appears in the following Collection(s)


Show full item record