TY  - JOUR
AB  - Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to authorities. The model assumes that firms (agents) have few incentives to unilaterally report breaches. To enforce the law, regulators (principals) can introduce security audits and sanction noncompliance. However, audits cannot differentiate between concealment and nescience of the agents. Even under optimistic assumptions regarding the effectiveness of mandatory security breach reporting to authorities in reducing individual losses, our model predicts that it may be difficult to adjust the sanction level such that breach notification laws generate social benefit.
AU  - Laube, Stefan
AU  - Böhme, Rainer
DA  - 2016-12-22
DO  - 10.1093/cybsec/tyw002
LA  - eng
N1  - Journal of Cybersecurity 2 (2016) 1, 29-41
N1  - Finanziert durch den Open-Access-Publikationsfonds 2015/2016 der Westfälischen Wilhelms-Universität Münster (WWU Münster).
PY  - 2016-12-22
SN  - 2057-2093
TI  - The economics of mandatory security breach reporting to authorities
UR  - https://nbn-resolving.org/urn:nbn:de:hbz:6-53229502051
Y2  - 2024-11-21T22:29:34
ER  -