Cybersecurity Economics: A Multiparadigmatic Inquiry into Theory and Practice

Abstract

Digital ecosystems are continually confronted with increasing number, sophistication, and complexity of cybersecurity threats and incidents. Cybersecurity researchers have been acutely aware of this challenge for many years, and it led them to look for solutions to bridge the gap between their empirical data and macro-level realities. In the early 2000s, economic models, or in general economics language, were hailed to explain, predict, and manage many cybersecurity problems more clearly and convincingly. Over the past two decades, the close collaboration between cybersecurity economics researchers and economists, sociologists, lawyers, politicians, and psychologists led to tremendous advances towards attaining these goals. This collaboration enabled us to identify, collect, and interpret existing and emerging issues that could impact the cybersecurity posture of agents operating at different levels of open, complex socio-technical systems. However, recent findings indicate that cybersecurity economists still struggle to factor in various issues, such as human and institutional governance and dominance structures, complexity and uncertainty of the digital ecosystems, and the rapidly changing dimensions of cybersecurity issues, to suggest practical and sustainable solutions. These issues have made various challenges in theory and practice of cybersecurity economics that hinder the proposed solutions within this field to be embedded in social norms and institutions that promote secure behavior in digital ecosystems. After identification of these challenges, this research project explores and advocates multi-paradigmatic approaches to tackle the theoretical challenges in cybersecurity economics research. We argue that these approaches provide appealing theoretical and practical frameworks. to understand and interpret known and unknown cybersecurity problems. Regarding the practical challenges, however, this thesis supports the notion of cybersecurity as a public good. Although this notion has been proposed repeatedly by scholars, it has not been substantiated by qualitative and quantitative analysis and studies. Therefore, in this thesis, we take up the challenge of employing a range of paradigms including functionalism, constructivism, and critical realism within one research investigation: cybersecurity as a public good. This thesis outlines a research project in which several studies were conducted to investigate this topic from perspectives of individuals, groups, and institutions. Results were obtained through using theories and methods from multiple paradigms as the basis for research. In seven research papers, details of the studies are given, research findings are presented, and the validity of the methods is discussed. Following transdisciplinary research strategy that supports co-creation of knowledge by participatory inclusion of scientific and societal actors, this research project suggests gamification and policy games to re-integrate knowledge and provide an essential context for understanding some of the most important, complex, and difficult issues both scientific and societal actors face. We proposed a socio-technical framework to design and develop serious games and developed and evaluated an instantiation of this framework. The evaluation results show a promising outlook on how gamification can be effectively used for promoting secure and sustainable behavior in digital ecosystems.