Interdependence of Reliability and Security

Paper, 2007, 22 p.This paper studies manufacturer incentives to invest in the improvement of reliability and security of a software system when (i) reliability and security failures are caused by the same errors in the development of the software components and (ii) naive users find it too costly to distinguish between these two classes of system failures. We trace the effects of these informational imperfections and discuss how the resulting supply and demand externalities affect manufacturer investments.
When users cannot distinguish between reliability and security failures and investment in system security is driven by the weakest link, the standard for optimal due care then depends on manufacturer characteristics with respect to both security and reliability. In this case, imposition of a due care standard based solely on reliability or on security becomes socially suboptimal.