Contracting Information Security in the Presence of Double Moral Hazard

Chul Ho Lee
Chul Ho Lee
[email protected]
Management Information Systems, Williams College of Business, Xavier University, Cincinnati, Ohio 45207
Search for more papers by this author
,
Xianjun Geng
Xianjun Geng
[email protected]
Naveen Jindal School of Management, University of Texas at Dallas, Richardson, Texas 75080
Search for more papers by this author
,
Srinivasan Raghunathan
Srinivasan Raghunathan
[email protected]
Naveen Jindal School of Management, University of Texas at Dallas, Richardson, Texas 75080
Search for more papers by this author

Chul Ho Lee

[email protected]

Management Information Systems, Williams College of Business, Xavier University, Cincinnati, Ohio 45207

Search for more papers by this author

Xianjun Geng

[email protected]

Naveen Jindal School of Management, University of Texas at Dallas, Richardson, Texas 75080

Search for more papers by this author

Srinivasan Raghunathan

[email protected]

Naveen Jindal School of Management, University of Texas at Dallas, Richardson, Texas 75080

Search for more papers by this author

Published Online:5 Oct 2012https://doi.org/10.1287/isre.1120.0447

Supplemental Material

isre.1120.0447-sm-ec.pdf (84 KB)

Cited by
- Security and pricing decisions in a competitive market considering overlap effect
  6 May 2026 | Information Technology and Management, Vol. 26
- “Extortionality” in Ransomware Attacks: A Microeconomic Study of Extortion and Externality
  Debabrata Dey,
  Atanu Lahiri
  2 May 2025 | Information Systems Research, Vol. 37, No. 1
- Cyberattacks, Operational Disruption, and Investment in Resilience Measures
  Terrence August,
  Daehoon Noh,
  Noam Shamir,
  Hyoduk Shin
  18 December 2024 | Management Science, Vol. 71, No. 9
- Optimal Design and Selection of Software Outsourcing Contracts in the Presence of Bilateral Moral Hazard
  27 February 2025 | Managerial and Decision Economics, Vol. 46, No. 5
- How to Make My Bug Bounty Cost-Effective? A Game-Theoretical Model
  Leting Zhang,
  Emre M. Demirezen,
  Subodha Kumar
  3 September 2024 | Information Systems Research, Vol. 36, No. 2
- Regulating Information and Network Security: Review and Challenges
  24 January 2025 | ACM Computing Surveys, Vol. 57, No. 5
- Information security outsourcing strategies in the supply chain considering security externality
  1 July 2024 | Journal of the Operational Research Society, Vol. 76, No. 3
- Decision Making in Information Security Investments: Impact of System Vulnerability and Investment Timing on Resource-Sharing Platforms
  Hui Zhao; ,
  Yong Wu,
  Zhijie Jin
  26 November 2024 | Decision Analysis, Vol. 22, No. 1
- Building cybersecurity resilience: integrating defense and recovery investment strategies in an expected resilience framework
  23 October 2024 | Journal of Enterprise Information Management, Vol. 38, No. 2
- Multi-Stage Game-Theoretical Decision Analysis of Enterprise Information Security Outsourcing Based on Moral Hazard
  1 January 2025 | Journal of Cyber Security, Vol. 7, No. 1
- Cybersecurity investment considering risk prevention and mitigation measures: A security insurance perspective
  Journal of Industrial and Management Optimization, Vol. 21, No. <![CDATA[6]]>
- Information security decisions of security‐interdependent firms in the presence of consumer sensitivity
  3 August 2024 | Managerial and Decision Economics, Vol. 45, No. 8
- Cybersecurity investments in supply chains with two-stage risk propagation
  Computers & Industrial Engineering, Vol. 197
- Does Sharing Make My Data More Insecure? An Empirical Study on Health Information Exchange and Data Breaches
  1 September 2024 | MIS Quarterly, Vol. 48, No. 3
- Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions
  31 July 2024 | ACM SIGMIS Database: the DATABASE for Advances in Information Systems, Vol. 55, No. 3
- Managing cloud security in the presence of strategic hacker and joint responsibility
  26 August 2023 | Journal of the Operational Research Society, Vol. 75, No. 7
- Managing partial outsourcing on information security in the presence of security externality
  Expert Systems with Applications, Vol. 246
- Information security outsourcing in a resource-sharing environment: The impacts of attack modes
  14 July 2023 | Journal of the Operational Research Society, Vol. 75, No. 6
- Cyber Insurance and Post-Breach Services: A Normative Analysis
  Wendy Hui,
  Kai-Lung Hui,
  Wei T. Yue
  19 March 2024 | Service Science, Vol. 16, No. 2
- Platform channel strategy of selling format: Effect of asymmetric service information
  Transportation Research Part E: Logistics and Transportation Review, Vol. 185
- Who should own the data? The impact of data value creation on data ownership
  Computers & Industrial Engineering, Vol. 190
- Financial Sustainability of IoT Platforms: The Role of Quality and Security
  14 May 2024 | Production and Operations Management, Vol. 33, No. 2
- Research on Information Security Decision of Complementary Firms Considering Security Standard
  Management Science and Engineering, Vol. 13, No. 01
- Analysis and Research on the Decision Process of Enterprise Information Security Outsourcing
  E-Commerce Letters, Vol. 13, No. 04
- How to Make My Bug Bounty Cost-effective? A Game-theoretical Model
  1 January 2024 | SSRN Electronic Journal, Vol. 65
- A competitive analysis of software quality investment with technology diversification and security concern
  13 April 2022 | Electronic Commerce Research, Vol. 23, No. 4
- Investigating the role of internal security resources in post-adoption satisfaction with the Security-as-a-Service model: an organizational mindfulness perspective
  22 September 2023 | Journal of Enterprise Information Management, Vol. 36, No. 6
- Time-and-materials or revenue-sharing? Implications of monitoring for software outsourcing contract
  Information & Management, Vol. 60, No. 3
- Security defense against long-term and stealthy cyberattacks
  Decision Support Systems, Vol. 166
- Contracting and timing for outsourcing of information system with uncertain requirements
  17 May 2022 | Neural Computing and Applications, Vol. 35, No. 3
- Managing Partial Outsourcing on Information Security under Security Standard Constraint—Based on Asymmetric Externality
  Management Science and Engineering, Vol. 12, No. 01
- Cyber Insurance and Post-breach Services: A Normative Analysis
  1 January 2023 | SSRN Electronic Journal, Vol. 53
- Linking Cybersecurity and Accounting: An Event, Impact, Response Framework
  1 November 2021 | Accounting Horizons, Vol. 36, No. 4
- An economic analysis of information security outsourcing with competitive firms
  8 February 2022 | Managerial and Decision Economics, Vol. 43, No. 7
- Agency problems in solution selling: How customer perceptions of opportunism and customer characteristics impede their acceptance of outcome-based pricing
  Industrial Marketing Management, Vol. 106
- Auctioning IT Contracts with Renegotiable Scope
  He Huang,
  Zhipeng Li,
  De Liu,
  Hongyan Xu
  5 November 2021 | Management Science, Vol. 68, No. 8
- Information Security Strategies for Information-Sharing Firms Considering a Strategic Hacker
  Yong Wu,
  Mengyao Xu,
  Dong Cheng,
  Tao Dai
  23 March 2022 | Decision Analysis, Vol. 19, No. 2
- A game-theoretical model of firm security reactions responding to a strategic hacker in a competitive industry
  4 February 2021 | Journal of the Operational Research Society, Vol. 73, No. 4
- Contracting managed security service: Double moral hazard and risk interdependency
  Electronic Commerce Research and Applications, Vol. 50
- Information security decisions of firms considering security risk interdependency
  Expert Systems with Applications, Vol. 178
- Outsourcing Strategies for Information Security: Correlated Losses and Security Externalities
  20 April 2020 | Information Systems Frontiers, Vol. 23, No. 3
- Designing Payment Contracts for Healthcare Services to Induce Information Sharing: The Adoption and the Value of Health Information Exchanges (HIEs)
  1 June 2021 | MIS Quarterly, Vol. 45, No. 2
- Cybersecurity investments in a two-echelon supply chain with third-party risk propagation
  6 February 2020 | International Journal of Production Research, Vol. 59, No. 4
- Cloud Service Model’s Role in Provider and User Security Investment Incentives
  1 February 2021 | Production and Operations Management, Vol. 30, No. 2
- Managing Security Outsourcing in the Presence of Strategic Hackers
  Yong Wu,
  Junlin Duan,
  Tao Dai,
  Dong Cheng
  18 March 2020 | Decision Analysis, Vol. 17, No. 3
- To outsource or not: The impact of information leakage risk on information security strategy
  Information & Management, Vol. 57, No. 5
- Investigating the Security Divide between SME and Large Companies: How SME Characteristics Influence Organizational IT Security Investments
  9 November 2019 | Information Systems Frontiers, Vol. 21, No. 6
- Ethics, Bounded Rationality, and IP Sharing in IT Outsourcing
  Krishnan S. Anand,
  Manu Goyal
  24 May 2019 | Management Science, Vol. 65, No. 11
- Monetization on Mobile Platforms: Balancing in‐App Advertising and User Base Growth
  1 September 2019 | Production and Operations Management, Vol. 28, No. 9
- Bilateral Liability-Based Contracts in Information Security Outsourcing
  Kai-Lung Hui,
  Ping Fan Ke,
  Yuxi Yao,
  Wei T. Yue
  23 May 2019 | Information Systems Research, Vol. 30, No. 2
- Effect of security investment strategy on the business value of managed security service providers
  Electronic Commerce Research and Applications, Vol. 35
- Enabling Collaborative Response to IT Service Disruptions Under Risk Aversion
  SSRN Electronic Journal, Vol. 51
- Comparison of information security decisions under different security and business environments
  18 January 2018 | Journal of the Operational Research Society, Vol. 69, No. 5
- Proactivity and Retroactivity of Firms and Information Sharing of Hackers
  25 March 2018 | International Game Theory Review, Vol. 20, No. 01
- Decisions making in information security outsourcing: Impact of complementary and substitutable firms
  Computers & Industrial Engineering, Vol. 110
- Information Sharing Among Cyber Hackers in Successive Attacks
  2 May 2017 | International Game Theory Review, Vol. 19, No. 02
- Security Investment, Hacking, and Information Sharing between Firms and between Hackers
  25 May 2017 | Games, Vol. 8, No. 2
- Payment Mechanisms, Incentives for Adoption And Value of Health-Information Exchanges (HIEs)
  SSRN Electronic Journal, Vol. 29
- Managing Co-Creation in Information Technology Projects: A Differential Games Approach
  Emre M. Demirezen,
  Subodha Kumar,
  Bala Shetty
  15 July 2016 | Information Systems Research, Vol. 27, No. 3
- A differential game approach to security investment and information sharing in a competitive environment
  13 January 2016 | IIE Transactions, Vol. 48, No. 6
- Game of information security investment: Impact of attack types and network vulnerability
  Expert Systems with Applications, Vol. 42, No. 15-16
- Cloud Implications on Software Network Structure and Security Risks
  Terrence August,
  Marius Florin Niculescu,
  Hyoduk Shin
  21 July 2014 | Information Systems Research, Vol. 25, No. 3
- Optimal information security investment in a Healthcare Information Exchange: An economic analysis
  Decision Support Systems, Vol. 61
- Joint Product Improvement by Client and Customer Support Center: The Role of Gain-Share Contracts in Coordination
  Shantanu Bhattacharya,
  Alok Gupta,
  Sameer Hasija
  27 November 2013 | Information Systems Research, Vol. 25, No. 1
- Managing Interdependent Information Security Risks: Cyberinsurance, Managed Security Services, and Risk Pooling Arrangements
  8 December 2014 | Journal of Management Information Systems, Vol. 30, No. 1

cover image Information Systems Research

Volume 24, Issue 2

June 2013

Pages 201-497

Article Information

Supplemental Material

Metrics

Information

Received:November 15, 2010
Published Online:October 05, 2012

Cite as

Chul Ho Lee, Xianjun Geng, Srinivasan Raghunathan, (2012) Contracting Information Security in the Presence of Double Moral Hazard. Information Systems Research 24(2):295-311.

https://doi.org/10.1287/isre.1120.0447

Keywords

PDF download

Available Issues

Available Issues

Available Issues

Available Issues

Available Issues

Contracting Information Security in the Presence of Double Moral Hazard

Supplemental Material

Volume 24, Issue 2

Article Information

Supplemental Material

Metrics

Information

Cite as

Keywords

Sign Up for INFORMS Publications Updates and News