数据资产依赖环境下考虑策略黑客的企业数据安全投资时机决策研究OACHSSCD

With the development of the digital economy,data has become an important production factor for firms.In the face of the increasingly serious data security problem,firms can protect their data assets by judging the current security environment they are in and making reasonable decisions on the amount and timing of data security investments.However,the strategic nature of hackers and the interdependence of data assets make the security environment in which firms live more complex.Based on this,this paper considers the game between firms and strategic hackers in the data asset-interdependent environment,and constructs three game models:simultaneous decision-making,firm-first decision-making,and firm-following decision-making.By comparing and analyzing the optimal decision-making of firms and strategic hackers under the three models,this paper draws the following main conclusions: First,by comparing the three models of simultaneous decision-making,first decision-making and following decision-making,this paper finds that the firm has the largest data security effort when it acts as a leader and the smallest when it acts as a follower;the hacker's attacking efforts when it acts as a leader and a follower are equal and both are smaller than the simultaneous decision-making model;the firm has the highest level of data security when it acts as a leader. Second,although the firm has the highest security level under the first decision,at this time,it has invested comprehensive security efforts to cope with the possible attacks of the hacker and paid a large amount of security effort costs,which is not economically advantageous,and from the perspective of economic sustainability,the enterprise as a follower participates in the decision to get the maximum expected benefits. Finally,through the analysis of firm data asset value,data asset interdependence,and the number of interdependent data systems,this paper finds that:first,in terms of data asset value,firms with high data asset value will invest a large amount of security efforts to protect themselves,and firms with high value of strategic hacking will pay more costs followed by a reduction in benefits.Therefore,when the value of data assets increases,firms should keep investing more to protect their assets.Further research found that firms with higher data asset values are vulnerable to leader hackers,while firms with lower data asset values should take care to prevent follower hackers.Second,in terms of data asset interdependence,data asset interdependence increases the value of a firm's assets while also increasing its data security risk,which affects its expected revenue,so an organization should increase its security investment when it has a high interdependence on data assets.In addition,in an environment with high data asset interdependence,leader hackers are more active in attacking the firm,while in an environment with low data asset interdependence,a large number of follower hackers attack the parts of the firm where the security investment is weak.Third,in terms of the number of interdependent data systems,strategic hackers can gain more by attacking a large number of interdependent systems,so when an organization is in a network with a large number of interdependent data systems,it should increase its security investment to protect data assets.It is further found that when the number of interdependent data systems is high,firms should focus mainly on the attack strategies of leading hackers,while when the number of interdependent data systems is low,firms should prevent attacks on data system vulnerabilities by following hackers.Finally,this paper extends the base model to explore the scenarios with different interdependences of data assets,and finds that the larger the proportion of owning other firms' data assets,the larger the firm's benefit;however,the larger the proportion of other firms' owning their data assets,the smaller the firm's benefit due to the increased security risk. This paper also provides management insights for enterprises' data security decisions:first,firms should act as followers to achieve maximum benefits,i.e.,optimally configure their security strategies after observing hackers' attack decisions;second,the existence of data asset interdependence can,on the one hand,positively affect the value of an firm's data assets,but too much interdependence can also bring challenges to an firm's data security governance,and the system of all firms with interdependent data assets should pay attention to data security governance and jointly prevent data security risks.