Security and network effects: centralized and decentralized perspectives

Security, like many other complex decisions, is generally approached with a divide-and-conquer mindset. Consequences of security failures, however, can rarely be completely localized: an explosion or a fire at one building can affect neighboring structures, a debt crisis in Greece resonates throughout the tightly connected European and US financial markets, and a breach of security at one computer can facilitate access to others on the same network. It is thus crucial to view security holistically, and devise security strategies that explicitly account for interdependencies between valuable assets. Here we provide an overview of two recent approaches to security with network effects. The first approach takes a centralized perspective, attempting to compute an optimal security configuration for all interdependent assets. This approach explicitly accounts for an intelligent adversary optimally attacking one of the assets. The second approach studies the impact of decentralized decision making when local failures can propagate in complex ways through the entire system, but assumes that initial failures are random.