Upload
stash
View
49
Download
2
Tags:
Embed Size (px)
DESCRIPTION
Estimating the Market for Internet Service Provider-Based Cyber Security Solutions. Brent Rowe – RTI International Doug Reeves – NC State University Dallas Wood – RTI International Fern Braun – RTI International November 4, 2010. Study Motivation. - PowerPoint PPT Presentation
Citation preview
Estimating the Market for Internet Service Provider-Based Cyber Security
SolutionsBrent Rowe – RTI International
Doug Reeves – NC State UniversityDallas Wood – RTI InternationalFern Braun – RTI International
November 4, 2010
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities
Study Motivation
• KEY QUESTION: How can home internet users become more secure?
– Incentive home internet users to spend more time / money on security
– Government regulations / subsidies to increase the security of products and services
• We decided to investigate a case study that would help inform both potential actions
Case Study: ISP-based Cyber Security
• ISPs are in optimal location to identify malicious incoming & outgoing Internet traffic
• ISPs have knowledge and capabilities to react
• As such, ISPs can help reduce the social cost of cyber security activities significantly– Economic theory: Economies of scale
Study Goals
I. Estimate supply of ISP-based cyber security solutions
– What are ISPs doing for their customers’ security? – What aren’t they doing that could help customers’ security?– How much are they charging for security services?
II. Estimate demand for ISP-based cyber security solutions
– What are ISP customers willing to pay for security?– What ISP security service components most impact demand?– What educational / marketing messages can impact demand?
I. ISP Supply Assessment
• Identified 84 plans sold by the Top 22 ISPs– 77% of plans examined were DSL or cable
broadband
• 97% offer some type security service
• 49% of those offering security services charge a fee, the rest include in monthly price
I. ISP Supply Assessment
• Average Price of Plan w/ Security = $52.65
• Average Price of Plan w/o Security = $47.47– NET: Amount ISPs Charging Customers for
“Included” Security Features = $4.18
• Average Price of Security Add-on = $4.34
9
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing
10
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &
remediation (higher cost)
11
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &
remediation (higher cost)
12
Comcast does
I. ISP Supply Assessment
Why aren’t ISPs doing more?
• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough
for security products / services
I. ISP Supply Assessment
Why aren’t ISPs doing more?
• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough
for security products / services
II. Consumer Demand Assessment
Establish Baseline:
• Quantify home internet users’ willingness to pay for ISP-based cyber security solutions
• Quantify home internet users’ willingness to spend time on ISP-based cyber security solutions
II. Consumer Demand Assessment
Assess Impact of Marketing / Educational Messages:
• Evaluate the differences in impact of fear and trust messaging on demand measures
• Identify any impact on behavior based on survey language
II. Consumer Demand Assessment
• Developed survey of home Internet users to determine willingness to pay for security and accept certain tradeoffs
– Utilized stated preference questions to assess demand
• Fielding through ComScore to 2,400 broadband home internet users
– Pilot survey conducted with 365 participants
Conjoint Question: Example
Attributes Treatment A Treatment B
Security fee $2 per month $7 per month
Required time spent on training 1 hours per month 0 hours per month
Option to limit access to subscribers showing signs of malicious or illegal activity
ISP can limit your access to the internet
ISP can never limit your access to the internet
Reduces risk of your computer slowing down or crashing
Not Reduced Greatly Reduced
Reduces risk of your identity being stolen Not Reduced Not Reduced
Reduces risk to other individuals and business from youru insecurity
Not Reduced Not Reduced
Please indicate your preferred option: Prefer
Option APrefer
Option BOpt Out
Pilot Survey Results
• On average, respondents indicated they would be willing to pay (per month)...
– $3.87 to AVOID ever having their internet access restricted
– $3.55 to REDUCE THE RISK of identify theft to them– $2.83 to REDUCE THE RISK of their computer crashing– $1.96 to REDUCE THE RISK of others being impacted– $0.71 to AVOID one hour of training
Implications
• Average cost of $4.25 for current ISP security packages (focus on low cost options like AV)
• Pilot data suggests that consumers are willing to pay over $8 per month to reduce risks to them and others, however…
– They do not want their internet access limited – They do not want to spend time on security
Future Survey Analysis
• 8 Versions of the Survey Fielded– No text added– “Trust” , “Fear” and combined messages added prior
to conjoint questions– Are survey participants willing to pay more when they
know more about threats and actions they can take?
• Analysis of Post-survey Actions– Do survey participants search for security?– Do survey participants install security programs?
Next Steps
• Field survey to full sample of 2,400 individuals through Comscore
• Assess impact of educational / marketing messages
• Determine if any actions are taken post survey
• Compile results into final report to be delivered in late 2010 / early 2011
Additional Information
• If you would like additional information about this study, please contact:
Brent Rowe browe at rti.org