Incentivizing Secure Software Development: the Role of Voluntary Audit and Liability Waiver

Abstract

Misaligned incentives in secure software development have long been the focus of research in the economics of security. Product liability, a powerful legal framework in other industries, has been largely ineffective for software products until recent times. However, the rapid regulatory responses to recent global cyber attacks by both the United States and the European Union, together with the (relative) success of the General Data Protection Regulation in defining both duty and standard of care for software vendors, may enable regulators to use liability to re-align incentives for the benefit of the digital society. Specifically, the recent United States National Cybersecurity Strategy suggests shifting responsibility for cyber incidents back to software vendors. In doing so, the strategy also puts forward the concept of the liability waiver: if a software company voluntarily undergoes and passes an IT security audit, its future product liability is (fully or partially) waived. In this paper, we analyze this audit scenario from the perspective of the software vendor and the auditor, respectively. From the vendor's view, this is formulated as a sequential decision problem: a vendor with a product or process needs to pass a mandatory audit to release the product onto the market; it is allowed to go through the audit repeatedly, and thus the vendor needs to determine what level of effort to put into the product following each failed test. We show that the optimal strategy for an opt-in vendor is to never quit and to exert cumulative investments in either a ``one-and-done'' or ``incremental'' manner. From the auditor's view, we examine what type of audit might be the most effective in incentivizing voluntary participation and, at the same time, a more desirable effort from the vendor. We also showed how dynamic audits can be exploited to increase the vendor's incentivizable investment.