Security Games with Insider Threats

Many cyber-security defense strategies rely on the information asymmetry between the defender and the attacker. Examples of information asymmetry include passwords and network configuration parameters. Using private information, defenders can drastically increase the computation complexity of the attacker and render his/her attacks inefficient. Availability of insider information can alter the equilibrium and favor the attacker. This paper discusses some of the attributes of private information and describes a three-player game with a partially collaborating insider to illustrate its impact.