Dynamics of Shared Security in the Cloud

This paper shows that shared security in the cloud manifests a new public goods paradigm owing to the dynamics of cloud economics and endogeneity between usage, vulnerability, and security. Users must balance the need for security with the risk of becoming locked into a particular cloud services provider (CSP) over time. CSP managers must recognize that security competition is neither a race to the bottom nor an arm’s race. Our results provide guidelines for designing a vulnerability prediction algorithm that emphasizes CSP managers’ understanding of users’ risk and time preferences. In addition, CSP managers should be aware of the nature of security technologies and associated costs, aiming to simplify security architecture and reduce future orchestration expenses. Over the long term, cloud users should consider judiciously repatriating cloud assets as taking refuge in the cloud presents a dynamic fallacy of composition.