Software Diversity for Information Security

In this paper we analyze a software diversification-based strategy to achieve information security. The notion of using diversity to limit correlated risks is a widely accepted strategy in many fields. Various risk management approaches strive to minimize the variance of losses faced by individuals by either risk pooling, as in insurance, or diversification, as in portfolio management. However, these approaches are advantageous only for risk-averse agents as the expected loss remains unchanged. Exploiting externalities unique to information systems, we show that diversification can not only reduce loss variance but also minimize expected loss. We formulate the optimal amount of diversity investment by a firm taking into account both the negative network externalities accruing from attacks as well as positive network effects that accrue from uniformity and interoperability.