Estimating the Market for Internet Service Provider-Based Cyber Security

Solutions

Brent Rowe – RTI International

Doug Reeves – NC State University

Dallas Wood – RTI International

Fern Braun – RTI International

November 4, 2010

Study Motivation

• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information

Study Motivation

• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information

• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities

Study Motivation

• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information

• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities

Study Motivation

• KEY QUESTION: How can home internet users become more secure?

– Incentive home internet users to spend more time / money on security

– Government regulations / subsidies to increase the security of products and services

• We decided to investigate a case study that would help inform both potential actions

Case Study: ISP-based Cyber Security

• ISPs are in optimal location to identify malicious incoming & outgoing Internet traffic

• ISPs have knowledge and capabilities to react

• As such, ISPs can help reduce the social cost of cyber security activities significantly– Economic theory: Economies of scale

Study Goals

I. Estimate supply of ISP-based cyber security solutions

– What are ISPs doing for their customers’ security? – What aren’t they doing that could help customers’ security?– How much are they charging for security services?

II. Estimate demand for ISP-based cyber security solutions

– What are ISP customers willing to pay for security?– What ISP security service components most impact demand?– What educational / marketing messages can impact demand?

I. ISP Supply Assessment

• Identified 84 plans sold by the Top 22 ISPs– 77% of plans examined were DSL or cable

broadband

• 97% offer some type security service

• 49% of those offering security services charge a fee, the rest include in monthly price

I. ISP Supply Assessment

• Average Price of Plan w/ Security = $52.65

• Average Price of Plan w/o Security = $47.47– NET: Amount ISPs Charging Customers for

“Included” Security Features = $4.18

• Average Price of Security Add-on = $4.34

9

I. ISP Supply Assessment

Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-

spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing

10

I. ISP Supply Assessment

Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-

spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &

remediation (higher cost)

11

I. ISP Supply Assessment

Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-

spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &

remediation (higher cost)

12

Comcast does

I. ISP Supply Assessment

Why aren’t ISPs doing more?

• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough

for security products / services

I. ISP Supply Assessment

Why aren’t ISPs doing more?

• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough

for security products / services

II. Consumer Demand Assessment

Establish Baseline:

• Quantify home internet users’ willingness to pay for ISP-based cyber security solutions

• Quantify home internet users’ willingness to spend time on ISP-based cyber security solutions

II. Consumer Demand Assessment

Assess Impact of Marketing / Educational Messages:

• Evaluate the differences in impact of fear and trust messaging on demand measures

• Identify any impact on behavior based on survey language

II. Consumer Demand Assessment

• Developed survey of home Internet users to determine willingness to pay for security and accept certain tradeoffs

– Utilized stated preference questions to assess demand

• Fielding through ComScore to 2,400 broadband home internet users

– Pilot survey conducted with 365 participants

Conjoint Question: Example

Attributes Treatment A Treatment B

Security fee $2 per month $7 per month

Required time spent on training

1 hours per month 0 hours per month

Option to limit access to subscribers showing signs of malicious or illegal activity

ISP can limit your access to the internet

ISP can never limit your access to the internet

Reduces risk of your computer slowing down or crashing

Not Reduced Greatly Reduced

Reduces risk of your identity being stolen

Not Reduced Not Reduced

Reduces risk to other individuals and business from youru insecurity

Not Reduced Not Reduced

Please indicate your preferred option: Prefer

Option APrefer

Option BOpt Out

Pilot Survey Results

• On average, respondents indicated they would be willing to pay (per month)...

– $3.87 to AVOID ever having their internet access restricted

– $3.55 to REDUCE THE RISK of identify theft to them– $2.83 to REDUCE THE RISK of their computer crashing– $1.96 to REDUCE THE RISK of others being impacted– $0.71 to AVOID one hour of training

Implications

• Average cost of $4.25 for current ISP security packages (focus on low cost options like AV)

• Pilot data suggests that consumers are willing to pay over $8 per month to reduce risks to them and others, however…

– They do not want their internet access limited – They do not want to spend time on security

Future Survey Analysis

• 8 Versions of the Survey Fielded– No text added– “Trust” , “Fear” and combined messages added prior

to conjoint questions– Are survey participants willing to pay more when they

know more about threats and actions they can take?

• Analysis of Post-survey Actions– Do survey participants search for security?– Do survey participants install security programs?

Next Steps

• Field survey to full sample of 2,400 individuals through Comscore

• Assess impact of educational / marketing messages

• Determine if any actions are taken post survey

• Compile results into final report to be delivered in late 2010 / early 2011

Additional Information

• If you would like additional information about this study, please contact:

Brent Rowe browe at rti.org