Three essays on the economics of cybersecurity

Abstract

The rapid growth of digitization has made cybersecurity a critical area for corporations, markets, and governments. The rise in cybersecurity investments and sweeping changes in the regulatory environment raise new economic questions — related to the impacts of cybersecurity investments, innovations, and legislation — that are yet to be answered. Focusing on the limited supply of cybersecurity labor, which has fallen behind the large demand for cybersecurity, Essay 1 studies how cybersecurity labor impacts the value of major infrastructural cyber investments. Moving beyond the ways to leverage cyberinfrastructure and labor, Essay 2 sheds light on the impact of the increasing pressure to pursue development and innovation in the cybersecurity area. This essay examines the bottom-line value of a prevalent type of innovative initiatives, i.e., corporate venture capital (CVC) investment in cybersecurity startups. Essays 1 and 2 heavily focus on the value proposition of cybersecurity investments in corporations. While both essays consider the cybersecurity legislation as exogenous variations instigating further demand for cybersecurity products and innovations, Essay 3 links a widely-adopted cybersecurity law, i.e., security breach notification law (SBNL), to the broader economic demand for general IT services. Compliance costs of cybersecurity legislation raise the barrier for general digitization initiatives, thus decreasing the demand for digitization and negatively impact general IT service providers, the main suppliers of digital goods and services. A difference-in-difference study examines how passages of SBNLs impact the employment of general IT service providers. Overall, the dissertation highlights a) the importance of cybersecurity labor in leveraging cybersecurity infrastructure, b) the business value of innovation in cybersecurity as an area that is predominantly believed to be costly but not value-generating, and c) the broader economic impacts of cybersecurity legislation. In doing so, the dissertation covers a wide range of institutional entities that both shape and are impacted by the cybersecurity ecosystem.