estimating the market for internet service provider-based cyber security solutions brent rowe –...
TRANSCRIPT
![Page 1: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/1.jpg)
Estimating the Market for Internet Service Provider-Based Cyber Security
Solutions
Brent Rowe – RTI International
Doug Reeves – NC State University
Dallas Wood – RTI International
Fern Braun – RTI International
November 4, 2010
![Page 2: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/2.jpg)
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
![Page 3: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/3.jpg)
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities
![Page 4: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/4.jpg)
Study Motivation
• Home Internet users are particularly ill-prepared to secure their computers– Economic theory: Incomplete information
• Home Internet users’ insecurity affects all other Internet users– Economic theory: Cost externalities
![Page 5: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/5.jpg)
Study Motivation
• KEY QUESTION: How can home internet users become more secure?
– Incentive home internet users to spend more time / money on security
– Government regulations / subsidies to increase the security of products and services
• We decided to investigate a case study that would help inform both potential actions
![Page 6: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/6.jpg)
Case Study: ISP-based Cyber Security
• ISPs are in optimal location to identify malicious incoming & outgoing Internet traffic
• ISPs have knowledge and capabilities to react
• As such, ISPs can help reduce the social cost of cyber security activities significantly– Economic theory: Economies of scale
![Page 7: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/7.jpg)
Study Goals
I. Estimate supply of ISP-based cyber security solutions
– What are ISPs doing for their customers’ security? – What aren’t they doing that could help customers’ security?– How much are they charging for security services?
II. Estimate demand for ISP-based cyber security solutions
– What are ISP customers willing to pay for security?– What ISP security service components most impact demand?– What educational / marketing messages can impact demand?
![Page 8: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/8.jpg)
I. ISP Supply Assessment
• Identified 84 plans sold by the Top 22 ISPs– 77% of plans examined were DSL or cable
broadband
• 97% offer some type security service
• 49% of those offering security services charge a fee, the rest include in monthly price
![Page 9: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/9.jpg)
I. ISP Supply Assessment
• Average Price of Plan w/ Security = $52.65
• Average Price of Plan w/o Security = $47.47– NET: Amount ISPs Charging Customers for
“Included” Security Features = $4.18
• Average Price of Security Add-on = $4.34
9
![Page 10: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/10.jpg)
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing
10
![Page 11: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/11.jpg)
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &
remediation (higher cost)
11
![Page 12: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/12.jpg)
I. ISP Supply Assessment
Security features offered vary by plan as follows: • 100% of security plans include antivirus and anti-
spyware software• 86% of plans include firewalls• 79% of plans include anti-spam• 73% of plans include anti-phishing• ? % of plans include traffic analysis, filtering &
remediation (higher cost)
12
Comcast does
![Page 13: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/13.jpg)
I. ISP Supply Assessment
Why aren’t ISPs doing more?
• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough
for security products / services
![Page 14: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/14.jpg)
I. ISP Supply Assessment
Why aren’t ISPs doing more?
• Legal implications• Desire not to impede internet activities• Perception that consumers are not willing to pay enough
for security products / services
![Page 15: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/15.jpg)
II. Consumer Demand Assessment
Establish Baseline:
• Quantify home internet users’ willingness to pay for ISP-based cyber security solutions
• Quantify home internet users’ willingness to spend time on ISP-based cyber security solutions
![Page 16: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/16.jpg)
II. Consumer Demand Assessment
Assess Impact of Marketing / Educational Messages:
• Evaluate the differences in impact of fear and trust messaging on demand measures
• Identify any impact on behavior based on survey language
![Page 17: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/17.jpg)
II. Consumer Demand Assessment
• Developed survey of home Internet users to determine willingness to pay for security and accept certain tradeoffs
– Utilized stated preference questions to assess demand
• Fielding through ComScore to 2,400 broadband home internet users
– Pilot survey conducted with 365 participants
![Page 18: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/18.jpg)
Conjoint Question: Example
Attributes Treatment A Treatment B
Security fee $2 per month $7 per month
Required time spent on training
1 hours per month 0 hours per month
Option to limit access to subscribers showing signs of malicious or illegal activity
ISP can limit your access to the internet
ISP can never limit your access to the internet
Reduces risk of your computer slowing down or crashing
Not Reduced Greatly Reduced
Reduces risk of your identity being stolen
Not Reduced Not Reduced
Reduces risk to other individuals and business from youru insecurity
Not Reduced Not Reduced
Please indicate your preferred option: Prefer
Option APrefer
Option BOpt Out
![Page 19: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/19.jpg)
Pilot Survey Results
• On average, respondents indicated they would be willing to pay (per month)...
– $3.87 to AVOID ever having their internet access restricted
– $3.55 to REDUCE THE RISK of identify theft to them– $2.83 to REDUCE THE RISK of their computer crashing– $1.96 to REDUCE THE RISK of others being impacted– $0.71 to AVOID one hour of training
![Page 20: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/20.jpg)
Implications
• Average cost of $4.25 for current ISP security packages (focus on low cost options like AV)
• Pilot data suggests that consumers are willing to pay over $8 per month to reduce risks to them and others, however…
– They do not want their internet access limited – They do not want to spend time on security
![Page 21: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/21.jpg)
Future Survey Analysis
• 8 Versions of the Survey Fielded– No text added– “Trust” , “Fear” and combined messages added prior
to conjoint questions– Are survey participants willing to pay more when they
know more about threats and actions they can take?
• Analysis of Post-survey Actions– Do survey participants search for security?– Do survey participants install security programs?
![Page 22: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/22.jpg)
Next Steps
• Field survey to full sample of 2,400 individuals through Comscore
• Assess impact of educational / marketing messages
• Determine if any actions are taken post survey
• Compile results into final report to be delivered in late 2010 / early 2011
![Page 23: Estimating the Market for Internet Service Provider-Based Cyber Security Solutions Brent Rowe – RTI International Doug Reeves – NC State University Dallas](https://reader036.vdocuments.site/reader036/viewer/2022070323/56649dc75503460f94abc427/html5/thumbnails/23.jpg)
Additional Information
• If you would like additional information about this study, please contact:
Brent Rowe browe at rti.org