How Much and on What?

Abstract

How much should a defender spend on defense and how should it allocate those resources across the sites it is trying to protect? This paper analyzes a model in which a defender first has to decide how much to spend on defense and what to spend it on. The more that a defender devotes to protecting a specific site, the less likely an attack on that site is to succeed and, crucially, the lower the marginal return to investing in attacking that site. After the defender moves, the attacker decides how much effort to devote to attacking each site. Three key conclusions result: First, the questions of how much to spend and what to spend it on are “separable.” However much the defender decides to spend, it should allocate those resources in the same general way. Second, a very simple principle or algorithm determines the optimal allocation. The defender minmaxes the attacker’s marginal gains, i.e., allocates its resources in the way that minimizes the attacker’s maximum marginal gain from exerting additional effort. Third, the defender is in effect a Stackelberg leader. The optimal level of spending takes into account how the defender’s allocation affects the attacker’s effort and generally is that level of spending which equates the marginal benefits of additional spending with the marginal cost of diverting these resources from other social ends.