John Mitchell : 2010 Security Workshop

Despite the conventional wisdom that proactive security is superior to reactive security, there are circumstances in which a reactive defensive strategy is effective. Using a game-theoretic model based on certain assumptions, it is possible to show that reactive security can be competitive with proactive security when the reactive defender learns from past attacks. The game-theoretic model used to study this problem assumes that the attacker has complete knowledge of the defender's strategy, but need not act rationally. On the other hand, we must also assume that the defender can reallocate the security budget adaptively, and none of the attacks put the enterprise under attack out of business. It is also interesting that unlike proactive defenses, our best reactive strategy is robust to a lack of information about the attacker's knowledge and incentives.