Why information security is hard - an economic perspective

By Ross J. Anderson. Seventeenth Annual Computer Security Applications Conference, 2001

952 citations recorded by the source corpus.

Subfields: Information Systems, Strategy and Management

View Paper: https://www.semanticscholar.org/paper/09dec7e45c76750c5387b91b45132fd1b72ae4fa

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Strategy and Management

Citations in the corpus

Secure or insure?: a game-theoretic analysis of information security games (2008, background): “Researchers and industry have responded by developing numerous security technologies to alleviate many of the aforementioned problems [4], thereby expecting to help improving individual security practices.”
The Economic Incentives for Sharing Security Information (2005, background): “Recent papers dealing with the economics of information security and protection of critical infrastructure include Anderson (2001) who discusses various distorted incentives in the information security domain implied by the existence of moral hazard and adverse selection problems. Gordon and Loeb (2”
Sharing Information on Computer Systems Security: An Economic Analysis (2003, background): “The Internet revolution has dramatically changed the way individuals, ﬁ rms, and the government communicate and conduct business.”
Income, interdependence, and substitution effects affecting incentives for security investment (2006, background): “The free-rider dilemma is further analyzed by Anderson (2001) with respect to security investments, Varian (2002) related to system reliability, and Hausken (2002) regarding how agents incur costs in various games to ensure system reliability. Ziv (1993) shows that truth telling may not be an equili”
Is finding security holes a good idea? (2005, background): “In [ 5 ] and [6] Anderson presents a theoretical ar gument using reliability modeling that suggests that a large number of lo wp robability vulnerabilities f avors the attacker rather than the defender because it is easier to find a single bug than to find all of them.”
Nudges for Privacy and Security (2017, background): “This ﬁeld started with the observation that liability for security failures is often dif-fused and that this creates a moral hazard [Varian 2000; Anderson 2001].”
The economic cost of publicly announced information security breaches: empirical evidence from the stock market (2003, neutral): “Recent conceptual/theoretical studies by Anderson [2] and Gordon and Loeb [20] provide insights into the economics of information security, but do not investigate the actual magnitude of losses associated with information security breaches.”
An inquiry into the nature and causes of the wealth of internet miscreants (2007, background): “Anderson discusses why security failures may be attributab le to “perverse economic incentives” in which victims bear the co sts of security failures rather than those who are responsible for the system’s security in the first place [3].”
The Economics of Information Security (2006, methodology): “are building their market position; later, once they have captured a lucrative market, they add excessive security in order to lock their customers in tightly [ 6 ].”
Privacy-preserving smart metering (2011, background): “Most importantly, the black box model might misalign incentives [2]: meters are provided by utilities that have no incentive to invest in high quality privacy for their customers.”