Anderson, Ross (2001) Why Information Security Is Hard
Varian, Hal (2000) Managing Online Security Risks