Johnson, Eric M. (2008) Managing Information Risk and the Economics of Security
Schneier, Bruce (2003) Beyond Fear