Anderson, Ross (2001) Why Information Security is Hard
Varian, Hal (2000) Managing Online Security Risks