Economics of Malware - Revision history

WikiSysop: /* Additional Notes and Highlights */

2010-08-20T16:58:22Z

Additional Notes and Highlights

← Older revision		Revision as of 16:58, 20 August 2010
Line 104:		Line 104:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			Expertise Required: Economics - Moderate

WikiSysop: /* Categorization */

2010-08-20T16:56:42Z

Categorization

← Older revision		Revision as of 16:56, 20 August 2010
Line 9:		Line 9:

	==Categorization==		==Categorization==
	* Resource by Type: [[Non-~~U.S.~~ Government Reports and Documents]]		* Resource by Type: [[Non-US Government Reports and Documents]]
	* Issues: [[Economics of Cybersecurity]]; [[Risk Management and Investment]]; [[Incentives]]		* Issues: [[Economics of Cybersecurity]]; [[Risk Management and Investment]]; [[Incentives]]

WikiSysop: /* Categorization */

2010-08-20T16:56:19Z

Categorization

← Older revision		Revision as of 16:56, 20 August 2010
Line 9:		Line 9:

	==Categorization==		==Categorization==
			* Resource by Type: [[Non-U.S. Government Reports and Documents]]
	* Issues: [[Economics of Cybersecurity]]; [[Risk Management and Investment]]; [[Incentives]]		* Issues: [[Economics of Cybersecurity]]; [[Risk Management and Investment]]; [[Incentives]]

Jacob: /* Additional Notes and Highlights */

2010-06-25T21:06:11Z

Additional Notes and Highlights

← Older revision		Revision as of 21:06, 25 June 2010
Line 104:		Line 104:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==

	~~'' * Outline key points of interest~~

Jacob: /* Synopsis */

2010-06-25T21:05:53Z

Synopsis

← Older revision		Revision as of 21:05, 25 June 2010
Line 61:		Line 61:
	commerce companies (with a focus on financial service providers), software vendors, registrars and end		commerce companies (with a focus on financial service providers), software vendors, registrars and end
	users.		users.

	~~The results indicate a number of market-based incentive mechanisms that contribute to enhanced~~
	~~security but also other instances in which decentralized actions may lead to sub-optimal outcomes – i.e.~~
	~~where significant externalities emerge. A pressing question is whether the response to malware of actors in~~
	~~information and communication markets is adequate or whether improvements are possible. Pointing to a~~
	~~variety of reports that show increases in malicious attack trends, one might conclude that markets are not~~
	~~responding adequately. Our analysis revealed a more nuanced picture.~~

	Across the value net of the different market players, three relevant situations emerge:		Across the value net of the different market players, three relevant situations emerge:
Line 98:		Line 91:
	illegal activity or crime associated with malware, the costs of restitution of crime victims, the costs of e-		illegal activity or crime associated with malware, the costs of restitution of crime victims, the costs of e-
	commerce companies buying security services to fight off botnet attacks, the cost of law enforcement		commerce companies buying security services to fight off botnet attacks, the cost of law enforcement
	associated with these activities, and so forth~~. Furthermore, they may take on the more indirect form of slower growth of e-commerce and other activities. Slower growth may entail a significant opportunity cost~~		associated with these activities, and so forth.
	~~for society at large if the delayed activities would have contributed to economic efficiency gains and~~
	~~accelerated growth. A comprehensive assessment of these additional costs will demand a concerted effort~~
	~~but will be necessary to determine the optimal level of action to fight malware~~.

	Although the research reported in this report was not designed to develop specific policy		Although the research reported in this report was not designed to develop specific policy

Jacob: /* Synopsis */

2010-06-25T21:05:02Z

Synopsis

Jacob: /* Synopsis */

2010-06-25T21:04:23Z

Synopsis

@@ Line 23: / Line 23: @@
 ==Synopsis==
-''This could be an abstract from the article.''
+Malicious software, or malware for short, has become a critical security threat to all who rely on
 ==Additional Notes and Highlights==
 '' * Outline key points of interest

Jacob: /* Full Citation */

2010-06-25T21:00:52Z

Full Citation

← Older revision		Revision as of 21:00, 25 June 2010
Line 6:		Line 6:
	Michel J. G. van Eeten and Johannes M. Bauer, Economics of Malware: Security Decisions, Incentives and Externalities, (2008). Report for the Organization of Co-operation and Development (OECD). [http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Web'']		Michel J. G. van Eeten and Johannes M. Bauer, Economics of Malware: Security Decisions, Incentives and Externalities, (2008). Report for the Organization of Co-operation and Development (OECD). [http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Web'']

	[http://cyber.law.harvard.edu/cybersecurity/?title=Special~~:Bibliography~~&view=detailed&~~startkey~~=~~vanEeten_Bauer:2008~~&f=~~wikibiblio.bib~~ ''BibTeX'']		[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special%3ABibliography&view=detailed&action=&keyword=vanEeten_Bauer%3A2008 ''BibTeX'']

	==Categorization==		==Categorization==

Jacob: /* Full Citation */

2010-06-25T20:56:02Z

Full Citation

← Older revision		Revision as of 20:56, 25 June 2010
Line 4:		Line 4:
	==Full Citation==		==Full Citation==

	Michel J. G. van Eeten and Johannes M. Bauer, Economics of Malware: Security Decisions, Incentives and Externalities. Report for the Organization of Co-operation and Development (OECD~~) (2008~~). [http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Web'']		Michel J. G. van Eeten and Johannes M. Bauer, Economics of Malware: Security Decisions, Incentives and Externalities, (2008). Report for the Organization of Co-operation and Development (OECD). [http://www.oecd.org/dataoecd/53/17/40722462.pdf ''Web'']

	[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&view=detailed&startkey=vanEeten_Bauer:2008&f=wikibiblio.bib ''BibTeX'']		[http://cyber.law.harvard.edu/cybersecurity/?title=Special:Bibliography&view=detailed&startkey=vanEeten_Bauer:2008&f=wikibiblio.bib ''BibTeX'']

Jacob: /* Key Words */

2010-06-25T20:47:23Z

Key Words

← Older revision		Revision as of 20:47, 25 June 2010
Line 15:		Line 15:

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Crimeware\| Crimeware]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Crimeware\| Crimeware]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cybersecurity as an Externality		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cybersecurity as an Externality]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Interdependencies \| Interdependencies]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Interdependencies \| Interdependencies]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Internet_Service_Providers \| Internet Services Providers]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Internet_Service_Providers \| Internet Services Providers]],

← Older revision		Revision as of 20:47, 25 June 2010
Line 15:		Line 15:

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Crimeware\| Crimeware]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Crimeware\| Crimeware]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cybersecurity as an Externality		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cybersecurity as an Externality]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Interdependencies \| Interdependencies]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Interdependencies \| Interdependencies]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Internet_Service_Providers \| Internet Services Providers]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Internet_Service_Providers \| Internet Services Providers]],

← Older revision		Revision as of 21:05, 25 June 2010
Line 35:		Line 35:
	uses of malware and botnets. This report, however, focuses primarily on malware as an economic threat.		uses of malware and botnets. This report, however, focuses primarily on malware as an economic threat.

	While originating in criminal behaviour, the magnitude and impact of the malware threat is also		While originating in criminal behaviour, the magnitude and impact of the malware threat is also
	influenced by the decisions and behaviour of legitimate market players such as Internet Service Providers		influenced by the decisions and behaviour of legitimate market players such as Internet Service Providers
	(ISPs), software vendors, e-commerce companies, hardware manufacturers, registrars and, last but not		(ISPs), software vendors, e-commerce companies, hardware manufacturers, registrars and, last but not
Line 42:		Line 42:
	words, they operate under different incentives.		words, they operate under different incentives.

	As security comes at a cost, tolerating some level of insecurity is economically rational. From an		As security comes at a cost, tolerating some level of insecurity is economically rational. From an
	economic perspective, the key question is whether the costs and benefits perceived by market players are		economic perspective, the key question is whether the costs and benefits perceived by market players are
	aligned with social costs and benefits of an activity. In certain situations, the security decisions of a market		aligned with social costs and benefits of an activity. In certain situations, the security decisions of a market
Line 54:		Line 54:
	outside the scope of this report.		outside the scope of this report.

	We set out to identify externalities by analysing the incentives under which a variety of market		We set out to identify externalities by analysing the incentives under which a variety of market
	players operate when dealing with malware. The core of the report is made up of a detailed discussion of		players operate when dealing with malware. The core of the report is made up of a detailed discussion of
	the outcomes of a qualitative empirical field study. In the course of 2007, we conducted 41 in-depth		the outcomes of a qualitative empirical field study. In the course of 2007, we conducted 41 in-depth
Line 62:		Line 62:
	users.		users.

	The results indicate a number of market-based incentive mechanisms that contribute to enhanced		The results indicate a number of market-based incentive mechanisms that contribute to enhanced
	security but also other instances in which decentralized actions may lead to sub-optimal outcomes – i.e.		security but also other instances in which decentralized actions may lead to sub-optimal outcomes – i.e.
	where significant externalities emerge. A pressing question is whether the response to malware of actors in		where significant externalities emerge. A pressing question is whether the response to malware of actors in
Line 69:		Line 69:
	responding adequately. Our analysis revealed a more nuanced picture.		responding adequately. Our analysis revealed a more nuanced picture.

	Across the value net of the different market players, three relevant situations emerge:		Across the value net of the different market players, three relevant situations emerge:
	i) No externalities. This concerns instances in which a market player, be it an individual user or
			i) No externalities. This concerns instances in which a market player, be it an individual user or
	an organisation, correctly assesses security risks, bears all the costs of protecting against security threats		an organisation, correctly assesses security risks, bears all the costs of protecting against security threats
	(including those associated with these risks) and adopts appropriate counter measures. Private and social		(including those associated with these risks) and adopts appropriate counter measures. Private and social
Line 77:		Line 78:
	efficient but, due to the high degree of interdependency in the Internet, it is relatively rare.		efficient but, due to the high degree of interdependency in the Internet, it is relatively rare.

	ii) Externalities that are borne by agents in the value net that can manage them. This concerns		ii) Externalities that are borne by agents in the value net that can manage them. This concerns
	instances in which a market player assesses the security risks based on the available information but, due to		instances in which a market player assesses the security risks based on the available information but, due to
	the existence of (positive or negative) externalities, the resulting decision deviates from the social		the existence of (positive or negative) externalities, the resulting decision deviates from the social
Line 88:		Line 89:
	examples were found that confirm externalities were being internalised by other market players.		examples were found that confirm externalities were being internalised by other market players.

	iii) Externalities that are borne by agents who cannot manage them or by society at large. An		iii) Externalities that are borne by agents who cannot manage them or by society at large. An
	individual unit may correctly assess the security risks given its perceived incentives but, due to the		individual unit may correctly assess the security risks given its perceived incentives but, due to the
	existence of externalities, this decision deviates from the social optimum. Alternatively, an individual unit		existence of externalities, this decision deviates from the social optimum. Alternatively, an individual unit
Line 102:		Line 103:
	but will be necessary to determine the optimal level of action to fight malware.		but will be necessary to determine the optimal level of action to fight malware.

	Although the research reported in this report was not designed to develop specific policy		Although the research reported in this report was not designed to develop specific policy
	recommendations, some general concluding remarks are offered. We found many feedback loops which		recommendations, some general concluding remarks are offered. We found many feedback loops which
	mitigate the externalities arising from security-reducing behaviour. All market players we studied		mitigate the externalities arising from security-reducing behaviour. All market players we studied