The Economics of Information Security - Revision history

WikiSysop: /* Additional Notes and Highlights */

2010-08-19T19:53:43Z

Additional Notes and Highlights

← Older revision		Revision as of 19:53, 19 August 2010
Line 47:		Line 47:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
	Expertise Required: Economics-Low		Expertise Required: Economics - Low

WikiSysop: /* Additional Notes and Highlights */

2010-08-10T16:03:48Z

Additional Notes and Highlights

← Older revision		Revision as of 16:03, 10 August 2010
Line 47:		Line 47:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			Expertise Required: Economics-Low

WikiSysop: /* Categorization */

2010-07-16T15:09:33Z

Categorization

← Older revision		Revision as of 15:09, 16 July 2010
Line 12:		Line 12:
	==Categorization==		==Categorization==

	* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Insurance]]; [[Metrics]]; [[Privacy]]; [[Risk Management and Investment~~]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)~~]]		* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Insurance]]; [[Metrics]]; [[Privacy]]; [[Risk Management and Investment]]

	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]; [[Technology]]

	==Key Words==		==Key Words==

WikiSysop: /* Synopsis */

2010-07-01T19:21:04Z

Synopsis

← Older revision		Revision as of 19:21, 1 July 2010
Line 40:		Line 40:
	The paper charts standard occurrences and outcomes for system security and reliability, and matches these up with game theory and microeconomic theory, to determine and rationalize security failings. Consider this scenario:		The paper charts standard occurrences and outcomes for system security and reliability, and matches these up with game theory and microeconomic theory, to determine and rationalize security failings. Consider this scenario:

	*Consider a medieval city. If the main threat is a siege, and each family is responsible for maintaining and guarding one stretch of the wall, then the city’s security will depend on the efforts of the laziest and most cowardly family. If, however, disputes are settled by single combat between champions, then its security depends on the strength and courage of its most valiant knight. But if wars are a matter of attrition, then it is the sum of all the citizens’ efforts that matters. System reliability is no different; it can depend on the sum of individual efforts, the minimum effort anyone makes, or the maximum effort anyone makes. Program correctness can depend on minimum effort (the most careless programmer introducing a vulnerability), whereas software validation and vulnerability testing might depend on the sum of everyone’s efforts.		* Consider a medieval city. If the main threat is a siege, and each family is responsible for maintaining and guarding one stretch of the wall, then the city’s security will depend on the efforts of the laziest and most cowardly family. If, however, disputes are settled by single combat between champions, then its security depends on the strength and courage of its most valiant knight. But if wars are a matter of attrition, then it is the sum of all the citizens’ efforts that matters. System reliability is no different; it can depend on the sum of individual efforts, the minimum effort anyone makes, or the maximum effort anyone makes. Program correctness can depend on minimum effort (the most careless programmer introducing a vulnerability), whereas software validation and vulnerability testing might depend on the sum of everyone’s efforts.

	What are the consequences?		What are the consequences?

	*In the minimum-effort case, the agent with the lowest benefit-cost ratio dominates. As more agents are added, systems become increasingly reliable in the total-effort case but increasingly unreliable in the weakest-link case. What are the implications? One is that software companies should hire more software testers and fewer (but more competent) programmers.		* In the minimum-effort case, the agent with the lowest benefit-cost ratio dominates. As more agents are added, systems become increasingly reliable in the total-effort case but increasingly unreliable in the weakest-link case. What are the implications? One is that software companies should hire more software testers and fewer (but more competent) programmers.

	==Additional Notes and Highlights==		==Additional Notes and Highlights==

WikiSysop: /* Key Words */

2010-07-01T19:19:30Z

Key Words

← Older revision		Revision as of 19:19, 1 July 2010
Line 17:		Line 17:

	==Key Words==		==Key Words==
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Computer_Network_Attack \| Computer Network Attack]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cyber Security as an Externality]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cyber Security as an Externality]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]],

WikiSysop: /* Categorization */

2010-07-01T19:17:55Z

Categorization

← Older revision		Revision as of 19:17, 1 July 2010
Line 12:		Line 12:
	==Categorization==		==Categorization==

	* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Metrics]]; [[Privacy]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]		* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Insurance]]; [[Metrics]]; [[Privacy]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]

	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]

WikiSysop: /* Categorization */

2010-07-01T19:16:26Z

Categorization

← Older revision		Revision as of 19:16, 1 July 2010
Line 12:		Line 12:
	==Categorization==		==Categorization==

	* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Metrics]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]		* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Metrics]]; [[Privacy]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]

	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]

WikiSysop: /* Key Words */

2010-07-01T19:15:25Z

Key Words

← Older revision		Revision as of 19:15, 1 July 2010
Line 18:		Line 18:
	==Key Words==		==Key Words==
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cyber Security as an Externality]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cyber Security as an Externality]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]],
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Interdependencies \| Interdependencies]]

	==Synopsis==		==Synopsis==

WikiSysop: /* Key Words */

2010-07-01T19:13:02Z

Key Words

← Older revision		Revision as of 19:13, 1 July 2010
Line 17:		Line 17:

	==Key Words==		==Key Words==
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality \| Cyber Security as an Externality]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries\| Information Asymmetries]]

WikiSysop: /* Categorization */

2010-07-01T19:10:50Z

Categorization

← Older revision		Revision as of 19:10, 1 July 2010
Line 12:		Line 12:
	==Categorization==		==Categorization==

	* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]		* Issues: [[Economics of Cybersecurity]]; [[Incentives]]; [[Information Sharing/Disclosure]]; [[Metrics]]; [[Risk Management and Investment]]; [[Security Components of Classic Cyberissues \| Security Components of Classic Cyberissues (e.g. IP)]]

	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]