Information security: Where computer science, economics and psychology meet

Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences

Volumn 367, Issue 1898, 2009, Pages 2717-2727

  Anderson, Ross ^a   Moore, Tyler ^b  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

^b HARVARD UNIVERSITY   (United States)

Author keywords

Economics; Incentives; Information security; Psychology

Indexed keywords

COMPUTER SCIENCE; CRYPTOGRAPHY; MACHINE DESIGN; NETWORK PROTOCOLS; RESEARCH; USABILITY ENGINEERING;

DISTRIBUTED SYSTEMS; FRAUDSTERS; INCENTIVES; INFORMATION SECURITY; MULTI-DISCIPLINARY RESEARCH; PHISHING; PSYCHOLOGY; RESEARCH PROGRAMME; SYSTEM DEPENDABILITY; TECHNICAL DESIGN;

NETWORK SECURITY;

COMPUTER PROGRAM; COMPUTER SECURITY; HUMAN;

COMPUTER SECURITY; HUMANS; SOFTWARE;

EID: 67650283950     PISSN: 1364503X     EISSN: None     Source Type: Journal    
DOI: 10.1098/rsta.2009.0027     Document Type: Article

References (40)

1. Acquisti, A. & Grossklags, J. 2004 Privacy and rationality: preliminary evidence from pilot data. In Proc. Third Workshop on the Economics of Information Security, Minneapolis, MN, 13-14 May 2004.
2. Akerlof, G. A. 1970 The market for 'lemons': quality uncertainty and the market mechanism. Q. J. Econ. 84, 488-500. (doi:10.2307/1879431)
3. Albert, R., Jeong, H. & Barabási, A.-L. 2000 Error and attack tolerance of complex networks. Nature 406, 378-382. (doi:10.1038/ 35019019) (Pubitemid 30625551)
4. Anderson, R. J. 1994 Why cryptosystems fail. Commun. ACM 37, 32-40. (doi:10.1145/188280. 188291)
5. Anderson, R. J. 2001 Why information security is hard-an economic perspective. In Proc. Seventeenth Annual Computer Security Applications Conf., New Orleans, LA, 11-14 December, 2001, pp. 358-365.
6. Anderson, R. J. 2005 Open and closed source systems are equivalent (that is, in an ideal world). In Perspectives on free and open source software, pp. 127-142. Cambridge, MA: MIT Press.
7. Anderson, R. J. 2008 The economics and security resource page. See http://www.cl.cam.ac.uk/ rja14/econsec.html.
8. Arora, A., Krishnan, R., Nandkumar, A., Telang, R. & Yang, Y. 2004 Impact of vulnerability disclosure and patch availability-an empirical analysis. In Proc. Third Workshop on the Economics of Information Security, Minneapolis, MN, 13-14 May 2004.
9. Asch, S. E. 1951 Social psychology. New York, NY: Prentice-Hall.
10. Atran, S. 2003 Genesis of suicide terrorism. Science 299, 1534-1539. (doi:10.1126/science.1078854) (Pubitemid 36297695)
11. Ayres, I. & Levitt, S. 1997 Measuring positive externalities from unobservable victim precaution: an empirical analysis of Lojack. Q. J. Econ. 113, 43-77. (doi:10.1162/003355398555522)
12. Bohm, N., Brown, I. & Gladman, G. 2000 Electronic commerce: who carries the risk of fraud? J. Inform. Law Technol. 3.
13. Böhme, R. & Kataria, G. 2006 Models and measures for correlation in cyber-insurance. In Proc. Fifth Workshop on the Economics of Information Security, Cambridge, UK, 26-28 June 2006.
14. Camp, J. & Wolfram, C. 2000 Pricing security. In Proc. CERT Information Survivability Workshop, 24-26 October 2000, pp. 31-39.
15. Campbell, K., Gordon, L. A., Loeb, M. P. & Zhou, L. 2003 The economic cost of publicly announced information security breaches: empirical evidence from the stock market. J. Comput. Secur. 11, 431.
16. Danezis, G. & Anderson, R. 2005 The economics of resisting censorship. IEEE Security Privacy 3, 45-50. (doi:10.1109/MSP.2005.29) (Pubitemid 40325582)
17. Edelman, B. 2006 Adverse selection in online'trust' certificates. In Proc. Fifth Workshop on the Economics of Information Security, Cambridge, UK, 26-28 June 2006.
18. Gilbert, D. 2006 If only gay sex caused global warming. Los Angeles Times 2 July 2006.
19. Goodhart, D. 2004 Too diverse? Prospect. See http://www.guardian.co.uk/ race/story/ 0,11374,1154684,00.html.
20. Humphrey, N. 2003 The inner eye: social intelligence in evolution. New York, NY: Oxford University Press.
21. Jakobsson, M. & Myers, S. 2007 Phishing and countermeasures. New York, NY: Wiley.
22. Katz, M. L. & Shapiro, C. 1985 Network externalities, competition, and compatibility. Am. Econ. Rev. 75, 424-440.
23. Kunreuther, H. & Heal, G. 2003 Interdependent security. J. Risk Uncertain. 26, 231-249. (doi:10. 1023/A:1024119208153)
24. Loewenstein, G. 2008 The best of strangers. In Workshop on Security and Human Behaviour, Boston, 1 July 2008. See www.lightbluetouchpaper.org.
25. Milgram, S. 1974 Obedience to authority: an experimental view. New York, NY: HarperCollins.
26. Moore, T. 2005 Countering hidden-action attacks on networked systems. In Proc. Fourth Workshop on the Economics of Information Security, Cambridge, MA, 2-3 June 2005.
27. Muller, J. 2006 Overblown: how politicians and the terrorism industry inflate national security threats, and why we believe them. New York, NY: Free Press.
28. Nagaraja, S. & Anderson, R. J. 2006 The topology of covert conflict. In Proc. Fifth Workshop on the Economics of Information Security, Cambridge, UK, 26-28 June 2006.
29. Newman, M. E. J. 2003 The structure and function of complex networks. SIAM Rev. 45, 167-256. (doi:10.1137/S003614450342480)
30. Odlyzko, A. M. O. 2003 Privacy, economics and price discrimination on the Internet. In Fifth Int. Conf. Electronic Commerce, pp. 355-366. New York, NY: ACM Press.
31. Ozment, A. 2005 The likelihood of vulnerability rediscovery and the social utility of vulnerability hunting. In Proc. Fourth Workshop on the Economics of Information Security, Cambridge, MA, 2-3 June 2005.
32. Ozment, A. & Schechter, S. E. 2006a Bootstrapping the adoption of internet security protocols. In Proc. Fifth Workshop on the Economics of Information Security, Cambridge, UK, 26-28 June 2006.
33. Ozment, A. & Schechter S. E. 2006b Milk or wine: does software security improve with age? In Proc. Fifteenth USENIX Security Symposium, Vancouver, BC, 31 July-4 August 2006, pp. 93-104.
34. Rescorla, E. 2004 Is finding security holes a good idea? In Proc. Third Workshop on the Economics of Information Security, Minneapolis, MN, 13-14 May 2004.
35. Schechter, S. E. 2004 Computer security strength and risk: a quantitative approach. PhD thesis, Harvard University, Cambridge, MA.
36. Varian, H. 2000 Managing online security risks. The New York Times, 1 June 2000.
37. Varian, H. 2004 System reliability and free riding. In Economics of information security (eds L. J. Camp & S. Lewis), pp. 1-15. Dordrecht, The Netherlands: Kluwer.
38. Varian, H. 2005 Keynote address to the Third Digital Rights Management Conference, Berlin, Germany, 13 January 2005.
39. Whitten, A. & Tygar, J. D. 1999 Why Johnny can't encrypt. In Proc. Eighth USENIX Security Symposium, Washington, DC, 23-26 August 1999, pp. 169-184.
40. Zimbardo, P. 2008 The Lucifer effect. New York, NY: Random House.