Security audits revisited

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7397 LNCS, Issue , 2012, Pages 129-147

  Böhme, Rainer ^a  

^a UNIVERSITY OF MÜNSTER   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

GAME-THEORETIC; INDIVIDUAL RISKS; POLICY IMPLICATIONS; SECURITY AUDIT; SECURITY INVESTMENTS;

CRYPTOGRAPHY; GAME THEORY; MANAGEMENT; PUBLIC POLICY;

SECURITY OF DATA;

EID: 84865825422     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-32946-3_11     Document Type: Conference Paper

References (29)

1. Anderson, R., Böhme, R., Clayton, R., Moore, T.: Security Economics and the Internal Market. Study commissioned by ENISA (2008)
2. Anderson, R.J.:Why information security is hard - An economic perspective (2001)
3. Armbrust, M., et al.: Above the clouds: A Berkeley view of cloud computing. Technical Report EECS-2009-28, University of California, Berkeley (2009)
4. Axelrod, R.: The Evolution of Cooperation. Basic Books, New York (1984)
5. Baye, M.R., Morgan, J.: Red queen pricing effects in e-retail markets. Working Paper (2003)
6. Böhme, R.: Security Metrics and Security Investment Models. In: Echizen, I., Kunihiro, N., Sasaki, R. (eds.) IWSEC 2010. LNCS, vol. 6434, pp. 10-24. Springer, Heidelberg (2010)
7. Böhme, R., Moore, T.W.: The iterated weakest link: A model of adaptive security investment. In: Workshop on the Economics of Information Security (WEIS). University College London, UK (2009)
8. Brynjolfsson, E., Hitt, L.: Computing productivity: Firm-level evidence. The Review of Economics and Statistics 85(4), 793-808 (2003)
9. Carr, N.G.: IT doesn't matter. Harvard Business Review 81(5), 41-49 (2003)
10. Edelman, B.: Adverse selection in online "trust" certifications. In:Workshop on the Economics of Information Security (WEIS). University of Cambridge, UK (2006)
11. Gordon, L.A., Loeb, M.P.: The economics of information security investment. ACM Trans. on Information and System Security 5(4), 438-457 (2002)
12. Grossklags, J., Christin, N., Chuang, J.: Secure or insure? A game-theoretic analysis of information security games. In: Proc. of the Int'l Conference on World Wide Web (WWW), pp. 209-218. ACM Press, Beijing (2008)
13. Hirshleifer, J.: From weakest-link to best-shot: The voluntary provision of public goods. Public Choice 41, 371-386 (1983)
14. Jacquith, A.: Security Metrics: Replacing Fear, Uncertainty, and Doubt. Addison-Wesley (2007)
15. Johnson, B., Böhme, R., Grossklags, J.: Security Games with Market Insurance. In: Baras, J.S., Katz, J., Altman, E. (eds.) GameSec 2011. LNCS, vol. 7037, pp. 117-130. Springer, Heidelberg (2011)
16. Kunreuther, H., Heal, G.: Interdependent security. Journal of Risk and Uncertainty 26(2-3), 231-249 (2003)
17. Liu, W., Tanaka, H., Matsuura, K.: An empirical analysis of security investment in countermeasures based on an enterprise survey in Japan. In: Workshop on the Economics of Information Security (WEIS). University of Cambridge, UK (2006)
18. Molnar, D., Schechter, S.: Self hosting vs. cloud hosting: Accounting for the security impact of hosting in the cloud. In: Workshop on the Economics of Information Security (WEIS). Harvard University, Cambridge (2010)
19. Ogut, H., Menon, N., Raghunathan, S.: Cyber insurance and it security investment: Impact of interdependent risk. In: Workshop on the Economics of Information Security (WEIS). Harvard University, Cambridge (2005)
20. Parameswaran, M., Whinston, A.B.: Incentive mechanisms for internet security. In: Rao, H.R., Upadhyaya, S. (eds.) Handbooks in Information Systems, Emerald, vol. 4, pp. 101-138 (2009)
21. Rice, D.: Geekonomics - The Real Cost of Insecure Software. Addison-Wesley, New York (2007)
22. Rowe, B.R.: Will outsourcing IT security lead to a higher social level of security? In: Workshop on the Economics of Information Security (WEIS). Carnegie Mellon University, Pittsburgh (2007)
23. Sackmann, S., Strüker, J., Accorsi, R.: Personalization in privacy-aware highly dynamic systems. Communications of the ACM 49(9), 32-38 (2006)
24. Schelling, T.: The Strategy of Conflict. Oxford University Press, Oxford (1965)
25. Shetty, N., Schwartz, G., Felegyhazi, M., Walrand, J.: Competitive cyber-insurance and internet security. In:Workshop on Economics of Information Security (WEIS). University College London, UK (2009)
26. Telang, R., Yang, Y.: Do security certifications work? Evidence from Common Criteria certification. In: IEEE International Conference on Technologies for Homeland Security (2011)
27. Varian, H.R.: System reliability and free riding. In: Workshop on the Economics of Information Security (WEIS). University of California, Berkeley (2002)
28. Winkler, S., Proschinger, C.: Collaborative penetration testing. In: Business Services: Konzepte, Technologien, Anwendungen (9. Internationale Tagung Wirtschaftsinformatik), vol. 1, pp. 793-802 (2009)
29. Zhao, X., Xue, L., Whinston, A.B.: Managing interdependent information security risks: A study of cyberinsurance, managed security service and risk pooling. In: Proceedings of ICIS (2009)