Why information security is hard - An economic perspective

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2001-January, Issue , 2001, Pages 358-365

  Anderson, Ross ^a  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

Author keywords

Access control; Computer crime; Computer security; Cryptographic protocols; Ethics; Floods; Information security; Laboratories; Microeconomics; Protection

Indexed keywords

ACCESS CONTROL; COMPUTER CRIME; CRYPTOGRAPHY; ECONOMICS; FLOODS; LABORATORIES; RISK MANAGEMENT; SECURITY SYSTEMS;

ACCESS CONTROL POLICIES; ASYMMETRIC INFORMATION; CRYPTOGRAPHIC PROTOCOLS; ECONOMIC PERSPECTIVE; ETHICS; MICROECONOMICS; PROTECTION; TRAGEDY OF THE COMMONS;

SECURITY OF DATA;

EID: 84925838576     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2001.991552     Document Type: Conference Paper

References (20)

1. GA Akerlof, The Market for 'Lemons': Quality Uncertainty and Market Mechanism, Quarterly Journal of Economics v 84 (August 1970) pp 488-500
2. J Anderson, 'Computer Security Technology Planning Study', ESD-TR-73-51, US Air Force Electronic Systems Division (1973) http://csrc.nist.gov/publications/ history/index.html
3. RJ Anderson, 'Security Engineering-A Guide to Building Dependable Distributed Systems', Wiley (2001) ISBN 0-471-38922-6
4. RJ Anderson, Why Cryptosystems Fail in Communications of the ACM vol 37 no 11 (November 1994) pp 32-40
5. JA Bloom, IJ Cox, T Kalker, JPMG Linnartz, ML Miller, CBS Traw, Copy Protection for DVD Video, in Proceedings of the IEEE v 87 no 7 (July 1999) pp 1267-1276
6. RM Brady, RJ Anderson, RC Ball, 'Murphy's law, the fitness of evolving species, and the limits of software reliability', Cambridge University Computer Laboratory Technical Report no. 476 (1999); at http;//www.cl.cam.ac. uk/~rja14
7. CERT, Results of the Distributed-Systems Intruder Tools Workshop, Software Engineering Institute, Carnegie Mellon University, http://www.cert.org/reports/dsit- workshop-final.html, December 7, 1999
8. W Curtis, H Krasner, N Iscoe, A Field Study of the Software Design Process for Large Systems, in Communications of the ACM v 31 no 11 (Nov 88) pp 1268-1287
9. D Davis, Compliance Defects in Public-Key Cryptography, in Sixth Usenix Security Symposium Proceedings (July 1996) pp 171-178
10. De l'influence des peages sur l'utilite des voies de communication, 1849, Annales des Ponts et Chausses
11. European Union, 'Network and Information Security: Proposal for a European Policy Approach', COM(2001)298 final, 6/6/2001
12. A Kerckhoffs, La CryptographieMilitaire, in Journal des Sciences Militaires, 9 Jan 1883, pp 5-38; http://www.fabien-petitcolas.net/ kerckhoffs
13. DP Kormann, AD Rubin, Risks of the Passport Single Signon Protocol, in Computer Networks (July 2000); at http://avirubin. com/vita.html
14. SJ Liebowitz, SE Margolis, NetworkExt ernalities (Effects), in The New Palgrave's Dictionary of Economics and the Law, MacMillan, 1998; see http://wwwpub.utdallas.edu/ ~liebowit/netpage.html
15. WF Lloyd, 'Two Lectures on the Checks to Population', Oxford University Press (1833)
16. AM Odlyzko, Smart and stupid networks: Why the Internet is like Microsoft, ACM netWorker, Dec 1998, pp 38-46, at http://www.acm.org/networker/ issue/9805/ssnet.html
17. C Shapiro, H Varian, 'Information Rules', Harvard Business School Press (1998), ISBN 0-87584-863-X
18. J Spolsky, Does Issuing Passports Make Microsoft a Country? at http://joel.editthispage.com/stories/ storyReader$139
19. H Varian, 'Intermediate Microeconomics-A Modern Approach', Fifth edition, WW Norton and Company, New York, 1999; ISBN 0-393-97930-0
20. H Varian, Managing Online Security Risks, Economic Science Column, The New YorkT imes, June 1, 2000, http: //www.nytimes.com/library/financial/ columns/060100econ-scene.html