The course readings are drawn from a variety of sources. They include outcomes of major international meetings and conferences, scholarly writings, excerpts of reports by international organizations, WEIS papers, and cutting-edge reflections on current affairs.
The course readings are designed to provide the necessary background information for the various speaker presentations as well as, present a spectrum of opinions, philosophies and perspectives on the economics of cybersecurity in a range of conflicts and situations.
For Week 1
An overview of the field
- Ross Andersson and Tyler Moore, The Economics of Information Security, Science, 2006.
- Tyler Moore and Ross Anderson. Economics and Internet Security: a Survey of Recent Analytical, Empirical and Behavioral Research, 2011
History of information security economics
- Ross Andersson, Why Information Security is Hard - An Economic Perspective, Annual Computer Security Applications Conference, 2002.
- Ross Andersson, Security Economics - A personal Perspective, Annual Computer Security Applications Conference, 2012.
- Hal Varian, Managing Online Security Risks, New York Times, 2000.
Not required reading, but if you want to get a bit more background on the economic concepts we are using
- A classic text on the incentives and business models in information markets from Hal Varian and Carl Shapiro: Information Rules: A Strategic Guide the Network Economy, Harvard Business School Press 1998. We cannot make the whole book available, but you can read the introduction.
- The classic paper on the tragedy of the commons: G. Hardin, The Tragedy of the commons, Science, 1968.
- The classic paper on information asymmetry: A. Akerlof, The market for ‘lemons’: quality uncertainty and the market mechanism, In Quarterly Journal of Economics, 1970
- If need more basic information about concepts like 'marginal cost' and 'diminishing (marginal) returns on investment', you can find numerous online sources. There are also online courses providing an introduction to microenonomics. A recent one that looks promising it by Tyler Cowen and Alex Tabarrok, though not all lectures are available yet: Introduction to Microeconomics, Marginal Revolution University, 2015
For Week 2
- Rainer Böhme, Cyber-insurance revisited, WEIS 2005
- Rainer Böhme, Security Metrics and Security Investment Models, Advances in Information and Computer Security, Lecture Notes in Computer Science Volume 6434, pp 10-24, 2010
- Ross Anderson et al., Measuring the Cost of Cybercrime, WEIS, 2012
- If you are interested in more information on our example of incident metrics on botnet infections, see Michel van Eeten et al., The Role of Internet Service Providers in Botnet Mitigation An Empirical Analysis Based on Spam Data, WEIS, 2010
- The reference we mentioned to the study of privacy leaks in the Apple App Store is here: Manuel Egele et al., PiOS: Detecting Privacy Leaks in iOS Applications, NDSS, 2011. You can find a short piece in Forbes here.
- The reference we made to Zhang et al. is this paper: On the Mismanagement and Maliciousness of Networks, NDSS, 2014. It suggests that measuring certain indicators of poor network hygiene (such as running open DNS resolvers) are good proxies for the controls in place at the network operator. It correlates strongly with incident-based metrics on malicious activity.
For Week 3
- Gordon and Loeb, The economics of information security investment, TISSEC, 2002
- Gordon et al., Information Security Expenditures and Real Options: A Wait-and-See Approach, Computer Security Journal, 2003
- Bodin et al., Information security and risk management, Communications of the ACM, 2008
- Rainer Böhme and Gaile Schwartz, Modeling cyber-insurance: Towards a unifying framework, WEIS, 2010
- Gordon and Loeb, A framework for using insurance for cyber-risk management, Communications of the ACM, 2003
- Hal Varian, System reliability and free riding, Economics of Information Security, 2004
For Week 4
Strongly suggested readings:
- Tyler Moore, Introducing the Economics of Cybersecurity: Principles and Policy Options, International Journal of Critical Infrastructure Protection, 2010
- B. Schneier, Security as a lemon market, 2007
- Tyler Moore, Richard Clayton, and Ross Anderson. The economics of online crime. Journal of Economic Perspectives, 2009
- Section 3.4 (Payment System Security) of Tyler Moore and Ross Anderson. Internet security. In Martin Peitz and Joel Waldfogel, editors, The
Oxford Handbook of the Digital Economy, pages 572-599. Oxford University Press, 2012.
- E. Gal-Or and A. Ghose, The Economic Incentives for Sharing Security Information, Information Systems Research, 2005
- Gordon et al., Sharing information on computer systems security: An economic analysis, Journal of Accounting and Public Policy, 2003
- Ross Anderson et al. , Security Economics and European Policy, WEIS, 2008
- Tyler Moore and Richard Clayton. Examining the Impact of Website Take-down on Phishing, ECRIME, 2007
- Tyler Moore and Richard Clayton. The Consequence of Non-Cooperation in the Fight Against Phishing, ECRIME, 2008
- Marc Rysman, The Economics of Two-Sided Markets. The Journal of Economic Perspectives, Vol. 23, No. 3 (Summer, 2009), pp. 125-143.
For Week 5
- Bruce Schneier, The Psychology of Security, 2008
- Mark Frank et al., Human Behaviour and Deception Detection, Handbook of Science and Technology for Homeland Security , 2008
- Stephen Lea et al., The Psychology of Scams – Provoking and Committing Errors of Judgment, 2009
- Frank Stajano and Paul Wilson, Understanding scam victims: seven principles for systems security, 2009
- Shari L. Pfleegera and Deanna D. Caputo, Leveraging behavioral science to mitigate cyber security risk, Computers & Security, 2012
- Alessandro Acquisti and Jens Grossklags, Privacy and Rationality: Preliminary Evidence from Pilot Data, WEIS 2004
- Alessandro Acquisti and Jens Grossklags, What Can Behavioral Economics Teach Us About Privacy?, ETRICS 2006
- Janice Tsai et al., The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study, WEIS 2007
- Kai-Lung Hui and Ivan Png, The Economics of Privacy, Handbooks in Information Systems, 2006
- Hal Varian, Economic Aspects of Personal Privacy, 1996
- On some of the key policy implications of security economics: Ross Anderson, Rainer Böhme, Richard Clayton and Tyler Moore, Security Economics and the Internal Market, ENISA report, 2008