Why information security is hard - an economic perspective

No abstract is available for this paper.

• Publication year

  2001

• Venue

  Seventeenth Annual Computer Security Applications Conference

• Publication date

  2001-12-10

• Fields of study

  Computer Science, Economics

• Identifiers
  DOI 10.1109/ACSAC.2001.991552
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Information rules

  2003influential reference
• Risks of the Passport single signon protocol

  2000cited by this paper
• Copy protection for DVD video

  1999cited by this paper
• Murphy’s law, the fitness of evolving species, and the limits of software reliability

  1999cited by this paper
• 'Smart' and 'Stupid' networks

  1998cited by this paper
• Compliance Defects in Public Key Cryptography

  1996cited by this paper
• Why cryptosystems fail

  1994cited by this paper
• A field study of the software design process for large systems

  1988cited by this paper
• Intermediate Microeconomics: A Modern Approach

  1987cited by this paper
• Computer Security Technology Planning Study

  1972cited by this paper

• From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures

  2026cites this paper
• NFV-Based Security Estimation and Classification Approaches for AIGC-Enabled Edge Networks

  2026cites this paper
• How Well Can LLM Agents Simulate End-User Security and Privacy Attitudes and Behaviors?

  2026cites this paper
• Applying Public Health Systematic Approaches to Cybersecurity: The Economics of Collective Defense

  2026cites this paper
• Hybrid GNN–LSTM Architecture for Probabilistic IoT Botnet Detection with Calibrated Risk Assessment

  2026cites this paper
• How informative are cybersecurity risk disclosures? Empirical analysis of firms targeted by ransomware

  2025cites this paper
• SoK: "Interoperability vs Security" Arguments: A Technical Framework

  2025cites this paper
• Voluntary Investment, Mandatory Minimums, or Cyber Insurance: What Minimizes Losses?

  2025cites this paper
• Towards Systemic IT Security. Introducing a Holistic Conceptual Framework for a Society-Centered Perspective Connecting IT and Cyber Security

  2025cites this paper
• The adversary: the philosophy of cryptography

  2025cites this paper
• EO-ZT: Economically informed zero-trust for secure spectrum trading in open radio access networks (O-RAN)

  2025cites this paper
• Addressing the Economics of Critical National Infrastructure (CNI) Security

  2025influential citation
• “The View from Below”: Resistance and Change in Authorised Push Payment Fraud

  2025cites this paper
• Optimal Security Investment Problem for Secure State Estimation on Cyber-Physical Systems

  2025cites this paper
• When User Needs Meet Power: Improving Security Usability by Recognizing Where Business Needs Come First

  2025cites this paper
• Assessing Cybersecurity Maturity: A Comprehensive Framework Applied to Ecuador

  2025cites this paper
• Secure by Design for Everyone

  2025cites this paper
• The quality of cybersecurity audits: do synergies among the chief audit executive, IT governance and internal audit functions matter?

  2025cites this paper
• The economics of cyber risk: a survey of the literature

  2025cites this paper
• Realigning Incentives to Build Better Software: a Holistic Approach to Vendor Accountability

  2025cites this paper
• Peer(ing) pressure: maintenance, care, and infrastructural capital in a cybersecurity intervention at Internet scale

  2025cites this paper
• Is Ransomware an Economically Distinct Attack Type? An Event Study of Market Reactions

  2025cites this paper
• "Where Are We On Cyber?" - A Qualitative Study On Boards' Cybersecurity Risk Decision Making

  2025cites this paper
• Peer(ing) pressure: a cybersecurity intervention at global scale in the internet infrastructure

  2025cites this paper
• Cybersecurity Challenges of Autonomous Systems

  2025cites this paper
• A history of cyber risk transfer

  2025influential citation
• "What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

  2024cites this paper
• User Vulnerabilities in AI-Driven Systems: Current Cybersecurity Threat Dynamics and Malicious Exploits in Supply Chain Management and Project Management

  2024cites this paper
• Incentivizing Secure Software Development: The Role of Liability (Waiver) and Audit

  2024cites this paper
• The simple economics of an external shock to a bug bounty platform

  2024cites this paper
• Active Defense Research: A New Perspective Integrating Traps and Vulnerabilities

  2024cites this paper
• How to Pass an Audit: Decisions on Sequential Investment

  2024cites this paper
• On the Economics of Adversarial Machine Learning

  2024cites this paper
• The perils of cybersecurity regulation

  2024cites this paper
• Automated Incident Response Using AI in Cloud Security

  2024cites this paper
• Incentivizing Secure Software Development: The Role of Voluntary Audit and Liability Waiver

  2024cites this paper
• The Medium is the Message: How Secure Messaging Apps Leak Sensitive Data to Push Notification Services

  2024cites this paper
• Generative Artificial Intelligence in the Financial Services Industry

  2024cites this paper
• Regulating Explainability in Machine Learning Applications -- Observations from a Policy Design Experiment

  2024cites this paper
• Internet of Things, critical infrastructures, and the governance of cybersecurity in 5G network slicing

  2024cites this paper
• PACAC: PYNQ Accelerated Cardiac Arrhythmia Classifier with secure transmission- A Deep Learning based Approach

  2024cites this paper
• Construction and Analysis of a Large-Scale Firm-Level Cybersecurity Posture Dataset

  2024cites this paper
• Repeated data breaches and executive compensation

  2024cites this paper
• The cybersecurity entrepreneur

  2024cites this paper
• Financial System Architecture and Technological Vulnerability

  2024cites this paper
• A Reactive Security Framework for Protecting AI Models from Adversarial Attacks: An Autoencoder-Based Approach

  2024cites this paper
• Revolutionizing Board Cyber-Risk Management Using Collaborative Gaming

  2024cites this paper
• Do hospital data breaches affect health information technology investment?

  2024cites this paper
• Robustifying Safety-Aligned Large Language Models through Clean Data Curation

  2024cites this paper
• Cyber Security Threats and Countermeasures in Digital Age

  2024cites this paper
• Selling Satisfaction: A Qualitative Analysis of Cybersecurity Awareness Vendors' Promises

  2024cites this paper
• The GDPR's Rules on Data Breaches: Analysing Their Rationales and Effects

  2023cites this paper
• The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

  2023cites this paper
• Identifying trends in information security and privacy concern research

  2023cites this paper
• Anatomy of a High-Profile Data Breach: Dissecting the Aftermath of a Crypto-Wallet Case

  2023cites this paper
• Towards a More Secure Ecosystem: Implications for Cybersecurity Labels and SBOMs

  2023cites this paper
• An Empirical Study of SETA Program Sustaining Educational Sector’s Information Security vs. Information Systems Misuse

  2023cites this paper
• Debiasing Strategies for Conversational AI: Improving Privacy and Security Decision-Making

  2023cites this paper
• How Much is Performance Worth to Users?

  2023cites this paper
• Lessons Lost: Incident Response in the Age of Cyber Insurance and Breach Attorneys

  2023cites this paper
• Security Reputation Metrics

  2023cites this paper
• SoK: Log Based Transparency Enhancing Technologies

  2023cites this paper
• Supply chain cybersecurity investments with interdependent risks under different information exchange modes

  2023cites this paper
• A Turning Point for Cyber Insurance

  2023influential citation
• Half-Day Vulnerabilities: A study of the First Days of CVE Entries

  2023cites this paper
• Measuring security development in information technologies: A scientometric framework using arXiv e-prints

  2023cites this paper
• Current Situation and Prospect of Game Theory based Network Security Methods

  2023cites this paper
• An Analysis of How Many Undiscovered Vulnerabilities Remain in Information Systems

  2023cites this paper
• Development of a secure video chat based on the WebRTC standard for video conferencing

  2023cites this paper
• Empirically evaluating the effect of security precautions on cyber incidents

  2023cites this paper
• Implementing Responsible AI: Tensions and Trade-Offs Between Ethics Aspects

  2023cites this paper
• Countering terrorist propaganda: Competitive resource allocation to communities

  2023cites this paper
• Firm performance and information security technology intellectual property

  2022cites this paper
• Making Markets for Information Security: The Role of Online Platforms in Bug Bounty Programs

  2022cites this paper
• Transparency, Compliance, And Contestability When Code Is Law

  2022cites this paper
• COMMAND: Certifiable Open Measurable Mandates

  2022cites this paper
• Do You Know Where Your Data Sleeps at Night? Cyber Security and Ransomware in Financial Markets

  2022cites this paper
• Empirically Evaluating the Effect of Cybersecurity Precautions on Incidents in Israeli Enterprises

  2022cites this paper
• Security-Induced Lock-In in the Cloud

  2022influential citation
• Data preservation and risk management in Management Information Systems

  2022cites this paper
• Economics and Optimal Investment Policies of Attackers and Defenders in Cybersecurity

  2022cites this paper
• Research on the Impact of Information Security Certification and Concealment on Financial Performance: Impact of ISO 27001 and Concealment on Performance

  2022cites this paper
• Analysis of vulnerability fixing process in the presence of incorrect patches

  2022cites this paper
• From Utility to Capability: A New Paradigm to Conceptualize and Develop Inclusive PETs

  2022cites this paper
• A Methodology for Quantifying the Value of Cybersecurity Investments in the Navy

  2022cites this paper
• Orchestrating Collaborative Cybersecurity: A Secure Framework for Distributed Privacy-Preserving Threat Intelligence Sharing

  2022cites this paper
• Transparency, Compliance, And Contestability When Code Is(n’t) Law

  2022cites this paper
• Cybersecurity For Defense Economists

  2022cites this paper
• The concept of improving the security of IT systems supporting the storage of knowledge in organizations

  2022cites this paper
• Financial Sustainability of IoT Platforms: The Role of Quality and Security

  2022cites this paper
• Research on prediction of security corresponding frequency based on GRU

  2022cites this paper
• Development of Scientific Basis for Decision Support by Experts of the Situational Center Under Conditions of Uncertainty of Input Information in Emergency Situations

  2021cites this paper
• Introduction to CyBOK Knowledge Area Version

  2021cites this paper
• Network Attack and Defense Modeling and System Security Analysis: A Novel Approach Using Stochastic Evolutionary Game Petri Net

  2021cites this paper
• Multi-paradigmatic approaches in cybersecurity economics

  2021cites this paper
• TechRank: A Network-Centrality Approach for Informed Cybersecurity-Investment

  2021cites this paper
• Crashproofing the Original NoSQL Key-Value Store

  2021cites this paper
• Dangerous games: A literature review on cybersecurity investments

  2021cites this paper
• Information security education based on job profiles and the e-CF

  2021cites this paper
• An Effective Design of Model for Information Security Requirement Assessment

  2021cites this paper