Managing Information Risk and the Economics of Security (eBook)

Preface 7
Table of Contents 9
Managing Information Risk and the Economics of Security 15
1 Introduction 15
2 Communicating Security – The Role of Media 16
3 Investigating and Prosecuting Cybercrime 20
4 CISO Perspective – Evaluating and Communicating Information Risk 22
5 Overview of Book 28
References 29
Nonbanks and Risk in Retail Payments: EU and U.S. 31
1 Introduction 31
2 Nonbanks in Retail Payment Systems 32
3 Risks in Retail Payments Processing 47
4 Impact of Nonbanks on Risk 56
5 Conclusions and Closing Remarks 63
Acknowledgments 65
References 65
Security Economics and European Policy 68
1 Introduction 68
2 Information Asymmetries 72
3 Externalities 76
4 Liability Assignment 79
5 Dealing with the Lack of Diversity 86
6 Fragmentation of Legislation and Law Enforcement 88
7 Security Research and Legislation 89
8 Conclusions 90
Acknowledgments 91
References 91
BORIS –Business ORiented management of Information Security 94
1 Introduction 94
2 BORIS design 97
3 Evaluation 107
4 Conclusion and Outlook 108
References 109
Productivity Space of Information Security in an Extension of the Gordon-Loeb’s Investment Model 111
1 Introduction 111
2 The Two Reductions 112
3 Productivity Space of Information Security 114
4 Implications and Limitations 122
5 Concluding Remarks 128
Acknowledgments 128
References 129
Appendix 130
Communicating the Economic Value of Security Investments: Value at Security Risk 132
1 Introduction and Problem Situation 132
2 Background and Preliminaries 134
3 Problem Formulations: Value-at-Risk 135
4 Value-at-Security Risk Model: Assumptions 135
5 Our Parametric Model 136
7 Analysis of Authentic Data: Model Evaluation 142
8 Comments and Conclusions: Present and Future Work 149
References 150
Modelling the Human and Technological Costs and Benefits of USB Memory Stick Security 152
1 Introduction 152
2 The Central Bank Problem and Information Security 154
3 An Empirical Study 156
4 The Conceptual Model 158
5 An Executable Model 166
6 The Experimental Space 168
7 Conclusions and Directions 172
Acknowledgments 173
References 173
The Value of Escalation and Incentives in Managing Information Access 175
1 Introduction 175
2 Background and Solution Framework 177
3 Literature Review 180
4 Economic Modeling of an Information Governance System 180
5 Overview of Insights and Results 182
6 Conclusion 185
References 186
Reinterpreting the Disclosure Debate for Web Infections 188
1 Introduction 188
2 Attack Trends 190
3 Market Failure: Consumer Webmasters and Mid-Tier Web Hosts 195
4 Vulnerability Disclosure 197
5 Methods for Identifying Most-Infected Web Hosts 199
6 Web Host Infection Results 200
7 Recommendations 203
8 Conclusion 205
Acknowledgments 205
References 205
The Impact of Incentives on Notice and Take-down 207
1 Introduction 207
2 Defamation 208
3 Copyright Violations 210
4 Child Sexual Abuse Images 211
5 Phishing 213
6 Fraudulent Websites 219
7 Spam, Malware and Viruses 224
8 Comparing Take-down Effectiveness 225
9 Conclusion 229
Acknowledgments 230
References 230
Studying Malicious Websites and the Underground Economy on the Chinese Web 232
1 Introduction 232
2 Related Work 234
3 Underground Economy Model 235
4 Mechanisms Behind Malicious Websites on the Chinese Web 239
5 Measurements and Results 245
6 Conclusions 250
Acknowledgments 251
References 251
Botnet Economics: Uncertainty Matters 252
1 Introduction 252
2 Background and Related Work 254
3 The Benchmark Model 256
4 Optimization Model With Virtual Machines 260
5 Further Discussion and Case Study 266
6 Conclusion and Future Work 273
References 274