Nice insights from paper 'Information Security Economics – and Beyond'

MrBrian · May 20, 2008

There are some nice insights in the paper 'Information Security Economics - and Beyond' about the relationship between information security and economics. Follow the money, as they say, to find out why things are the way they are. I discovered this paper at this blog entry and got some of my ideas of what to quote from there.

Most users cannot tell good security from bad, so developers are not compensated for efforts to strengthen their code. Some evaluation schemes are so badly managed that ‘approved’ products are less secure than random ones.
Click to expand...

Asymmetric information plays a large role in information security. Moore showed that we can classify many problems as hidden-information or hidden action problems. The classic case of hidden information is the ‘market for lemons’. Akerlof won a Nobel prize for the following simple yet profound insight: suppose that there are 100 used cars for sale in a town: 50 well-maintained cars worth $2000 each, and 50 ‘lemons’ worth $1000. The sellers know which is which, but the buyers don’t. What is the market price of a used car? You might think $1500; but at that price no good cars will be offered for sale. So the market price will be close to $1000. Hidden information, about product quality, is one reason poor security products predominate. When users can’t tell good from bad, they might as well buy a cheap antivirus product for $10 as a better one for $20, and we may expect a race to the bottom on price.
Click to expand...

In many markets, the attitude of ‘ship it Tuesday and get it right by version 3’ is perfectly rational behaviour. Many software markets have dominant firms thanks to the combination of high fixed and low marginal costs, network externalities and client lock-in noted above, so winning market races is all important. In such races, competitors must appeal to complementers, such as application developers, for whom security gets in the way; and security tends to be a lemons market anyway. So platform vendors start off with too little security, and such as they provide tends to be designed so that the compliance costs are dumped on the end users. Once a dominant position has been established, the vendor may add more security than is needed, but engineered in such a way as to maximise customer lock-in.

In some cases, security is even worse than a lemons market: even the vendor does not know how secure its software is. So buyers have no reason to pay more for protection, and vendors are disinclined to invest in it.
Click to expand...

Acquisti and Grossklags tackled the specific problem of why people express a high preference for privacy when interviewed but reveal a much lower preference through their behaviour both online and offline. They find that people mostly lack sufficient information to make informed choices, and even when they do they often trade long-term privacy for short-term benefits. Vila et al. characterised privacy economics as a lemons market, arguing that consumers disregard future price discrimination when giving information to merchants.
Click to expand...

Legal theorists have long known that liability should be assigned to the party that can best manage the risk. Yet everywhere we look, we see online risks allocated poorly, resulting in privacy failures and protracted regulatory tussles.
Click to expand...

Log in or Sign up

Nice insights from paper 'Information Security Economics – and Beyond'

MrBrian Registered Member

Log in or Sign up

Nice insights from paper 'Information Security Economics – and Beyond'

MrBrian Registered Member

Useful Searches