Module- Case: SECURITY VIA TECHNOLOGY
Case Assignment
1. Revisit Bruce Schneier's presentation in Module 2. This time, please focus on his discussions on cost/benefit analysis.
Schneier, B. (2008). What are the implications of spying? CCTV interview with Bruce Schneier. Retrieved from https://www.youtube.com/watch?v=Ar67N94NYr0
If you don't have access to the presentation, then simply read his article mentioned in Module 2. The article is:
Schneier, Bruce. The Psychology of Security. https://www.schneier.com/essay-155.html
The following article provides an example how such a cost/benefit analysis is considered.
Schneier, Bruce. Security at What Cost? National ID System Is Not Worth The $23 Billion Price Tag. https://www.schneier.com/essay-207.html.
The following article uses some typical accounting measurements for economics of information security.
Gordon, L. A., & Richardson, R. (2004). The New Economics of Information Security. Optimize. April, 83-86. (Trident Online Library: ProQuest)
The following article recaps what we talked about perceptions of security. More importantly, it discusses how people generally do not perceive gains and costs equally. When you conduct a cost/benefit analysis of security, you should keep that in mind.
West, R. (2008). The psychology of security. Communications of the ACM, Apr, 51(4), 34-40.
2. Incentive Design
The economics of information security is not only about cost/benefit analysis of implementing a security measure. Another major topic in economics is mechanism design, which provides principles and methods (like game theory) to help design incentive-compatible mechanisms that ensure participants are better off behaving honestly than dishonestly. See the following article to get a peek:
The Economist. (2007) Intelligent Design. Oct 18th, 2007. https://www.economist.com/finance/displaystory.cfm?story_id=9988840
To know more about the three Nobel Prize winners in 2007 economics division, surf https://nobelprize.org/nobel_prizes/economics/laureates/2007/ and check them out.
It is not easy to understand the revelation principle or the incentive-compatible design. I introduce you the concepts here for the purpose of making you aware of such a method. It takes time to learn how to design a game (a mechanism) that every party is better off by being honest.
Well, on a lighter note. Interestingly, a movie called "Mad Money" tells a story of three female employees of the Federal Reserve Bank stealing money that is about to be shredded. It is not a movie that I recommend to watch a second time, but it is entertaining enough to watch once. The movie is also a fit for the educational purpose here. I suggest you watch it once when you get a chance during this term, and pay special attention to the human factors -- especially the incentives of the thieves and the Chief Security Officer.
3. Other Economics Issues as to Security
As a matter of fact, there are many aspects in applying economics to information security. The following article has mentioned a list of authors that research economics of information security and provided a brief overview of their research:
Anderson R. and Schneier B., (2005) Economics of Information Security, IEEE Security and Privacy 3 (1), 2005, pp. 12-13. (Retrieved May 19, 2008).
To know more in depth, you can choose to view the video (optional):
Simonyi Konferencia 2011 - Economics of Information Security and Privacy. Retrieved from https://www.youtube.com/watch?v=fSfH80DY6S4
You are probably overwhelmed now with all these economics. I hope you also have broadened your views on security and have said "wow" to yourself that now you hold a much broader view on security and how to approach it from economic perspective.
Please write a 4- to 6-page paper discussing what you have learned:
What are the economic considerations of information security and its management?
In preparing your paper, you need to discuss the following issues, and support with arguments and evidence:
• What are the major economic considerations in information security and management?
• Are these economic considerations serving their purposes?
• Why do these economic measures help?
• Discuss economic mechanisms that can improve information security and management.
• Provide a comparative table of the economic measures that you discussed.
Assignment Expectations
Length: Minimum 4-6 pages excluding cover page and references (since a page is about 300 words, this is approximately 1,200-1,800 words).