Economics of Information Security and Privacy III PDF
Preview Economics of Information Security and Privacy III
Economics of Information Security and Privacy III Bruce Schneier Editor Economics of Information Security and Privacy III 123 Editor BruceSchneier Minneapolis MN,USA [email protected] ISBN978-1-4614-1980-8 ISBN978-1-4614-1981-5(eBook) DOI10.1007/978-1-4614-1981-5 SpringerNewYorkHeidelbergDordrechtLondon LibraryofCongressControlNumber:2012944738 ©SpringerScience+BusinessMediaNewYork2013 Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartof thematerialisconcerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation, broadcasting,reproductiononmicrofilmsorinanyotherphysicalway,andtransmissionorinformation storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodology nowknownorhereafterdeveloped.Exemptedfromthislegalreservationarebriefexcerptsinconnection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’slocation,initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer. PermissionsforusemaybeobtainedthroughRightsLinkattheCopyrightClearanceCenter.Violations areliabletoprosecutionundertherespectiveCopyrightLaw. Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant protectivelawsandregulationsandthereforefreeforgeneraluse. While the advice and information in this book are believed to be true and accurate at the date of publication,neithertheauthorsnortheeditorsnorthepublishercanacceptanylegalresponsibilityfor anyerrorsoromissionsthatmaybemade.Thepublishermakesnowarranty,expressorimplied,with respecttothematerialcontainedherein. Printedonacid-freepaper SpringerispartofSpringerScience+BusinessMedia(www.springer.com) Preface You have in your hands most of the papers—some are missing because of various publication requirements—from the Tenth Workshop on Economics and InformationSecurityorWEIS2011. The idea that economics has anything to do with computer security is only slightlyolderthanthisworkshop.RossAndersonandIseemtohavestumbledupon the idea independently—he in his brilliant article from 2001, “Why Information Security Is Hard—An Economic Perspective” (http://www.cl.cam.ac.uk/∼rja14/ Papers/econ.pdf),andmeinvariousessaysandpresentationsfromthatsameperiod. WEISwasinaugurateda yearlater attheUniversityofCaliforniaatBerkeleyand has been held annually ever since in both the USA and Europe. It is the only workshop where security technologists get together with economists and policy makersandtrytounderstandtheeconomicproblemsrelatedtocomputersecurity. And economics has a lot to teach computer security. We generally think of computer security as a problem of technology, but it is a technological problem that has people as an essential element. Security designs need to take intelligent attackersintoaccount,ofcourse,buttheyhavetotakeintoaccounttheinterestsand motivationsof the usersas well. Thismakescomputersecurityunique,andopens upvastareasoffailurethattraditionalcomputerengineeringsystemsdon’thaveto dealwith.Oftensystemsfailbecauseofmisplacedeconomicincentives,whenthe peoplewhocouldprotectasystemarenottheoneswhosufferthecostsoffailure. When you start looking, economic considerations are everywhere in com- putersecurity.Hospitals’ medicalrecordssystems providecomprehensivebilling- managementfeaturesfortheadministratorswhospecifythem,butarenotsogood at protecting patients’ privacy. Automated teller machines suffered from fraud in countries like the UK and the Netherlands, where poor regulation left banks without sufficient incentive to secure their systems, and allowed them to pass the cost of fraud along to their customers. And one reason the Internet is insecure is that liability for attacks is so diffuse. In all of these examples, the economic considerationsofsecurityaremoreimportantthanthetechnicalconsiderations. More generally,manyof the mostbasic security questionsare atleast asmuch economicastechnical.Dowespendenoughonkeepinghackersoutofourcomputer v vi Preface systems? Or do we spend too much? For that matter, do we spend appropriate amountsonpoliceandmilitaryservices?Andarewespendingoursecuritybudgets ontherightthings?Inthe10yearssincetheterroristattacksof9/11,questionslike thesehaveaheightenedimportance. Economics can actually explain many of the puzzling realities of Internet security. Firewalls are commonand e-mail encryptionis rare—notbecause of the relativeeffectivenessofthetechnologies,butbecauseoftheeconomicpressuresthat drive companies to install them. Corporations rarely publicize information about intrusions;thatisbecauseofeconomicincentivesagainstdoingso.Andaninsecure operatingsystemistheinternationalstandard;inpart,thatisbecauseitseconomic effectsare largelybornenotby the companythatbuildsthe operatingsystem, but bythecustomerswhobuyit. Some of the most controversial cyberpolicy issues also sit squarely between information security and economics. For example, the issue of digital rights management:is copyrightlaw too restrictive—or not restrictive enough—tomax- imize society’s creative output? And if it needs to be more restrictive, will DRM technologiesbenefitthemusicindustryorthetechnologyvendors?IsApple’sstrict control over iPhone and iPad applications good for security, or just another way for the company to lock its customers into its platforms? What are the costs and benefits of different Internet security proposals: systems that restrict anonymity, breach disclosure laws, or Internet “kill switches”? Any attempt to answer these questionsbecomesrapidlyentangledwithbothinformationsecurityandeconomic arguments. WEIS 2011 was held at George Mason University, in Fairfax, Virginia (http:// weis2011.econinfosec.org/). Over the course of two days, 95 attendees heard 20 talks,twoinvitedspeakers,andonepanel.Topicscoveredincludedprivacy,identity, securityresilience,andtheeconomicsofcomputercrime. This year marked a milestone for WEIS: ten conferences in 10 years. I’ve longsaid thatthe fundamentalproblemsin computersecurity are no longerabout technology; they’re about applying technology. Workshops like WEIS help us understandwhygoodsecuritytechnologiesfailandbadonessucceed,andthatkind ofinsightiscriticalifwe’regoingtoimprovesecurityintheinformationage. Minneapolis,MN,USA BruceSchneier Contents TheImpactofImmediateDisclosureonAttackDiffusionandVolume.... 1 SamRansbothamandSabyasachiMitra WhereDoAlltheAttacksGo? ................................................. 13 DineiFloreˆncioandCormacHerley Sex,LiesandCyber-CrimeSurveys ........................................... 35 DineiFloreˆncioandCormacHerley TheUndergroundEconomyofFakeAntivirusSoftware.................... 55 Brett Stone-Gross, Ryan Abman, Richard A. Kemmerer, ChristopherKruegel,DouglasG.Steigerwald,andGiovanniVigna TheInconvenientTruthAboutWebCertificates............................. 79 NevenaVratonjic, Julien Freudiger,VincentBindschaedler, andJean-PierreHubaux ResilienceoftheInternetInterconnectionEcosystem ....................... 119 ChrisHall,RossAnderson,RichardClayton,EvangelosOuzounis, andPanagiotisTrimintzios ModelingInternet-ScalePoliciesforCleaningupMalware................. 149 Steven Hofmeyr, Tyler Moore, Stephanie Forrest, BenjaminEdwards,andGeorgeStelle Fixed Costs, Investment Rigidities, and Risk Aversion inInformationSecurity:AUtility-theoreticApproach...................... 171 ChristosIoannidis,DavidPym,andJulianWilliams AreHomeInternetUsersWillingtoPayISPsforImprovements inCyberSecurity?............................................................... 193 BrentRoweandDallasWood vii viii Contents EconomicMethodsandDecisionMakingbySecurityProfessionals....... 213 Adrian Baldwin, Yolanta Beres, Geoffrey B. Duggan, Marco Casassa Mont, Hilary Johnson, Chris Middup, andSimonShiu RealNameVerificationLawontheInternet:APoisonorCure forPrivacy?....................................................................... 239 DaegonCho ThePrivacyLandscape:ProductDifferentiationonDataCollection...... 263 So¨renPreibuschandJosephBonneau Contributors RyanAbman UniversityofCalifornia,SantaBarbara,SantaBarbara,CA,USA RossAnderson UniversityofCambridge,Cambridge,UK AdrianBaldwin HPLabs,Bristol,England,UK YolantaBeres HPLabs,Bristol,England,UK VincentBindschaedler EPFL,Lausanne,Switzerland JosephBonneau UniversityofCambridge,Cambridge,UK MarcoCasassaMont HPLabs,Bristol,England,UK DaegonCho CarnegieMellonUniversity,Pittsburgh,PA,USA RichardClayton UniversityofCambridge,Cambridge,UK GeoffreyB.Duggan UniversityofBath,Bath,England,UK BenjaminEdwards UniversityofNewMexico,Albuquerque,NM,USA DineiFloreˆncio MicrosoftResearch,Redmond,WA,USA StephanieForrest UniversityofNewMexico,Albuquerque,NM,USA JulienFreudiger EPFL,Lausanne,Switzerland ChrisHall HighwaymanAssociatesLtd.,Leatherhead,UK CormacHerley MicrosoftResearch,Redmond,WA,USA StevenHofmeyr LawrenceBerkeleyNationalLaboratory,Berkeley,CA,USA Jean-PierreHubaux EPFL,Lausanne,Switzerland ChristosIoannidis UniversityofBath,Bath,England,UK HilaryJohnson UniversityofBath,Bath,England,UK ix x Contributors Richard A. Kemmerer University of California, Santa Barbara, Santa Barbara, CA,USA ChristopherKruegel UniversityofCalifornia,SantaBarbara,SantaBarbara,CA, USA ChrisMiddup OpenUniversity,England,UK Sabyasachi Mitra College of Management, Georgia Institute of Technology, Atlanta,GA,USA TylerMoore HarvardUniversity,Cambridge,MA,USA Evangelos Ouzounis European Network and Information Security Agency, Heraklion,Greece So¨renPreibusch UniversityofCambridge,Cambridge,UK DavidPym UniversityofAberdeen,Aberdeen,Scotland,UK SamRansbotham BostonCollege,ChestnutHill,MA,USA BrentRowe RTIInternational,SanFrancisco,CA,USA SimonShiu HPLabs,Bristol,England,UK DouglasG. Steigerwald University of California, Santa Barbara, Santa Barbara, CA,USA GeorgeStelle UniversityofNewMexico,Albuquerque,NM,USA Brett Stone-Gross University of California, Santa Barbara, Santa Barbara, CA, USA Panagiotis Trimintzios European Network and Information Security Agency, Heraklion,Greece GiovanniVigna UniversityofCalifornia,SantaBarbara,SantaBarbara,CA,USA NevenaVratonjic EPFL,Lausanne,Switzerland JulianWilliams UniversityofAberdeen,Aberdeen,Scotland,UK DallasWood RTIInternational,SanFrancisco,CA,USA
The list of books you might like
