Economic Security Metrics

Böhme, Rainer; Nowey, Thomas

doi:10.1007/978-3-540-68947-8_15

Cited by 41 publications

(26 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Our work complements the rich area of security metrics that are commonly technical, financial [17] or market-based [3]. However, the price of uncertainty is motivated by game-theory and, more specifically, by Koutsoupias and Papadimitriou's metric to evaluate worst-case equilibria [20], and adds to the rich literature on information sharing, (mandatory) disclosure, and notice and consent that we reviewed in the introductory section.…”

Section: Discussionmentioning

confidence: 99%

The Price of Uncertainty in Security Games

Großklags

Johnson

Christin

2010

Economics of Information Security and Privacy

View full text Add to dashboard Cite

In the realm of information security, lack of information about other users' incentives in a network can lead to inefficient security choices and reductions in individuals' payoffs. We propose, contrast and compare three metrics for measuring the price of uncertainty due to the departure from the payoffoptimal security outcomes under complete information. Per the analogy with other efficiency metrics, such as the price of anarchy, we define the price of uncertainty as the maximum discrepancy in expected payoff in a complete information environment versus the payoff in an incomplete information environment. We consider difference, payoff-ratio, and cost-ratio metrics as canonical nontrivial measurements of the price of uncertainty.We conduct an algebraic, numerical, and graphical analysis of these metrics applied to different well-studied security scenarios proposed in prior work (i.e., best shot, weakest-link, and total effort). In these scenarios, we study how a fully rational expert agent could utilize the metrics to decide whether to gather information about the economic incentives of multiple nearsighted and naïve agents. We find substantial differences between the various metrics and evaluate the appropriateness for security choices in networked systems.

show abstract

Section: Discussionmentioning

confidence: 99%

The Price of Uncertainty in Security Games

Großklags

Johnson

Christin

2010

Economics of Information Security and Privacy

View full text Add to dashboard Cite

show abstract

“…The most well-known metrics are used in risk management and in economic/managerial evaluation of security investments (Bohme and Nowey, 2008;Ravi et al, 2007). They include the annual loss expectancy (ALE), the return on security investment (ROSI), the net present value (NPV), and the internal rate of return (IRR).…”

Section: Figure 1 Economic Model Of Social Benefits and Costsmentioning

confidence: 99%

Economic assessment of externalities for interactive audio media anti-SPIT protection of internet services

Tsiakis

Katsaros

Gritzalis

2012

IJESDF

View full text Add to dashboard Cite

Spam over internet telephony (SPIT) refers to all unsolicited and massive scale attempts to establish voice communication with oblivious users of voice over internet protocol (VoIP) services. SPIT exhibits a significant increase over the last years, thus developing into a serious threat with adverse impact and costs for the business economy. An audio completely automated public Turing test to tell computers and human apart (CAPTCHA) has been introduced as a means to distinguish automated software agents (bots) from human. CAPTCHA has been proposed as a security measure against SPIT. In this paper, we lay the principles for an adequate understanding of the SPAM-related economic models, as well as their analogies to the SPIT phenomenon, so as to weigh the benefits of audio CAPTCHA protection against the incurred costs. Our approach is based on the economic assessment of externalities, i.e., the economic impact associated with the SPIT side effects on the everyday life.

show abstract

“…Economic security metrics are concerned with how efficient a security measure is. Those methods include, Annual Loss Expectancy (ALE), Return On Security Investment (ROSI), Net Present Value, (NPV), Internal Rate of Return (IRR), risk management and focus on economic/managerial evaluation of security investments [10,11]. The second group is based on classic economic theory, with methods such as efficient market hypothesis.…”

Section: Fig 1 Economic Model Of Social Benefits and Costsmentioning

confidence: 99%

Economic Evaluation of Interactive Audio Media for Securing Internet Services

Tsiakis

Katsaros

Gritzalis

2012

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

Abstract. Internet Telephony (Voice over Internet Protocol or VoIP) has recently become increasingly popular mainly due to its cost advantages and range of advance services. On the same time, SPam over Internet Telephony (SPIT) referred as unsolicited bulk calls sent via VoIP networks by botnets, is expected to become a serious threat in the near future. Audio CAPTCHA (Completely Automated Public Turing test to tell Computers and Human Apart) mechanism were introduced and employed as a security measure to distinguish automated software agents from human beings. The scope of this paper is to present the security economics frame and to have an in-depth review of the related economic models of SPAM and its analogies with SPIT.

show abstract

Economic Security Metrics

Cited by 41 publications

References 19 publications

The Price of Uncertainty in Security Games

The Price of Uncertainty in Security Games

Economic assessment of externalities for interactive audio media anti-SPIT protection of internet services

Economic Evaluation of Interactive Audio Media for Securing Internet Services

Contact Info

Product

Resources

About