Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls

Craig Wright; Tanveer Zia

Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls

Craig Wright, Tanveer Zia

Research output: Book chapter/Published conference paper › Conference paper › peer-review

1 Citation (Scopus)

112 Downloads (Pure)

Abstract

As with all aspects of business and the economy, information security is an economic function. Security can be modeled as a maintenance or insurance cost as a relative function but never in absolute terms. As such, security can be seen as a cost function that leads to the prevention of loss, but not one that can create gains (or profit). With the role of a capital investment to provide a return on investment, security is a defense against unforeseen losses that cost capital and reduce profitability. In this paper we assess the individual security cost and model our assessment in economic terms. This assessment is vital in determining the cost benefit in applying costly security controls in our systems in general and software in particular.

Original language	English
Title of host publication	Computational Intelligence in Security for Information Systems
Subtitle of host publication	Proceedings of the 4th International Conference, CISIS 2011
Editors	Ãlvaro Herrero, Emilio Corchado
Place of Publication	Germany
Publisher	Springer
Pages	206-213
Number of pages	8
Volume	6694
ISBN (Electronic)	9783642213236
ISBN (Print)	9783642213229
Publication status	Published - 2011
Event	4th International Conference on Computational Intelligence in Security for Information Systems: CISIS 2011 - Hotel Melia Costa del Sol, Torremolinos, Málaga, Spain Duration: 08 Jun 2011 → 10 Jun 2011 http://www.springer.com/gp/book/9783642213229 (Conference proceedings ) https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml (Conference website)

Publication series

Name	Security and Cryptology
Publisher	Springer
ISSN (Print)	0302-9743

Conference

Conference	4th International Conference on Computational Intelligence in Security for Information Systems
Country/Territory	Spain
City	Torremolinos, Málaga
Period	08/06/11 → 10/06/11
Other	CISIS aims to offer a meeting opportunity for academic and industry-related researchers belonging to the various, vast communities of Computational Intelligence, Information Security, and Data Mining. The need for intelligent, flexible behaviour by large, complex systems, especially in mission-critical domains, is intended to be the catalyst and the aggregation stimulus for the overall event.
Internet address	http://www.springer.com/gp/book/9783642213229 (Conference proceedings ) https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml (Conference website)

Access to Document

CISIS 2011_2 Final Published.pdfAccepted author manuscript, 149 KB

Cite this

Wright, Craig ; Zia, Tanveer. / Rationally Opting for the Insecure Alternative : Negative Externalities and the Selection of Security Controls. Computational Intelligence in Security for Information Systems: Proceedings of the 4th International Conference, CISIS 2011. editor / Ãlvaro Herrero ; Emilio Corchado. Vol. 6694 Germany : Springer, 2011. pp. 206-213 (Security and Cryptology).

@inproceedings{614e166af0514bd0a248a1f86eb32c5e,

title = "Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls",

abstract = "As with all aspects of business and the economy, information security is an economic function. Security can be modeled as a maintenance or insurance cost as a relative function but never in absolute terms. As such, security can be seen as a cost function that leads to the prevention of loss, but not one that can create gains (or profit). With the role of a capital investment to provide a return on investment, security is a defense against unforeseen losses that cost capital and reduce profitability. In this paper we assess the individual security cost and model our assessment in economic terms. This assessment is vital in determining the cost benefit in applying costly security controls in our systems in general and software in particular.",

keywords = "Open access version available, Empirical studies, Model Checking, Software Development Life Cycle, Software Verification",

author = "Craig Wright and Tanveer Zia",

note = "Imported on 03 May 2017 - DigiTool details were: publisher = Germany: Springer, 2011. editor/s (773b) = Herrero, {\~A}lvaro and Corchado, Emilio; Event dates (773o) = 8-10 June 2011; Parent title (773t) = Computational Intelligence in Security for Information Systems. ISSNs: 0302-9743; ; 4th International Conference on Computational Intelligence in Security for Information Systems : CISIS 2011 ; Conference date: 08-06-2011 Through 10-06-2011",

year = "2011",

language = "English",

isbn = "9783642213229",

volume = "6694",

series = "Security and Cryptology",

publisher = "Springer",

pages = "206--213",

editor = "{\~A}lvaro Herrero and Emilio Corchado",

booktitle = "Computational Intelligence in Security for Information Systems",

address = "United States",

url = "http://www.springer.com/gp/book/9783642213229, https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml",

}

Wright, C & Zia, T 2011, Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls. in Ã Herrero & E Corchado (eds), Computational Intelligence in Security for Information Systems: Proceedings of the 4th International Conference, CISIS 2011. vol. 6694, Security and Cryptology, Springer, Germany, pp. 206-213, 4th International Conference on Computational Intelligence in Security for Information Systems, Torremolinos, Málaga, Spain, 08/06/11.

Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls. / Wright, Craig; Zia, Tanveer.
Computational Intelligence in Security for Information Systems: Proceedings of the 4th International Conference, CISIS 2011. ed. / Ãlvaro Herrero; Emilio Corchado. Vol. 6694 Germany: Springer, 2011. p. 206-213 (Security and Cryptology).

Research output: Book chapter/Published conference paper › Conference paper › peer-review

TY - GEN

T1 - Rationally Opting for the Insecure Alternative

T2 - 4th International Conference on Computational Intelligence in Security for Information Systems

AU - Wright, Craig

AU - Zia, Tanveer

N1 - Imported on 03 May 2017 - DigiTool details were: publisher = Germany: Springer, 2011. editor/s (773b) = Herrero, Ãlvaro and Corchado, Emilio; Event dates (773o) = 8-10 June 2011; Parent title (773t) = Computational Intelligence in Security for Information Systems. ISSNs: 0302-9743;

PY - 2011

Y1 - 2011

N2 - As with all aspects of business and the economy, information security is an economic function. Security can be modeled as a maintenance or insurance cost as a relative function but never in absolute terms. As such, security can be seen as a cost function that leads to the prevention of loss, but not one that can create gains (or profit). With the role of a capital investment to provide a return on investment, security is a defense against unforeseen losses that cost capital and reduce profitability. In this paper we assess the individual security cost and model our assessment in economic terms. This assessment is vital in determining the cost benefit in applying costly security controls in our systems in general and software in particular.

AB - As with all aspects of business and the economy, information security is an economic function. Security can be modeled as a maintenance or insurance cost as a relative function but never in absolute terms. As such, security can be seen as a cost function that leads to the prevention of loss, but not one that can create gains (or profit). With the role of a capital investment to provide a return on investment, security is a defense against unforeseen losses that cost capital and reduce profitability. In this paper we assess the individual security cost and model our assessment in economic terms. This assessment is vital in determining the cost benefit in applying costly security controls in our systems in general and software in particular.

KW - Open access version available

KW - Empirical studies

KW - Model Checking

KW - Software Development Life Cycle

KW - Software Verification

M3 - Conference paper

SN - 9783642213229

VL - 6694

T3 - Security and Cryptology

SP - 206

EP - 213

BT - Computational Intelligence in Security for Information Systems

A2 - Herrero, Ãlvaro

A2 - Corchado, Emilio

PB - Springer

CY - Germany

Y2 - 8 June 2011 through 10 June 2011

ER -

Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this