Skip to main content

of-lexus-lanes-and-safety-spikes-tm

Posted by: admin 15 years, 11 months ago

and information security.

I just finished reading the Undercover Economist by Tim Hartford. Great Read. He has a chapter on externality charges. While he doesn't use the term, he's talking about Lexus Lanes - toll lanes that charge a fee for access - think a paid HOV lane.

The Safety Spike (TM) is my interpretation of the economic idea of removing a moral hazzard. Economists might argue the safety belts and airbags increase the likelihood of accidents. Indeed, accidents have increased - but fatalities have not. To reduce accidents, an economist suggested installing a sharp spike in the steering column pointed at the driver. (The Safety Spike is my term for it - trademark is pending once I get around to filing it.)

I was hoping to apply these ideas to information security, in particular vis-a-vis the externalities of unpatched servers and desktop PCs on the Internet and online banking. Some pundits have suggested making the banks responsible for online fraud. If we do that, what incentive do users have to buy anti-spyware? Attackers are already using SSL-session hijackers. While transaction authentication could potentially solve this, a better solution for spyware exists, it's called anti-spyware. People just need to be incented to use it.

Could you create a Lexus Lane for users that have anti-spyware? Maybe. The problem is that you can't trust the user's PC. How about this: the anti-spyware company sends the bank a history of user's updates with some type of trust score based on how long the user has been a customer and how frequent the user updates. I would suggest that the user gets a discount on the anti-spyware software to ease the cost. I would think that an anti-spyware company would jump at that.

In general, I think the Lexus Lane is preferable to spreading the liability across all the banking customers, which is what making the banks liable would do. Users that don't have third-party validated security should be charged for banking online.

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom