The WiKID Blog

Viewing posts tagged Security and Economics

infosec-and-the-affect-heuristic

Posted by: admin 15 years, 3 months ago

Perhaps there is a lesson for infosec professionals in this post on the Affect heuristic on Overcoming Bias:

Suppose an airport must decide whether to spend money to purchase some new equipment, while critics argue that the money should be spent on other aspects of airport safety. Slovic et. al. (2002) presented two groups of subjects with the arguments for and against purchasing the equipment, with a response scale ranging from 0 (would not support at all) to 20 (very strong support). One group saw the measure described as saving 150 lives. The other group saw the measure described as saving 98% of 150 lives. The hypothesis motivating the experiment was that saving 150 lives sounds vaguely good - is that a lot? a little? - while saving 98% of something is clearly very good because 98% is so close to the upper bound of the percentage scale. Lo and behold, saving 150 lives had mean support of 10.4, while saving 98% of 150 lives had mean support of 13.6.

The post also shows that people tend to over-estimate the value of going with known brands, even though they might not add any extra value:

Ganzach (2001) found the same effect in the realm of finance. According to ordinary economic theory, return and risk should correlate positively - or to put it another way, people pay a premium price for safe investments, which lowers the return; stocks deliver higher returns than bonds, but have correspondingly greater risk. When judging familiar stocks, analysts' judgments of risks and returns were positively correlated, as conventionally predicted. But when judging unfamiliar stocks, analysts tended to judge the stocks as if they were generally good or generally bad - low risk and high returns, or high risk and low returns.

But perhaps you don't have time to consider all this, because you've got a deadline!

Finucane et. al. also found that time pressure greatly increased the inverse relationship between perceived risk and perceived benefit, consistent with the general finding that time pressure, poor information, or distraction all increase the dominance of perceptual heuristics over analytic deliberation.

computer-crime-and-security-survey-shows-increase

Posted by: admin 15 years, 3 months ago

The annual CSI survey is (almost) out and it shows a big increase in reported costs. Companies reported average annual losses of $350,424 in the past year, up sharply from the $168,000 they reported the previous year.

banking-group-sues-tjx

Posted by: admin 15 years, 3 months ago

In an interesting development in the economics of information security and data breaches, a group of banks is suing TJX for "negligent misrepresentation". According to Massachusetts Bankers Association CEO Daniel Forte:

"Banks all across the nation re-issued debit cards as a result of the TJX data breach. Preliminary estimates of the costs vary from institution to institution, up to $25 dollars per card," MBA officials said in a statement. "This alone would run into many millions of dollars for banks throughout the country. Moreover, when fraud occurs, banks generally cover the entire fraud, replacing money in customer accounts to protect their customers."

The banks, which once owned Visa, the creator of the PCI data security standards, now recognize that there costs are an externality in that system. The tort system is a pretty good system for dealing with externalities. Unfortunately for those who like to have real data on these matters, if the case is settled out of court, we probably won't know how much it actually costs TJX. I continue to believe it will not affect their brand or sales , but it will hurt their stock price as would any expenses that do not generate revenue.

punishment-and-security

Posted by: admin 15 years, 3 months ago

There is a very article in the NY Times about how groups can profit by punishing members, in particular, by punishing free riders.

In the experiment, investigators at the University of Erfurt in Germany enrolled 84 students in the investment game and gave them 20 tokens apiece to start. In each round of the game, every participant decided whether to hold on to the tokens or invest some of them in a fund whose guaranteed profit was distributed equally among all members of the group, including the "free riders" who sat on their money. Because the profit was determined by a multiple of the tokens invested, each participant who contributed to the fund enjoyed less of a return than if the free riders had done so as well.

assessing-brand-damage

Posted by: admin 15 years, 3 months ago

Tim Erlin started a discussion about brand damage. However, the data he used was really about stock prices, not "brand", which is much harder to quanitify (and it's not easy to qauntify the affects of breach on stock price).

• Page 9 of 20
• ←
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• →