View source for An Introduction to Key Themes in the Economics of Cyber Security

==Full Title of Reference==
An Introduction to Key Themes in the Economics of Cyber Security

==Full Citation==

Neil Gandal, "An Introduction to Key Themes in the Economics of Cybersecurity," in ''Cyber Warfare and Cyber Terrorism'' (IGI Global eds., 2008). [http://www.tau.ac.il/~gandal/security%20encyclopedia%20entry.pdf ''Web'']

[http://cyber.law.harvard.edu/cybersecurity/Special:Bibliography?f=wikibiblio.bib&title=Special%3ABibliography&view=&action=&keyword=Gandal%3A2008 ''BibTeX'']
[http://www.worldcat.org/title/cyber-warfare-and-cyber-terrorism/oclc/77520608&referer=brief_results ''WorldCat'']
[http://books.google.com/books?q=An+Introduction+to+Key+Themes+in+the+Economics+of+Cybersecurity ''Google Books'']
[http://www.amazon.com/Cyber-Warfare-Terrorism-Premier-Reference/dp/1591409918#reader_1591409918 ''Amazon'']

==Categorization==

* Issues: [[Economics of Cybersecurity]]; [[Incentives]]

* Approaches: [[Technology]]

==Key Words== 
[[Keyword_Index_and_Glossary_of_Core_Ideas#Botnet | Botnet]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Computer_Network_Attack | Computer Network Attack]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Crimeware | Crimeware]],
[[Keyword_Index_and_Glossary_of_Core_Ideas#Cyber_Security_as_an_Externality | Cyber Security as an Externality]]

==Synopsis==

Software security is an important concern for vendors, consumers, and regulators since attackers who exploit vulnerabilities can cause significant damage. In this brief paper, I discuss key themes in the budding literature on the economics of cyber-security. My primary focus is on how economics incentives affect the major issues and themes in information security. Two important themes relevant for the economics of cyber security issues are (i) a security externality and (ii) a network effect that arises in the case of computer software. A nascent economics literature has begun to examine the interaction between vulnerability disclosure, patching, product prices and profits.

Two fundamentals of cybersecurity economics addressed here are that of "security externality" and "network effect."

*Security Externality: 

Unprotected computers are vulnerable to being used by hackers to attack other 
computers.  There is a lack of incentive for each user in the system to adequately protect 
against viruses in his system, since the cost of the spread of the virus is borne by others.  
That is, computer security is characterized by a positive “externality.” If I take more 
precautions to protect my computer, I enhance the security of other users as well as my 
own.  Such settings lead to a classic free-rider problem.  In the absence of a market for 
security, individuals will choose less security than the social optimal.  

*Network Effects:

A network effect arises in computer software.  The benefits of computer software 
typically depend on the number of consumers who purchase licenses to the same or 
compatible software.  A direct network effect exists when increases in the number of 
consumers on the network raise the value of the good or service for everyone on the 
network. The most common examples are communication networks such as telephone 
and email networks. 
 
Network effects are typically thought to benefit consumers and firms that have coalesced 
around a standard.  However, network effects may contribute to security problems.   
Large networks are more vulnerable to security breaches, precisely because of the 
success of the network.  In part because of its large installed base, Microsoft’s Internet 
Explorer is likely more vulnerable to attack than the Mosaic’s “Firefox” Browser.

==Additional Notes and Highlights==
Expertise Required: Economics - Low