The DOI matches its Crossref record; 8 of the 8 references it cites were found in a registry or an index.
Why information security is hard - an economic perspective
Abstract
According to one common view, information security comes down to technical measures. Given better access control policy models, formal proofs of cryptographic protocols, approved firewalls, better ways of detecting intrusions and malicious code, and better tools for system evaluation and assurance, the problems can be solved. The author puts forward a contrary view: information insecurity is at least as much due to perverse incentives. Many of the problems can be explained more clearly and convincingly using the language of microeconomics: network externalities, asymmetric information, moral hazard, adverse selection, liability dumping and the tragedy of the commons.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The Market for "Lemons": Quality Uncertainty and the Market Mechanism
Akerlof, G. A. (1970) · The Quarterly Journal of Economics · doi:10.2307/1879431 · Cited by 23,016
Intermediate microeconomics : A modern approach
Varian, H. R. (2006) · Cited by 2,271
A field study of the software design process for large systems
Curtis, B., Krasner, H., & Iscoe, N. (1988) · Communications of the ACM · doi:10.1145/50087.50089 · Cited by 2,076
Computer Security Technology Planning Study
Anderson, J. P. (1972) · Cited by 660
Anderson, R. (1994) · Communications of the ACM · doi:10.1145/188280.188291 · Cited by 358
Self-citationSecurity Engineering: A Guide to Building Dependable Distributed Systems
Anderson, R. (2020) · doi:10.1002/9781119644682 · Cited by 345
Self-citationRisks of the Passport single signon protocol
Kormann, D. P., & Rubin, A. D. (2000) · Computer Networks · doi:10.1016/s1389-1286(00)00048-7 · Cited by 171
Compliance defects in public-key cryptography
Davis, D. D. (1996) · Cited by 54
Cited by
So long, and no thanks for the externalities: the rational rejection of security advice by users
Herley, C. (2009) · Proceedings of the 2009 workshop on New security paradigms workshop · doi:10.1145/1719030.1719050 · Cited by 524
The Economic Incentives for Sharing Security Information
Gal-Or, E., & Ghose, A. (2005) · Information Systems Research · doi:10.1287/isre.1050.0053 · Cited by 417
Quantified security is a weak hypothesis: a critical survey of results and assumptions
Verendel, V. (2009) · Proceedings of the 2009 workshop on New security paradigms workshop · doi:10.1145/1719030.1719036 · Cited by 180
Metadata
- Authors
- Anderson, R.
- Venue
- Seventeenth Annual Computer Security Applications Conference
- Publisher
- IEEE Comput. Soc
- Published
- 2005-08-24
- Pages
- 358-365
- OpenAlex
- W1483280370
- Cited by
- 830
- References
- 8
- FWCI
- 46.63
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Why information security is hard - an economic perspective. https://app.cochat.ai/papers/10.1109/acsac.2001.991552
- The paper
- Anderson, R. (2005). Why information security is hard - an economic perspective. Seventeenth Annual Computer Security Applications Conference. https://doi.org/10.1109/acsac.2001.991552
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
