Chapter 7 Economics

《Chapter 7 Economics》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、CHAPTER7EconomicsThegreatfortunesoftheinformationagelieinthehandsofcompaniesthathaveestablishedproprietaryarchitecturesthatareusedbyalargeinstalledbaseoflocked-incustomers.—CarlShapiroandHalVarianTherearetwothingsIamsureofafteralltheseyears:thereisagrowingsocietalneedforhighass

2、urancesoftware,andmarketforcesarenevergoingtoprovideit.—EarlBoebertIfyoutrytobuckthemarkets,thenthemarketswillbuckyou.—MargaretThatcher7.1IntroductionTheeconomicsofinformationsecurityhasrecentlybecomeathrivingandfast-movingdiscipline.Westartedtorealiseroundabout2000thatmanysecu

3、ritysystemfailureswerentduetotechnicalerrorssomuchastowrongincentives:theclassiccaseiswherethepeoplewhoguardasystemarenotthepeoplewhosufferwhenitfails.Indeed,securitymechanismsareoftendesignedquitedeliberatelytoshiftliability,whichoftenleadstotrouble.Economicshasalwaysbeenimpor

4、tanttoengineering,attherawlevelofcostaccounting;agoodengineerwasonewhocouldbuildabridgesafelywithathousandtonsofconcretewheneveryoneelseusedtwothousandtons.Buttheperverseincentivesthatariseincomplexsystemswithmultipleownersmakeeconomicquestionsbothmoreimportantandmoresubtle2152

5、16Chapter7■Economicsforthesecurityengineer.Trulyglobal-scalesystemsliketheInternetarisefromtheactionsofmillionsofindependentprincipalswithdivergentinterests;wehopethatreasonableglobaloutcomeswillresultfromselfishlocalactions.Ingeneral,peoplewontdosomethingunlesstheyhaveanincenti

6、veto.Marketsareoftenthebestguidewehavetowhatsortofmechanismswork,orfail.Marketsalsofail;thecomputerindustryhasbeendoggedbymonopoliessinceitsearliestdays.Thereasonsforthisarenowunderstood,andtheirinteractionwithsecurityisstartingtobe.WhensomeoneasksWhyisMicrosoftsoftwareinsecure

7、?wecannowgiveaprincipledanswerratherthansimplycursingRedmondasaformofbadweather.Thenewfieldofsecurityeconomicsprovidesvaluableinsightsnotjustintosecuritytopicssuchasprivacy,bugs,spam,andphishing,butintomoregeneralareassuchassystemdependability.Forexample,whatstheoptimalbalanceof

8、effortbyprogrammersandtesters?(Fortheanswer,seesection