Best Practices in IT Risk Management: Buying Safeguards, Designing Security Architecture, or Managing Information Risk?

by Richard L. Baskerville

Ross Anderson, noted professor of computer engineering in the Cambridge Computer Laboratory, explains "Why Information Security is Hard" in economic terms [1]. It isn't because we need better security technology or security models or cryptography. It is because there are perverse economic incentives. It is still a "guns or butter" decision. Why should owners of computing technology buy security technology instead of more functionality or other things altogether?

Password Protected Cutter Consortium clients, please log in:


This document is available to Cutter Consortium Resource Center clients only. Retrieve password.
If you would like further information about how to become a client, please contact us at +1 781 648 8700 or sales@cutter.com.
Best Practices in IT Risk Management: Buying Safeguards, Designing Security Architecture, or Managing Information Risk?Thu Dec 01 12:02:33 CST 2005