I research the economics of cybersecurity & privacy Cyber risk science at @SolveCyberRisk @EdinburghUni My own thoughts
Joined April 2011
- Tweets883
- Following784
- Followers790
- Likes836
I moved to <the other platform> and hope others will join.
@CDra_90n set up a "security economics" follower-pack so you can quickly build a network of WEIS-y people.
Contact one of us if you join <the other platform> and want to be added to the starter-pack.
Very proud of @CDra_90n who had his first article accepted at @IEEESSP.
The paper looks at the role of hacker teams in the Chinese bug bounty ecosystem.
We very sadly lost @rossjanderson mid way through this project.
computer.org/csdl/proceeding…
My favourite finding is that these teams function like labour unions in negotiating with large tech companies to receive fair bug bounty payouts.
This fighting for the little guy was very much @rossjanderson.
@CDra_90n also scraped a bunch of descriptive stats on team size, finding that the biggest teams have 500+ members.
Daniel Woods retweeted
The entire 3rd-edition of @rossjanderson's "Security Engineering" is available free as PDFs now!
cl.cam.ac.uk/archive/rja14/b…
Interested in pursuing an MSc in Cyber Security, Privacy and Trust, freshly certified by @NCSC?
Register for our virtual open day next week to hear more: informatics.ed.ac.uk/postgra…
@InfAtEd @EdinburghUni
Overview of the recent (lack of) progress towards establishing a software liability regime.
therecord.media/cybersecurit…
Daniel Woods retweeted
📅 Join us on 29 October for an online panel on the cyber insurance industry’s efforts to shape global cybersecurity governance. Find our more on our website.
🗣Speaker include: @josephinecwolff, @IelTop, and @tjohansmeyer.
my.rusi.org/events/webinar-d…
Daniel Woods retweeted
Learn to identify essential economic #investments for #cybersecurity & measure your results to make informed decisions. Our new course #Economics of Cybersecurity: Foundation and Measurement start Oct 2 online-learning.tudelft.nl/c…
I wanted to check in on this argument 18 months later.
This is motivated by discussions at DefCon about the progress towards creating a cyber insurance backstop: therecord.media/white-house-…
Ty @tomatospy for the prompt
Why a cyber insurance backstop is premature
tl;dr There's no evidence market conditions are restricting online economic activity (unlike post-9/11 which necessitated TRIA), and a backstop may reduce incentives for insureds to improve security
lawfareblog.com/federal-cybe…
And the backstop also introduces risks:
- Increase the supply of insurance, reducing the leverage insurers have to require security hygiene
- Increase the potential for moral hazard regarding catastrophe
- Harm innovation in cyber insurance linked securities
Daniel Woods retweeted
"Evidence-based cybersecurity policy? A meta-review of security control effectiveness" <- In case you missed, this is worth reading.
tandfonline.com/doi/full/10.…
Daniel Woods retweeted
Which security controls reduce cyber risk and by how much?
Until recently, vendors tried to answer with peacock like competition, e.g. ever fancier marketing campaigns.
A new article by @IelTop is a step towards answering with empirical evidence.
Open access link to the article: tandfonline.com/doi/full/10.…