Working Group on Economics of Security

Scope and objectives of the ENISA ad hoc Working Group on Economics of Security

The objective of this work is to highlight in a tangible manner the importance of economic aspects of security in different areas of businesses. Moreover, the Working Group aims to validate, analyse and prioritise the key issues in each identified topic.

Given the fact that the members of the Working Group will transfer knowledge to ENISA, we would like to maintain flexibility in terms of content to be inputted. This is in order to encompass various relevant areas of Economics of Security that will emerge in the course of the WG’s work from the Stakeholders represented within its members. Should an area or topic emerge through the work of the Working Group, it will be considered within the list of potential topics. Through a subsequent prioritisation, we will strive for the identification of the most important areas. In the following years, ENISA is going to invest available resources in processing these priorities.

Moreover, the Working Group will support ENISA by providing suitable tools for optimisation of the decision making process, while at the same time making better use of the available knowledge within future ENISA work. This may be achieved by forming a steering committee and a list of experts to be engaged in future ENISA work, beyond the current Working Group appointment.

Members of the ENISA Working Group on Economics of Security are (in alphabetic order):

Eyal Adar, White Cyber Knight Inc., Bnei-Brak, Israel

Fabio Bisogni, Fondazione FORMIT, Rome, Italy

Rainer Böhme, Westfälische Wilhelms-Universität Münster, Germany

Tilman Brück, German Institute for Economic Research (DIW Berlin), Berlin, Germany

Simona Cavallini, Fondazione FORMIT, Rome, Italy

Nicolas Christin, Carnegie Mellon University, Pittsburgh, PA, USA

Jens Grossklags, The Pennsylvania State University, USA

Christoph Janello, Ludwig-Maximilians-University Munich, Munich School of Management, Institute for Information, Organization, and Management, Munich, Germany

Johann Kranz, Ludwig-Maximilians-University Munich, Munich
School of Management, Institute for Information, Organization, and Management, Munich, Germany

Thomas Nowey, Krones AG, Neutraubling, Germany

Arnold Picot, Ludwig-Maximilians-University Munich, Munich
School of Management, Institute for Information, Organization, and Management, Munich, Germany

David Pym, University of Aberdeen, Scotland, UK

Michael Rath, Luther Rechtsanwaltsgesellschaft mbH, Köln, Germany

Ralf Schneider, TÜV Informationstechnik GmbH, Essen, Germany

Rahul Telang, Carnegie Mellon University, Pittsburgh, PA, USA

Jeremy Ward,  HP Enterprise Security Services, UK

Method

On the basis of the contributions received at the open consultation, certain topics emerged as the most popular/interesting (see 9 topics mentioned above). Each one of these topics will be assigned to one member of the Working Group for further analysis. In case that the WG members are more than the initial list of topics, more than one experts might work on the same topic. 3

The list of topics to be addressed will be communicated to the Working Group and each member will select the topic that is most relevant to his/her background or area of interest. The assignment of the topics will be done on a first-come-first-served basis.

After having concluded the first part of the work whereby the main ideas of the analysis have become apparent, each participant will submit to the group a draft executive summary on the selected topic. A couple of weeks later, ENISA will organise a workgroup meeting in order for the authors to receive feedback and supplementing ideas by the rest of the group. Such feedback may be taken into account in the finalisation of the document.

The executive summary is expected to be one page long while the finalised document that will be submitted would be no more than 5 pages long.

The finalised contributions of the participants will be compiled by ENISA into a single document with different chapters, bearing the names of the participants. Subsequently, the document will be published by ENISA and the deliverable may be presented in a meeting organised by ENISA, probably in Brussels.

Tasks

Tasks to be carried out by the participants of the WG are:

1. To select a working topic from the list of the top issues identified.

2. To perform a stock taking of the existing work in the respective topic. This activity will be based mainly on literature research. This is to present a concise analysis of the selected topic as well as the latest developments in this area. A list of bibliography references should also be included in the final report. Moreover part of this task is to identify keywords of the subject at hand, aiming to achieve cross-topic synergies among the examined topics but also other scientific areas (e.g. NIS, economics, social issues, business issues, etc.). For this purpose, ENISA is going to distribute a glossary of terms in the area of NIS and in the area of Economics to be used as first pool of possible keywords. Additional keywords will be proposed/identified by the members of the Working Group as deemed necessary.

3. To identify areas of applicability as a result of the analysis made in the previous task. Such applicability should be assessed vis-à-vis the EU Regulatory Framework/ Policies/ Directives/ Research etc.

4. To prepare a mapping between relevant stakeholder groups identified and the respective topic.

5. To identify issues within the processed topic that require a further analysis (e.g. subject of further research, deployment, etc.) but also issues that have a good maturity and could be better disseminated. The identified issues per processed topic will be used as a basis for the generation the final list of topics, possible groupings and proposals for future work in the area of Economics of Security.

The final deliverable of the Working Group can be found here.