Action, Inaction, Trust, and Cybersecurity's Common Property Problem

K. Elliott, F. Massacci, J. Williams

Research output: Contribution to JournalArticleAcademicpeer-review


© 2016 IEEE.Cybersecurity tends to be viewed as a highly dynamic, continually evolving technology race between attacker and defender. However, economic theory suggests that in many cases doing 'nothing' is the optimal strategy when substantial fixed adjustment costs are present. Indeed, the authors' anecdotal experience as chief information security officers indicates that uncertain costs that might be incurred by rapid adoption of security updates substantially delay the application of recommended security controls, so the industry does appear to understand this economic aspect quite well. From a policy perspective, the inherently discontinuous adjustment path taken by firms can cause difficulties in determining the most effective public policy remit and the effectiveness of any enacted policies ex post. This article summarizes this type of policy issue in relation to the contemporary cybersecurity agenda.
Original languageEnglish
Pages (from-to)82-86
JournalIEEE Security and Privacy
Issue number1
Publication statusPublished - 1 Jan 2016
Externally publishedYes


Dive into the research topics of 'Action, Inaction, Trust, and Cybersecurity's Common Property Problem'. Together they form a unique fingerprint.

Cite this