Cybersecurity in the perspective of Internet traffic growth

Kox, Henk L.M. (2013): Cybersecurity in the perspective of Internet traffic growth.

Abstract

Private and public concern about digital security, cybercrime and data privacy is growing the last few years. If Internet-related markets are flexible enough to cope with security concerns, given time, one would expect that - per unit of Internet traffic - the number and costs of cybersecurity incidents fall over time. This paper is a first attempt to assess empirically whether overall Internet traffic growth has grown faster than the number of cybersecurity incidents. The conclusion is that, overall, the Internet has over time has become a safer place when measured by the number of security incidents per unit of transmitted data. The implication is that the current surge in reported cyberincidents is primarily driven by the growth in scale and pervasiveness of Internet communication exchange. There are a number of caveats that should be taken into account, but for this more consistent and reliable cybersecurity statistics would be required than are available at present.

• Item Type: MPRA Paper
• Language: English
• Keywords: Internet traffic, cybersecurity, time trend safety Internet
• Subjects: L - Industrial Organization > L8 - Industry Studies: Services > L86 - Information and Internet Services ; Computer Software; L - Industrial Organization > L9 - Industry Studies: Transportation and Utilities > L96 - Telecommunications; N - Economic History > N7 - Transport, Trade, Energy, Technology, and Other Services

References

Anderson, R., R. Böhme, R. Clayton and T. Moore, 2008, Security economics and the Internal Market, report commissioned by European Network and Information Security Agency (ENISA), Heraklion.

Anderson, R. and T. Moore, 2006, The economics of information security, Science, 27 (314), 610-613.

APWG, 2008-2012, Global Phishing Survey - Trends and Domain Name Use (twice per year), APWG, Internet Policy Committee, Lexington MA.

Ash, T.G., 2013, If Big Brother came back he’d be a public-private partnership, The Guardian, 27 June 2013.

Bauer, J. and M. Van Eeten, 2009, Cybersecurity: stakeholder incentives, externalities and policy options, Telecommunications Policy, 33, 706-719.

Berthold, S., R. Böhme, and S. Köpsell, 2009, Data retention and anonymity services, In: V. Matyas et al. (eds.), The Future of Identity in the Information Society, Springer, Boston, 92–106.

Black, P., K. Scarfone and M. Souppaya, 2008, Cybersecurity metrics and measures, in J. Voeller (ed.), Handbook of Science and Technology for Homeland Security, John Wiley and Sons, London.

Böhme, R. and R. Köpsell, 2010, Trained to Accept? A Field Experiment on Consent Dialogs, paper presented at CHI 2010 (April 10-15, 2010, Atlanta, Georgia, USA), (http://dmrussell.net/CHI2010/docs/p2403.pdf).

CAIDA, 2011, Annual report for 2011, Cooperative Association for Internet Data Analysis, University of California, Supercomputer Centre (http://www.caida.org/home/about/annualreports/2011/#topology).

Chee, F., N. Taylor and S. de Castell, 2012, Re-Mediating Research Ethics: End-User License Agreements in Online Games, Bulletin of Science Technology Society, 32 (6), 497-506.

Cisco, 2012, Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update, 2011–2016, White Paper, www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.pdf.

Dean, D., S. DiGrande, D. Field, A. Lundmark, J. O'Day, J. Pineda and P. Zwillenberg, 2012, The Internet Economy in the G-20: The $4.2 Trillion Growth Opportunity, Boston Consulting Group.

EC, 2013a, Cybersecurity strategy of the European Union: an open, safe and secure cyberspace, Joint Communication to the European Parliament and the Council, JOIN(2013)1Final, European Commission, Brussels.

EC, 2013b, Proposal for a Directive concerning measures to ensure a high common level of network and information security, COM(2013)48final, Brussels.

EC, 2013c, Impact assessment, Commission staff working paper accompanying the Proposal for a Directive concerning measures to ensure a high common level of network and information security, SWD(2013)32final, Brussels.

EC, 2012c, Cybersecurity, Special Eurobarometer #390, TNS Opinion and Social, at the request of European Commission DG Home Affairs, coordinated by DG COMM, Brussels.

ENISA, 2013, Threat landscape: responding to the evolving threat environment, European Network and Information Security Agency, Heraklion.

ENISA, 2012, Economics of security: facing the challenges - a multidisciplinary assessment, European Network and Information Security Agency, Heraklion.

ENISA, 2012a, Cyber incident reporting in the EU: an overview of security articles in EU legislation, European Network and Information Security Agency, Heraklion.

ENISA, 2010, Measurement frameworks and metrics for resilient networks and services: challenges and recommendations, European Network and Information Security Agency, Heraklion.

Frei, S., B. Plattner, and B. Tramell, 2010, Modelling the Security Ecosystem - The Dynamics of (In)Security, paper presented at WEIS 2010 conference, ETH Zürich (http://www.techzoom.net/security-ecosystem).

Frei. S., 2009, Security econometrics: the dynamics of (in)security, PhD dissertation, ETH, Zürich.

GOVCERT.NL, 2011, Cybersecuritybeeld Nederland 2011, Ministerie van Veiligheid en Justitie, Den Haag.

Graham-Rowe, D., 2007, Mapping the Internet, MIT Technology Review, 19 June, (http://www.technologyreview.com/news/408104/mapping-the-Internet/), accessed April 09, 2013..

Heninger, N., Z. Durumeric, E. Wustrow and J. Halderman, 2012, Mining your Ps and Qs: detection of widespread weak keys in network devices, Proc. 21st USENIX Security Symposium, Aug. 2012 ()

Kosinski, M., D. Stillwell and T. Graepel, 2013, Private traits and attributes are predictable from digital records of human behavior, Proceedings of the National Academy of Sciences of the United States of America, (published online before print, March 11, 2013: doi: 10.1073/pnas.1218772110 ).

Kox, H. (2013), Analysing the effect of cybersecurity with a gravity model of Internet traffic, MPRA Paper, Munich (forthcoming).

Krishnamuthy, B., K. Naryshkin and C. Wills, 2011, Privacy leakage vs. Protection measures: the growing disconnect, paper Web 2.0 Security & Privacy conference 2011, held in conjunction with the 2011 IEEE Symposium on Security and Privacy (http://w2spconf.com/2011/papers/privacyVsProtection.pdf).

Lehr, W., 2012, Mobile Broadband and Metrics Challenges, presentation at 3rd Workshop on Internet Economics (WIE 2012, 12-13th December, UCL, San Diego), MIT, Cambridge MA.

Liebenau, J., S. Elaluf-Calderwood, 2012, Understanding the measuring and characteristics of quantitative data on Internet traffic, presentation at CAIDAWorkshop (12-13th December, UCL, San Diego), LSE, London.

Microsoft, 2012, Microsoft Security Intelligence Report: worldwide threat assessment, volume 13: January through June 2012, Microsoft Corporation.

Moore, T, and R. Anderson, 2011, Economics and Internet security: a survey of recent analytical, empirical and behavioural research, WP TR-03-11, Computer Science Group, Harvard University, Cambridge MA.

Moore, T., R. Clayton and R. Anderson, 2009, The economics of online crime, Journal of Economic Perspectives, 23(3), 3-20.

Motiwala, M. A. Dhamdere, N. Feamster and A. Lakhina, 2012, Towards a cost model for network traffic, Cooperative Association for Internet Data Analysis, University of California, Supercomputer Centre (http://gtnoise.net/papers/2012/motiwala:ccr2012.pdf).

NCSC, 2012, Cybersecuritybeeld Nederland2012, Nationaal Cyber Security Centrum, Den Haag.

Odlyzko, A., 2012, On the classification and the value of communications, presentation at 3rd Interdisciplinary Workshop on Internet Economics (University of California San Diego, La Jolle), School of Mathematics / Digital Technology Center, University of Minnesota.

Odlyzko, A., 2004, Internet traffic growth: sources and implications, mimeo, University of Minnesota, Minneapolis, MN.

OECD, 2012, Proactive policy measures by Internet service providers against botnets, OECD Digital Economy Papers #199, OECD, Paris.

OECD, 2011, National strategies and policies for digital identity management in OECD countries, DSTI/ICCP/REG(2010)3/FINAL, DSTI, Working Party on Information Security and Privacy, Paris.

OECD, 2008, Malicious software (malware): a security threat to the Internet economy, DSTI/ICCP/REG (2007)5/Final, OECD, Paris

Prince, M., 2013, The DDoS That Almost Broke the Internet, CloudFlare blog, March 27, 2013 (http://blog.cloudflare.com/the-ddos-that-almost-broke-the-Internet).

Rasmussen. R and G. Aaron, 2012, Global Phishing Survey: Trends and Domain Name Use 1H2012, APWG, Lexington MA.

Rao, J. and D. Reily, 2012, The economics of spam, Journal of Economic Perspectives, 26(3), 87-110.

Rogers, M. and D. Ruppersberger, 2012, Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE, U.S. House of Representatives, 112th Congress, Washington DC.

Security.nl, 2012, Onderzoeker vindt 23 SCADA-lekken in 4 uur, October 28, 2012 (https://www.security.nl/artikel/44099/1/Onderzoeker_vindt_23_SCADA-lekken_in_4_uur.html).

Symantec, 2007, Symantec Internet Security Threat Report - Trends for July–December 06, Vol. XI, Symantec. (http://eval.symantec.com/mktginfo/enterprise/white_papers/ent-whitepaper_Internet_security_threat_report_xi_03_2007.en-us.pdf)

Symantec, 2012, Internet Security Threat Report: 2011 Trends- main report, Vol. 17, Symantec Inc., Mountain View, Calif. (http://www.symantec.com/content/en/us/enterprise/other_resources/bistr_main_report_2011_21239364.en-us.pdf)

US Department of Commerce, 2011, Cybersecurity, innovation and the Internet economy, The Department Of Commerce Internet Policy Task Force, Washington DC.

Van Eeten, M. and J. Bauer, 2008, Economics of malware: security decisions, incentives and externalities, STI Working Paper DSTI/DOC(2008)1, OECD, Paris.

Verizon, 2008, 2008 Data Breach Investigations: A comparison of risk factors among the finance, food, retail, and tech industries - supplementary report, Verizon Business Risk Team, http://www.verizonenterprise.com/resources/whitepapers/wp_supplemental-report-specifics-for-the-financial-services-food-beverage-retail-and-tech-services-industries_en_xg.pdf).

Verizon, 2010, 2010 Data Breach Investigations Report: study conducted by the Verizon RISK Team in cooperation with the United States Secret Service, (http://www.verizonenterprise.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf).

Verizon, 2011, 2011 Data Breach Investigations Report (DBIR): study conducted by the Verizon RISK Team with cooperation from the U.S. Secret Service and the Dutch High Tech Crime Unit, (http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2011_en_xg.pdf).

Verizon, 2012, 2012 Data Breach Investigations Report (DBIR): study conducted by the Verizon RISK Team with cooperation from the Australian Federal Police, Dutch National High Tech Crime Unit, Irish Reporting and Information Security Service, Police Central e-Crime Unit, and United States Secret Service, (http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf?__ct_return=1).

Weller, D. and B. Woodcock, 2013, Internet traffic exchange: market developments and policy challenges, DSTI/ICCP/CISP(2011)2/Final, OECD, Paris.