<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Some stuff &#187; security dollars</title>
	<atom:link href="http://blog.yhuang.org/?feed=rss2&#038;tag=security-dollars" rel="self" type="application/rss+xml" />
	<link>https://blog.yhuang.org</link>
	<description>here.</description>
	<lastBuildDate>Wed, 27 Aug 2025 08:50:58 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1.1</generator>
		<item>
		<title>price of security</title>
		<link>https://blog.yhuang.org/?p=13</link>
		<comments>https://blog.yhuang.org/?p=13#comments</comments>
		<pubDate>Mon, 30 Oct 2006 20:46:14 +0000</pubDate>
		<dc:creator>admin</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[digression]]></category>
		<category><![CDATA[nice bike]]></category>
		<category><![CDATA[security dollars]]></category>
		<category><![CDATA[security problem]]></category>
		<category><![CDATA[target]]></category>

		<guid isPermaLink="false">http://scripts.mit.edu/~zong/wpress/?p=13</guid>
		<description><![CDATA[All this talk of &#8220;in real life, we accept managed insecurity&#8221; has got me thinking about the question of how much security is actually worth to people. People pay some &#8220;appropriate&#8221; amount for security by buying alarms, paying for antivirus software, buying locks and whatever. How much should be paid? Is there a model for [...]]]></description>
			<content:encoded><![CDATA[<p>All this talk of &#8220;in real life, we accept managed insecurity&#8221; has got me thinking about the question of how much security is actually worth to people. People pay some &#8220;appropriate&#8221; amount for security by buying alarms, paying for antivirus software, buying locks and whatever. How much should be paid? Is there a model for this behavior? Here is a not even half-baked look:</p>
<p>Suppose your thing is worth \(D\) dollars (to everyone, for simplicitiy) and the probability of it getting stolen/destroyed is \(p_0\). Let&#8217;s actually make \(p\) a function of how much you pay for security, so \(p(S)\). This function is, say, monotonically decreasing in \(S\) with \(p(0)=p_0\). Then the worth of \(S\) security dollars is \((p(0)-p(S))D\). I guess you should not pay for security when \(S>(p(0)-p(S))D\), and you should aim for \(S^*=\arg\max_S{(p(0)-p(S))D-S}\) when you should pay.</p>
<table align="right" width="100" border="1" cellpadding="10" style="margin: 2 2 2 2; background: #FFFFFF; border-collapse: collapse; border-style: dashed; border-color: #365873;">
<tr>
<td>
Another question altogether is how should security services be priced? They should probably be priced such that \((p(0)-p(S))D=S\), but are they? No idea.
</td>
</tr>
</table>
<p>So far so good. At this point, I&#8217;m taking a digression because I am reminded of my bicycle. It&#8217;s a piece of junk but I lock it. Next to a nice bike. Even better if the nice bike has a worse-looking lock &#8211; although that doesn&#8217;t happen usually. My bicycle never gets stolen. This happens with recommendations for securing computers, too. Often there is advice to hide unused ports, leave small footprint, make yourself less of a target, etc. As long as it takes less effort to get more from somewhere else, you are somewhat secure, although you really aren&#8217;t. So there is the idea of competitive influence in the security problem.</p>
<p>So let&#8217;s say your neighbor also has a thing worth \(D\) dollars and \(S&#8217;\) is thrown into security for it by your neighbor. Now if you don&#8217;t pay more than your neighbor for security, it&#8217;s like you haven&#8217;t paid at all. Define a new function \(p&#8217;(S)=p(0)\) for \(S\leq S&#8217;\) and \(p&#8217;(S)=p(S)\) for \(S>S&#8217;\). Then you should aim for \(\tilde{S}^*=\arg\max_S{(p(0)-p&#8217;(S))D-S}\) when it is nonnegative. Now it is really possible to lose no matter what. Although it is possible to have \(S^*=0\) as the solution previously, that would have been a result of particularly poor security service. This is different. Depending on what your neighbor does, you may have no way to get more security for your thing.</p>
<p>Of course, your neighbor would normally aim for the optimal point, as would you. So you both could try to outbid each other until you hit the next \(S\) larger than \(S^*\) where \((p(0)-p(S))D-S=0\). This would be the competitive equilibrium. But then what&#8217;s the point? Both of you could do just as well by not paying anything for security &#8211; like leaving all (equally nice) bikes unlocked. but that would be a cooperative equilibrium, which won&#8217;t happen in reality.</p>
<p>However, it isn&#8217;t that simple. If we think about how a security service is able to decrease the probability of a thing getting stolen/destroyed, we (or I) get a headache, so that&#8217;s it for now. This may be revisited.</p>
]]></content:encoded>
			<wfw:commentRss>https://blog.yhuang.org/?feed=rss2&#038;p=13</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
