Workshop on Economics and Information Security Held at Smith School

Professors Lawrence A. Gordon and Martin P. Loeb of the Smith Schools accounting and information assurance department presented some of their recent research on economic aspects of information security at the 2nd Annual Workshop on Economics and Information Security, held here at the Smith School on May 29-30, 2003. (The first workshop was held at the University of California, Berkeley in May 2002.)

The work presented by Gordon and Loeb (co-authored with William Lucyshyn from DARPA and Maryland's School of Public Affairs) addressed issues related to control of capital investments in information security. Also in attendance at the workshop were such well-known academicians as Hal Varian (University of California, Berkeley), Ross Anderson (Cambridge University), Michael Smith (Harvard University), Andrew Newman (Princeton University and University College London), Andrew Odlyzko (University of Minnesota) and Jean Camp (Harvard University). Guest speakers at the Workshop included John Manferdelli (senior Microsoft executive), Marianne Emmerson (Director of Information Technologies at the Federal Reserve Board) and Howard Frank, dean of the Smith School.

Later this month, Gordon and Loeb will receive a Certificate of Merit for another of their papers in the area of economic aspects of information security. Their award winning paper entitled Return on Information Security Investments: Myths vs. Realities was the cover story for the November 2002 issue of Strategic Finance. The Institute of Management Accountants (IMA) will present a Lybrand award to Gordon and Loeb at the IMAs annual meeting to be held in Nashville. The IMA is the leading professional organization devoted to issues related to management accounting and financial management. Gordon and Loeb's paper points out the weaknesses of using the traditional notion of return on investments for measuring the value of investments in information security. The paper ends up by pointing out that firms would be better served if they pursued an optimal level of information security investments in lieu of the return on such investments.