In the 10 years that Lawrence Gordon, Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance, has spent pondering the economic issues related to cybersecurity, the risks have changed significantly. Businesses and government agencies no longer have to worry about teen hackers taking a shot at their organizations for bragging rights. Instead, multinational corporations and government agencies are suffering cyber-attacks from organized crime, large-scale fraud, disgruntled employees and even terrorists.

Dr. Lawrence A. Gordon, Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance, gave testimony concerning his research (with Dr. Martin Loeb, professor of accounting and information assurance and Deloitte & Touche Faculty Fellow) on cybersecurity economics to the U.S. House of Representatives Subcommittee on Homeland Security on October 31, 2007. The Subcommittee is working on emerging threats, cybersecurity, and science and technology.

Research by Larry Gordon and Martin Loeb The Sarbanes-Oxley Act has caused an increase in the voluntary disclosure of firms’ information security activities.

Lawrence A. Gordon, Ernst & Young Alumni Professor of Managerial Accounting, and Martin Loeb, professor of accounting and information assurance and Deloitte & Touche Faculty Fellow, are pioneers in the economics and financial management of cybersecurity resources. A brief overview of recent key research is now being made available to Chinese scholars through a translation on Gordon's Web site. It is the pairs first foray to directly connect their counterparts in China with the results of their research.

The security of information is a fundamental concern to organizations operating in the modern digital economy. There are technical, behavioral, and organizational aspects related to this concern. There are also economic aspects of information security. One important economic aspect of information security (including cybersecurity) revolves around deriving the right amount an organization should invest in protecting information. Organizations also need to determine the most appropriate way to allocate such an investment.

The security of information is a fundamental concern to organizations operating in the modern digital economy. There are technical, behavioral, and organizational aspects related to this concern. There are also economic aspects of information security. One important economic aspect of information security (including cybersecurity) revolves around deriving the right amount an organization should invest in protecting information. Organizations also need to determine the most appropriate way to allocate such an investment.

The Fourth Annual Forum on Financial Information Systems & Cybersecurity: A Public Policy Perspective, held on May 23, 2007 at the Robert H. Smith School of Business, brought together experts and industry professionals from around the globe to discuss risk management issues related to information security. The day included expert presentations followed by discussions that ranged from the extremely theoretical to the practical to the purely political, and the issues ranged from personal security risks to corporate and national security risks.

In the past few years, Americans have come to learn that security initiatives are expensive and, many times, unsuccessful. However, high cost security is more than a government issue, it is also an important business issue. In a digital economy, businesses must work hard to keep client and employee information safe and private. Unfortunately many businesses spend millions of dollars on security initiatives that never deliver the promised results.

Stories concerning cybersecurity issues are now common in the news media. Articles addressing the theft of laptop computers with entire confidential databases have topped the list in recent months. The need to protect the nations infrastructure, a large part of which is controlled by computer networks, has also been the subject of many recent news stories and government reports. In response to the stories and reports, computer security experts have been working hard to develop all sorts of technical solutions to prevent, or at least quickly detect and correct, cybersecurity breaches.