Dr Richard Clayton ran the team that developed one of the earliest Internet access packages for Windows. In 1995 his company was bought by Demon Internet, then the largest UK ISP and he worked for Demon until 2000. He then went back to the University of Cambridge and obtained a PhD on "Anonymity and Traceability in Cyberspace". Since then he stayed on as an academic; his recent work being a series of papers that study the econometrics of phishing.
He was one of the authors of "Security Economics and the Internal Market", the ENISA-commissioned report that was published in January 2008. This sets out a series of recommendations for the EU and member states on information security issues. It is based on the principles of "security economics" -- a powerful way of thinking about security, which is more concerned with the economic incentives of participants than in specifying particular hardware or software solutions.
Webpage: http://www.cl.cam.ac.uk/~rnc1
Security Economics and Network Security
Abstract:Back it the 1990s, when people began to notice that the Internet isn't terribly secure, they tried to fix it with more technology, more cryptography, more authentication, more firewalls, more filtering, and to their disappointment, the Internet often didn't get any safer. We can now explain many of these failures by considering the economics behind the issue -- and in particular, do the people who can fix the problems have any incentive to do so? This talk will provide an introduction to this way of thinking about the world, and will consider the recommendations for the EU and member states made in the ENISA- commissioned report: "Security Economics and the Internal Market", Ross Anderson, Rainer Bohme, Richard Clayton and Tyler Moore, January 2008 http://www.enisa.europa.eu/pages/analys_barr_incent_for_nis_20080306.htm
