Liability and Computer Security - Nine Principles


Published: Feb 27, 2000 Updated: Feb 27, 2000 Section: Network Security Library :: Law Author: Printable Version Adjust font size: Rating: 3.3/5 - 13 Votes 1 2 3 4 5

The conventional wisdom is that security priorities should be set by risk analysis. However, reality is subtly different: many computer security systems are at least as much about shedding liability as about minimizing risk. Banks use computer security mechanisms to transfer liability to their customers; companies use them to transfer liability to their insurers, or (via the public prosecutor) to the taxpayer; and they are also used to shift the blame to other departments ("we did everything that GCHQ/the internal auditors told us to"). We derive nine principles which might help designers avoid the most common pitfalls.

Click Here to download this article