TWC: Medium: Reputation as Public Policy for Internet Security

TWC：媒介：作为互联网安全公共政策的声誉

• 批准号: 1228990
• 负责人: Andrew Whinston
• 金额: $ 65.84万
• 依托单位: University of Texas at Austin
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-01 至 2015-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1228990&HistoricalAwards=false
• 关键词: TWC; Medium; Reputation; Public; Policy

Internet miscreants cooperate for profit in identity theft, denial of service, etc.  Meanwhile, defending organizations act separately and treat Internet information security (infosec) as a cost to be minimized. Customers could choose more wisely among competing Internet firms if they knew which had good or bad security, and such fame or shame would cause firms to improve security to retain and attract customers.To verify such a policy of peer influence, this project uses a readily available stand-in for organizational infosec: outbound spam (unsolicited bulk email).  Other security problems may not cause outbound spam, and this project makes no claims to solve all problems.  However, just as a sneeze indicates disease, spam indicates poor infosec that could be exploited for even worse purposes (theft, denial of service, blackmail, etc.), and no organization wants to be seen to have such problems.The project ranks similar organizations in SpamRankings.net, using daily data from multiple anti-spam blocklists, aggregating it from IP addresses into routing blocks (Autonomous Systems), and categorizing their owners by geography and type (hosting, medical, ISP, etc.).  Field experiments, including the relative effects of different publicity strategies, seek to determine whether publishing information on a symptom of infosec (outbound spam) causes firms to improve that symptom.Positive experimental results will serve as stepping stones to policy recommendations of legislative mandates of timely and publicly accessible incident disclosure to enable more third-party peer rankings for further infosec improvement.  Minimal enforcement could thus catalyze significant improvements in Internet usability, profitability, and national security.

互联网不法分子在身份盗窃、拒绝服务等方面合作牟利。同时，防御组织单独行动，将互联网信息安全（infosec）视为最小化的成本。如果客户知道哪家公司的安全性好或不好，他们就可以在竞争的互联网公司中做出更明智的选择，而这种名声或耻辱将促使公司提高安全性，以留住和吸引客户。为了验证这种对等影响策略，本项目使用了一种现成的组织信息安全替代品：出站垃圾邮件（未经请求的批量电子邮件）。其他安全问题可能不会导致出站垃圾邮件，并且本项目并不声称可以解决所有问题。然而，就像打喷嚏意味着生病一样，垃圾邮件意味着糟糕的信息安全，可能被用于更糟糕的目的（盗窃、拒绝服务、勒索等），没有组织希望被发现有这样的问题。该项目对SpamRankings.net中的类似组织进行排名，使用来自多个反垃圾邮件块列表的日常数据，将其从IP地址聚合到路由块（自治系统）中，并按地理位置和类型（托管，医疗，ISP等）对其所有者进行分类。实地实验，包括不同宣传策略的相对效果，试图确定发布信息安全症状（出站垃圾邮件）是否会导致公司改善该症状。积极的实验结果将成为及时和公开披露事件的立法授权的政策建议的垫脚石，从而使更多的第三方同行排名能够进一步改善信息安全。因此，最低限度的强制执行可以促进互联网可用性、盈利能力和国家安全方面的重大改进。