ROI, ROSI & ALE

ROI
http://www.3com.co.uk/promotions/roi/
http://answers.google.com/answers/threadview?id=222921
http://www.itsecurity.com/asktecs/oct3201.htm

ROI & Economics of Information Security
http://www.getronics.com/NR/rdonlyres/ejhsokxgywr3iom
4mn4vq43l73fmqzsqbsnz47jd2thnvawjlceksww2zuu3yd3
3tnybjcjmjbtbmyfyxa2r4nhpure/wp_analysis_
return_on_investment.pdf [ROSI]
http://whitepapers.zdnet.co.uk/0,39025942,60064781p,00.htm [ROSI]
http://www.sbq.com/sbq/rosi/ [ROSI]
http://www.eecs.harvard.edu/~stuart/papers/fc03.pdf [Harvard Paper]
http://www.ftp.cl.cam.ac.uk/ftp/users/rja14/econ.pdf
http://www.dtc.umn.edu/weis2004/
http://www.dtc.umn.edu/weis2004/agenda.html [Ultra Recent!]
http://www.cl.cam.ac.uk/users/rja14/econsec.html [Very Good Link]
http://www.cl.cam.ac.uk/users/rja14/econws.html [Basis of history in literature review]
http://itresearch.forbes.com/detail/RES/1057858077_908.html
http://www.intel.com/network/connectivity/emea/eng/
solutions/security/roi.htm
http://csrc.nist.gov/roi/proceedings.html
http://csrc.nist.gov/roi/wksps0603-notes/NIST-Wkshp-bothsessions.pdf [Good argument with respect to ROI & NPV]
http://infosecuritymag.techtarget.com/2002/jul/
curmudgeons_corner.shtml
http://www.umiacs.umd.edu/partnerships/ltsdocs/Gordon-Loeb%2003%20NSA_presentation.pdf [Economic aspects]
http://www.rainbow.com/library/8/
EconomicsAspectsOfInformationSecurity.pdf [Contact authors for extra material]
http://www.cio.com/archive/021502/security.html
http://www.cio.com/archive/021502/security_sidebar.html
http://imailab-www.iis.u-tokyo.ac.jp/Members/kanta/CEF2003.pdf
http://www.whitehouse.gov/omb/inforeg/infopoltech.html [Spending]
http://www.eecs.harvard.edu/~stuart/papers/thesis.pdf [PhD thesis]
http://citeseer.ist.psu.edu/578826.html
http://ideas.repec.org/s/sce/scecf3.html
http://www.umiacs.umd.edu/partnerships/ltsdocs/Gordon-Loeb%2003%20NSA_presentation.pdf
http://www.umiacs.umd.edu/docs/umiacspresentation.pdf
http://www.financetech.com/utils/printableArticle.jhtml?articleID=18901266
http://www.secure-biz.net/Spring2004/speaker_presentation/Lawrence%20Gordon.ppt
http://www.secure-biz.net/Spring2004/presentations.htm
http://www.cpppe.umd.edu/rhsmith3/agenda.htm [2nd Annual Workshop]
http://www.dtc.umn.edu/weis2004/agenda.html [3rd Annual Workshop]
http://www.fsl.cs.sunysb.edu/docs/cost-acm_ccs/acm_ccs.html
http://students.depaul.edu/~gmahjub/ [THESIS DRAFT]
http://www.computerworld.com/managementtopics/
http://www.securityfocus.com/infocus/1608 [ROI of IDS]
http://www.nai.com/us/promos/corp/article2.asp [ROI of IDS]
http://www.continuitycentral.com/news0312.htm [IDS Market Failure]
ROIT White Paper [Return on Information Technology]
Economics of Cyber Crime [NPV approach]
http://www.oict.nsw.gov.au/content/7.1.15.ROSI.asp
http://www.corsaire.com/articles/030317-rosi.html
http://comment.cio.com/talkback/021502.html [ROSI]

OVERSPENDING/UNDERSPENDING
http://news.com.com/2010-1071-966448.html [Is IT Overspending in Security?]

INFORMATION ECONOMICS
http://citeseer.ist.psu.edu/rd/0,513304,1,0.25,Download/
http:qSqqSqwww.coiera.comqSqpapersqSqjamia-00-infoecon.pdf
http://www.sims.berkeley.edu/~hal/Papers/mattioli/mattioli.pdf

ALE
http://comment.cio.com/comments/8408.html
http://keith.mccammon.org/docs/loss_expectancy.php
http://comment.cio.com/comments/8408.html
http://citeseer.ist.psu.edu/george98practical.html [Assurance, mention of ALE]
http://citeseer.ist.psu.edu/392822.html
http://www.cccure.org/Documents/HISM/229-230.html
http://www.linuxjournal.com/article.php?sid=5567
http://www.riskinfo.com/cyberisk/Watersupply/SCADA-thesis.html [Origin of ALE???]
http://csrc.nist.gov/publications/fips/fips31/fips31.pdf [First mention of ALE]
http://www.cs.kau.se/~albin/Documents/F18-RiskAnalysis.pdf
http://www.spybusters.com/SS0202.html
http://www.drj.com/new2dr/w3_030.htm
http://linuxsecurity.org/feature_stories/feature_story-98.html [Good article]