2010 - ERCIS

University of Münster –
Department of Information Systems –
IT Security Research Group
16
New Research Group:
IT Security at ERCIS HQ
Whenever information systems are being
connected, a new potential security
hole is created. In a world where computer
networks are an indispensable
backbone of wealth and growth, basic
knowledge of the principles of security
and privacy are no longer the domain
of spies and specialists. Instead, this
qualification will soon belong the set to
elementary skills of every businessperson
and citizen – just like nowadays
you know how to operate a door lock,
or not to issue a blank check. ERCIS has
accommodated to this need and welcomes
Dr. Rainer Böhme as head of a
new research group dedicated to IT security.
West Coast to Westphalia
Professor Dr.-Ing. Rainer Böhme was
appointed as Assistant Professor (“Juniorprofessor”)
on September 1st, 2010.
Prior to this position, he worked as
Postdoctoral Fellow at the International
Computer Science Institute in Berkeley,
California. He holds a Master’s degree
in Communication Science and Economics
and a Doctorate in Computer
Science, both from Technische Universität
Dresden in Germany. He also
worked at the European Central Bank,
where he served for the directorates of
economics and financial stability & supervision.
Professor Böhme’s research
interests include economics of information
security and privacy as well as multimedia
security. He is particularly keen
on teaching security in its breadth to
students of the University of Münster’s
Master program.
Security Economics
The new research group will take an
interdisciplinary approach on a range
of research questions in information
security and privacy. One key field of
research is economics of information
security.
Security breaches are in the news almost
daily, each bigger and more costly
than the last. But rarely are they caused
by technical failures. Bad security often
is a result of wrong decisions on
the deployment of security technology.
The economic perspective on information
security starts with looking at these
decisions and analyzes underlying processes
and incentive systems. Technology
merely defines the action space. With
insights into economic and behavioral
mechanisms, technology can be designed
and deployed in such a way that
bad security decisions are less likely.
Relevant research questions include:
How can security be measured? How
much shall individuals, firms, and governments
spend on information security?
How exactly shall they invest?
What incentives really drive privacy decisions?
What distinguishes cyber-risks
from conventional risks and what consequences
emerge for cyber-risk management?
How does all this affect the IT
security industry?
The methods in the field of economics
of information security range from
economic modeling of isolated aspects,
via quantitative empirical studies, to
broader strategy/policy analyses targeted
to corporate decision makers and
governments.
Impact
Professor Böhme is an established
capacity in this field. He has published
nine papers on various topics in the past
six editions of the prestigious Workshop
on the Economics of Information Security.
His work got cited in Science, The
Economist, and in reports of international
organizations like the UNCTAD, OECD
and the European Commission. His 2009
paper entitled “The Iterated Weakest
Link”, co-authored with Dr. Tyler Moore
of Harvard’s Center for Research on
Computation and Society, was awarded
the inaugural Gordon Price in Managing
Information Security Resources by the
University of Maryland’s Smith School
of Business. In 2008, Dr. Böhme co-authored
an influential report on Security
Economics and European Policy commissioned
by the European Network and
Information Security Agency (ENISA).
Some of the 15 recommendation formulated
therein have been taken up by policymakers
in Europe, the US, and Asia.
Digital Image Forensics
Besides economic and managerial
questions, the research group also contributes
to advance the state of security
technology. Its members belong to the
leading European researchers in the
field of digital image forensics. Forensic
methods in general deal with the search
and analysis of traces with the aim of reconstructing
(criminal) activities as well
as identifying culprits.
The wide acceptance of digital imaging
coupled with ever better image processing
software enables ordinary users to
Image 1: Image released to the press