Authorized Authorized

224 WORLD DEVELOPMENT REPORT 2016
Table 4.2 A basic framework for assessing the costs of cybersecurity incidents
Direct costs
Indirect costs
Market players
Repair costs
Data loss
Security measures
Fraud
Patch development and deployment
Customer support
Abuse management
Law enforcement
Cost of infrastructure
Investigation at the organizational level
Lost productivity
Revenue loss
Confidentiality breach
Reputation-related revenue loss
Security countermeasures collateral impact
Slower ICT adoption
Slower ICT innovation
End users
Home
Business
e-commerce companies
Infrastructure
Software vendors
Internet service providers
Hosting providers
Registrars
Computer emergency
response teams
Law enforcement
Society at large
Source: Bauer and Dutton 2015, for the WDR 2016, citing Bauer and others 2008.
Note: ICT = information and communication technology.
perhaps more than others—governments can play a
role in developing effective policies. The “perimeter
security” paradigm that pervades today, born in an
era of a few centralized mainframe computers, needs
revisiting, putting users—not devices—at the center
of the discussion, and thus implying a great role for
capacity building. 98 Public policy could be used to
change misaligned incentives to achieve security.
Given the pace of technological change, these policies
should be guidelines or principles, not prescriptive,
and be technology neutral. They should encourage
interoperability among regimes and legal systems
to investigate and prosecute cybercriminals across
jurisdictions and to avoid the creation of safe havens
for cybercriminals. Finally, work could be done to
develop a common set of indicators to measure the
economic impact of cybercrime and other cyberrisks.
Protecting personal privacy and data
online is essential in building trust in the
internet
The other side of the “balance” is protecting privacy
and data online. 99 One of the key drivers in the digital
economy is the flow of personal data, of which an
estimated 90 percent has been added in the last two
years. Collecting and analyzing data about individuals
is integral to how some of the largest companies
in the world do business. For example, Facebook is a
company with a US$230 billion capitalization largely
through its sales of ads that reach Facebook users. 100
But data also allow small and medium companies to
monetize their services.
The World Economic Forum (WEF) has identified
data-driven enterprises as part of a strategy for
economic development in developing countries. 101