With cloud computing quickly becoming a standard in today's IT environments, many security experts are raising concerns regarding security and privacy in outsourced cloud environments-requiring a change in how we evaluate risk and protect information, processes, and people.Managing Risk and Security in Outsourcing IT Services: Onshore, Offshore and

This comprehensive and timely resource examines security risks related to IT outsourcing, clearly showing you how to recognize, evaluate, minimize, and manage these risks. Unique in its scope, this single volume offers you complete coverage of the whole range of IT security services and fully treats the IT security concerns of outsourcing. The book helps you deepen your knowledge of the tangible and intangible costs and benefits associated with outsourcing IT and IS functions.

This comprehensive and timely resource examines security risks related to IT outsourcing, clearly showing you how to recognize, evaluate, minimize, and manage these risks. Unique in its scope, this single volume offers you complete coverage of the whole range of IT security services and fully treats the IT security concerns of outsourcing. The book helps you deepen your knowledge of the tangible and intangible costs and benefits associated with outsourcing IT and IS functions. Moreover, it enables you to determine which information security functions should be performed by a third party, better manage third-party relationships, and ensure that any functions handed over to a third party meet good security standards.

Describing OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation), a method of evaluating information security risk, this text should be of interest to risk managers.

More firms outsource information technology (IT) security activities each year, as they determine that they can achieve cost savings or a higher level of security at the same cost. However, despite the estimated benefits, many firms still fail to see a clear positive net benefit from their (private) perspective, given the risks and costs involved. This paper investigates the positive externalities associated with IT security outsourcing. My research suggests that, when one organization decides to outsource its security, both direct and indirect benefits can accrue to other organizations and users. In this paper I analyze how a variety of decision characteristics affect whether and to what level such positive externalities will result. I also discuss implications for public policy and for firm-level decision making.

Nontechnical, simple, and straightforward, this handbook offers valuable advice to help managers protect their companies from malicious and criminal IT activity.

The Workshop on the Economics of Information Security (WEIS) is the leading forum for interdisciplinary research and scholarship on information security and privacy, combining ideas, techniques, and expertise from the fields of economics, social science, business, law, policy, and computer science. In 2009, WEIS was held in London, at UCL, a constituent college of the University of London. Economics of Information Security and Privacy includes chapters presented at WEIS 2009, having been carefully reviewed by a program committee composed of leading researchers. Topics covered include identity theft, modeling uncertainty's effects, future directions in the economics of information security, economics of privacy, options, misaligned incentives in systems, cyber-insurance, and modeling security dynamics. Economics of Information Security and Privacy is designed for managers, policy makers, and researchers working in the related fields of economics of information security. Advanced-level students focusing on computer science, business management and economics will find this book valuable as a reference.