The group brings together computer scientists, engineers and social scientists to analyze large-scale measurement and incident data sets to identify how the markets for Internet services deal with security risks.

We have conducted empirical studies for the ITU and the OECD on the economics of malware and the role of Internet Service Providers in botnet mitigation. The latter study found that just 50 Internet Service Providers (ISPs) harbor around half of all infected machines worldwide and that countries with active telecom regulators have lower infection rates. The Dutch government commissioned an in-depth study on the Dutch market, which estimated that each year around 5-10 percent of all Dutch households have at least one computer in a botnet. More recently, we studied the economics at work in the market for Certification Authorities and found, for example, that there is no 'race to the bottom' for security.

Our work has been covered widely by the media, including the BBC (12), the MIT Technology ReviewSlashdot and countless Dutch media and security websites.

In a variety of projects, we are expanding our earlier work on ISPs and botnets into new markets. The core objective of all this work is to develop reliable reputation metrics for security of services of Internet intermediaries, such as ISPs, hosting providers, certification authorities, payment service providers, among others. With these metrics, we can: 

  • Identify the incentives – including regulatory efforts – that increase security in these markets 
  • Publish ratings that themselves can work as security incentives 
  • Support the development of evidence-based policies and practices

The group has been established in the course of 2013. It is being led by Michel van Eeten and currently comprises six members, but we are still recruiting for additional positions.

Economics of Cybersecurity Group (October 2013). From left to right: Giovane Moura, Qasim Lone, Michel van Eeten, Hadi Asghari, Samaneh Tajalizadehkhoob, Payam Poursaied

Economics of Cybersecurity Group (October 2014). From left to right: Samaneh Tajalizadehkhoob, Giovane Moura, Maciej Korczynski, Arman Noroozian, Qasim Lone, Martijn Groenleer, Hadi Asghari,  Michel van Eeten,  Orcun Cetin, Carlos H. Gañán