Rationally Opting for the Insecure Alternative: Negative Externalities and the Selection of Security Controls

As with all aspects of business and the economy, information security is an economic function. Security can be modeled as a maintenance or insurance cost as a relative function but never in absolute terms.