Andy Ozment and Stuart E. Schechter June 2006
In The Fifth Annual Workshop on the Economics of Information Security