Economics Book Review: Global Financial Systems: Stability & Risk by Jon Danielsson

How come that an Information Security blog posts now a review of a book dealing with the foundations of modern finance?

If you wonder why, then probably you are starting as an Information Security professional. Good luck to you! Train your psychological resilience. 

If you will read this post to find out why the reading of this book is recommendable, then surely you have wondered how Information Security can provide value to the business. 

This book titled Global Financial Systems: Stability and Risk is used by his author, Jon Danielsson, in his lectures about Global Financial Systems in the London School of Economics.

In 19 Chapters and in several weeks' reading time, readers get an first comprehensive idea of what has happened in the last decade and what it is currently happening in this global financial crisis. Not only that, readers get also an understanding on key financial concepts.

This information will be of great help to understand the business functionality of the IT Systems that you will probably pen-test or secure or harden or white-hat hack. And not only in the financial sector, literally in any industry sector somehow related or affected by banks i.e. in all industries.

Chapter 1 deals with systemic risk. Worth being highlighted are the interlinks among different risks and the concept of fractional reserve banking.

I identified four concepts that could have a reflection also in the Information Security field: procyclicality, information asymmetry, interdependence and perverse incentives.

Chapter 2 talks about the Great Depression from 1929 to 1933 and four potential causes such as trade restrictions, wrong monetary policies, competitive devaluations and agricultural overproduction.

Chapter 3 talks about a very special type of risk: endogenous risk. The author mentions a graph on how perceived risk goes in time after actual risk. Very interesting concept to apply also in Information Security.

Chapter 4 deals with liquidity and different models bank follow (or should follow). Liquidity is essential but, reading this chapter, complex. The distinction between funding liquidity and market liquidity is also an eye-opener.

Chapter 5 describes central banking and banking supervision. The origin of central banking dates from 1668 in Sweden and from 1694 in England. The author mentions two key roles in central banking: monetary policy and financial stability.

Chapter 6 teaches us why short-term foreign currency borrowing is a bad idea.

Chapter 7 describes the importance of the fractional reserve system and a concept that it is almost opposite to what information security professionals face on a daily basis: moral hazard (literally, "it is what happens when those taking risks do not have to face the full consequences of failure but they enjoy all benefits of success").

Chapter 8 deals with the complexity of coming up with a smart deposit insurance policy that would avoid "moral hazard" possibilities in a fractional reserve banking system.

Chapter 9 describes the problems that trading actions like short selling can bring into the financial system. An impartial reader of this chapter would see the need to come up with an effective and worldwide trading regulation. Concepts such as a "clearing house" and a "central counterparty" are mentioned.

Chapters 10 and 15: Market participants need to know probabilities to default when engaging in credit activities. These chapters explain securitisation concepts such as Special Purpose Vehicles (SPV), Collateralised Debt Obligation (CDO), Asset Backed Securities (ABS) and Credit Default Swaps (CDS). Could you think of similar concepts being used in Information Security?

Chapter 11 presents the "impossible trinity" i.e. no country is able to pursue simultaneously these three goals: fixed exchange rate, free capital movements and an independent monetary policy. Remember that the biggest market is the foreign exchange market.

Chapter 12 focuses on mathematical models of currency crises. The reader can see how these models evolved and how the global games model was proposed.

Chapter 13 goes through the different sets of international financial regulation i.e. Basel I and Basel II. There is also an appendix referring to the Value-At-Risk model.

Chapter 14 could trigger some discussions. There is a patent political element in bailing banks out. Should governments contribute or not to move private sector bank losses into the public sector?


Chapter 16 shows the need to take into account concepts such as tail risk, endogenous risk and systemic risk. Very very interesting reading for us information security professionals.

Chapter 17, 18 and 19 deal with current developments. Chapter 17 studies the period from 2007 to 2009 of the latest financial crisis, chapter 18 describes efforts taken in developing financial regulations and chapter 19 talks about the current sovereign debt crisis and its relation with the common currency and the challenge of a transfer union i.e. a higher degree of unification.

In addition, the website of the book offers the slides of every chapter, a link to modelsandrisk.org and three additional chapters with updated information on the European crisis, financial regulations and current challenges in financial policy.

Happy risk management!

Risky times

  

Economics Book review: Bad Samaritans by Ha-Joon Chang - Reality vs hearsay - Similar in Infosec?

I am convinced that Information Security professionals can benefit from reading, not only Information Security books like this one or that one, but also books that would shed some light on key business areas. Areas to which, ultimately, Information Security and IT Security provides services to. This is why I propose a series of book reviews outside the Information Security realm. Economics is certainly one of those. Understanding key points on Economics would enable security professionals to understand and assess system and data criticality and to better aim at providing added value to their customers.
 
In this occasion I present some learning points extracted from the book titled Bad Samaritans by Ha-Joon Chang. Certainly this list does not replace the reading of the book. I do recommend its careful reading.

However, for those with little time, maybe these points can be of help to you:

In two thoughts:

- There is a tendency in rich countries to request developing countries to follow economic policies that are, in many occasions, the opposite of what the rich countries did to reach where they are in economic terms.
- Care, reflection, attention to detail and a sense of fairness should be applied in this politically-driven field named economics.

In more than two thoughts:

On Chapter 0

- South Korea as a country greatly improved in about 50 years. Similarly to Haiti becoming Switzerland. This happened thanks to a mix of economic policies that, during most of those years, from the 1960s to today, by no means could be considered free-trade based.
- This economic development was not only linked to periods of democracy.
- The Korean government was extra careful controlling imports and their influence in their national economy.
- Intellectual property piracy has played an important role in countries that did protect their industries.
- This chapter argues clearly against neo-liberal economics.
-  It is interesting to see that today's rich countries used protectionism and subsidies to reach their current state.
- All this has been summarised as "climbing and kicking away the ladder".
- So, it seems that a careful, selective and gradual opening of countries' economies is key to make progress in this matter.

On Chapter 1

- Fewer than 50 years ago, it was unthinkable to see Japan as a high-quality car maker country.
- Democracy in Hong-Kong only started in 1994. Three years before the handover to China. And 152 years after the start of the British ruling.
- Before free trade, there was protectionism.
- Globalisation was not always hand in hand with free trade.
- Interesting thought: Something purely driven by politics is evitable.
- The role of the IMF, the World Bank and the WTO is biased towards the benefit of the rich countries.

On Chapter 2

- How did rich countries become rich? In a nutshell, by protecting their markets.
- How did rich countries protect their markets? Basically by:

• Applying tariff rates.
• Keeping industries in their local markets
• Supporting local industries via governmental decisions (and budget).
• Keeping primary commodities production in the colonies.

In a way, while reading this chapter, one can grasp the confusion that, throughout History, economic theories had between limiting parameters during a specific period of time and new limiting parameters after having applied a specific economic policy in terms of development or industrialisation, or even after benefiting from a specific technological breakthrough.

On Chapter 3

Very succinctly, this chapter suggests the need to find the right pace and timeline for a country to adopt free trade or, even, the right balance between protected and free trade. Done very quickly, it could mean a lack of growth. Done very slowly, it could mean losing growth opportunities.

On Chapter 4

Today's rich countries regulated foreign direct investment when they were at the receiving end. Foreign direct investment needs to be regulated.


On Chapter 5

There is a fine line defining which (and whether) some specific enterprises need to be owned by the State and when they need to be sold and to whom.
 

On Chapter 6

Equally, it is also very complex to get the right balance on Intellectual Property Rights and when ideas need to be protected by patents.

On Chapter 7

Economics is driven by politics. This is the reason why a balanced and prudent government is so decisive.

On Chapter 8

The trouble of corruption and how it damages the economy.  Interestingly, economic prosperity and democracy are not so compulsorily linked.



On Chapter 9

Culture in all countries can evolve with the right political measures.


On a Final Chapter      

There was at least an example in History when the "Bad Samaritans" (as so called by this book) behaved as "Good Samaritans": The Marshall Plan.

Enjoy the reading!

Enjoy the future!

The Economics of Security - A talk by Ross Anderson in 2011 AusCERT

The following is a personal summary of a conference/lecture given by Mr. Anderson in the most recent AusCERT event. This summary is just a collection of un-connected (and wrongly interpreted?) thoughts. It does not replace the pleasure to listen to the lecture itself.
I listened to the audio via the Risky Business podcast. Here is the link to the mp3 file. The topic of the talk was "the economics of security".

The Economics of Security

system engineering is not enough
10000 years ago human beings invented agriculture. Soon after, human organisations, driven by people, created the civil service function. This was organised by individuals at the local level, this is why it was kept simple. As an example, he mentions a system that is still being run in Bombay to deliver packed lunches (with more than 20000 people in the system). Now this has become a complex system. The world is changing. We now have people plus software, and this is the novelty. Software adds complexity.

Facebook has reached 600 million users. How do you deal with competition among members? with conflict? All this is a new scenario.

Initially security was seen as an external boundary problem. By that time, all the systems related were under the same chief executive. Today the world works differently, there is a market and a supposed equilibrium. A traditional system engineering approach is required, but unfortunately this is not enough to manage this security effectively.

First thought: In the UK, banks are more protected than customers in case of a conflict between them. In the US, the situation is the opposite. So, we would think that security in US banks would be higher. However, it is the other way round.

Second thought: Will Internet users pay an antivirus (AV) to protect, not their PCs, but other systems such as Amazon clouds and the like?

the role of incentives
Things need to be very dependable. Things go wrong because the incentives are not right e.g. the triode customer, merchant and bank or why should an electricity company invest in extra capacity (to offer a more dependable service) if that would also benefit a competitor electricity company?

Third thought: Security and Insecurity are often an externality - it is not a result of a direct effort but a side effect of what people do globally.

Can governments do something about cybercrime? It seems so. See the recommendations below.

the economics of information related markets
The distinguishing features:
- The network effect, the more people use it, the more useful it is for each user - e.g. email and fax - the winner in the market gets all - after the tipping point.
- Fixed costs are high and marginal costs very low.
- Information likes to be free - At the margin information products cost zero - you need to find a distinguishing feature that is not price (e.g. compatibility).
- Switching costs - your price should consider them and adjust to that - this is why many security mechanisms are there to control users and not to protect users - e.g. lock-in mechanisms.

With all this, the likelihood of a monopoly is really really high.

enticing users through iterations
Getting it right in version 3 - this is how the world turns - the vendor need to be quick and to follow a recurring pattern in their value proposal. This is why, in every platform market, vendors first launch the platform, as open as possible, even if it is insecure... to make it easy for people to build apps there. Then they lock it out later.
Mr Anderson mentions that exactly the same happens with payment networks e.g. this is why we use SSL and not SET. it was very quickly deployed (even if it is suboptimal).

asymmetric information
The example of 100 cars, 50 are great and 50 are lemons - the good ones cost 2000 and the bad ones 1000. Will the price in the market be 1500? Nope, no one would buy a good one for 1500. In second-hand markets, nobody knows if it is a lemon or not - this affect the security product market e.g. how could we tell the difference between a good and a not so good encryption product? We can't. This is why the IT market went through the path of providing a pile of features, basing sales on a long list of irrelevant features.

adverse selection
E.g. sick people buy more insurance. If we apply this fact to trust, we see that websites with any sort of certification are twice as likely to be malicious that those with no seal at all e.g. in google, the paid search result is twice as probable to be malicious than the non-paid top result. This means that certification schemes work in rather unexpected ways.

In conclusion, without the proper incentive, there is no right security.

what do we then need as citizens?
Security breach notification laws, publication of fraud and malware statistics, sheding light on who is good and who is bad. There is a clear a role for governments on this topic. Google and similar names do not publish those data to avoid lawsuits (only 3 out of the 27 EU members publish those statistics),

An additional measure could be the issuance of cybersecurity checks/certifications in products before they are released (e.g. do they offer the possiblity to be regularly updated in an easy manner?).

Together with security engineering, we need to touch upon adjacent knowledge fields such as game theory, psychology and business to understand security.

In terms of security resilience, we need to collect long term network performance data and to create regulation to build extra capacity (a big issue will be who pays for it?) so that we provide the appropriate incentives to deploy measures such as  BGPsec or DNSsec.

We find more details on Mr Anderson's recommendations in an ENISA paper titled "resilience of the internet interconnection ecosystem" (or in the executive summary). The headlines are the following:

1 - Incident Investigation - An independent body should thoroughly investigate all major incidents and report publicly on the causes, effects and lessons to be learned.
2 - Data Collection of Network Performance Measurements
3 - Research into Resilience Metrics and Measurement Frameworks
4 - Development and Deployment of Secure Inter‐domain Routing
5 - Research into AS Incentives that Improve Resilience
6 - Promotion and Sharing of Good Practice on Internet Interconnections
7 - Independent Testing of Equipment and Protocols
8 - Conduct Regular Cyber Exercises on the Interconnection Infrastructure
9 - Transit Market Failure

Happy reading!

Security economics: Keeping the house protected and open

Tweet this post to your friend economists ;-)