Why Information Security Is Hard – An Economic Perspective (2001) [pdf]
cl.cam.ac.uk