CYBERSECURITY RESEARCH
ANNOTATED BIBLIOGRAPHY
Authentication, phishing, user behavior, and security economics
1
Cybersecurity Annotated Bibliography
Web security, authentication, phishing, user behavior, and the economics of information
security
CYBERSECURITY RESEARCH FOCUS
These works examine cybersecurity as a socio-technical field in which technical defenses interact with
human behavior, authentication design, phishing, organizational incentives, and economic tradeoffs.
The bibliography therefore combines empirical studies with conceptual frameworks that address why
security measures succeed or fail in real-world use.
SECURITY ECONOMICS
Anderson, R., & Moore, T. (2006). The economics of information security. Science, 314(5799), 610-613.
https://doi.org/10.1126/science.1130992
ANNOTATION
Anderson and Moore examine cybersecurity through the incentives and economic relationships that
shape security decisions. They explain why organizations can face security problems even when
technical defenses exist, because costs, benefits, and responsibilities are distributed across different
parties. The article is useful for cybersecurity research because it expands the subject beyond
software and hardware into questions of investment, information sharing, liability, and
interdependence. It provides a concise foundation for understanding why secure system design is
also an economic and organizational problem.
AUTHENTICATION
Bonneau, J., Herley, C., van Oorschot, P. C., & Stajano, F. (2012). The quest to replace passwords: A
framework for comparative evaluation of web authentication schemes. In 2012 IEEE Symposium
on Security and Privacy (pp. 553-567). IEEE. https://doi.org/10.1109/SP.2012.44
ANNOTATION
Bonneau and colleagues evaluate proposals for replacing passwords using a framework built around
twenty-five usability, deployability, and security benefits. They compare a wide range of
authentication approaches, including password managers, federated login, hardware tokens,
one-time passwords, and biometrics. The paper is valuable because it treats authentication as a
system-design problem in which stronger security can introduce costs or usability barriers. For
cybersecurity research, it provides a structured way to compare authentication schemes rather than
judging them on security strength alone.
