Article in ssrn electronic Journal · July 015 doi: 10. 2139/ssrn. 2634590 citations 32 reads 1,108 author: Some of the authors of this publication are also working on these related projects

Policy Recommendations 
Several policy implications follow from the main finding of 
the paper. One cardinal mistake would be to assume that 
because the security of cyberspace seems to be improving, 
individuals, companies and governments do not need to 
act to protect themselves. If perceptions of the security 
of cyberspace are truly guided by the absolute figures 
(showing a poor and often worsening environment), 
then the real improvement in the security of cyberspace 
is probably driven in part by users’ actions intended to 
counter this dangerous environment by increasing their IT 
security. More efforts along these lines are needed. 
The following recommendations follow from the 
conclusions of this paper and the improvement of IT 
security more generally: 
Focus on the individual. The weak point in most IT 
security systems is often the individual user and not 
the technical system itself.
Spam and phishing emails 
are designed to capitalize on this weakness, which stems 
largely from a combination of a lack of knowledge and a 
likely moral hazard to do with individual responsibility 
for cyber security. In other words, many people do not 
know enough to not click the link in a phishing email and 
many people will likely click links in a work environment 
that they would never click at home because there is an 
IT staff to deal with the consequences and individual 
accountability for data breaches is inconsistent. 
Detect and counter new vulnerabilities faster by relying 
on open source software where possible.
Open source 
software, such as SSL, is often more secure than strictly 
proprietary programs because it can be examined by 
so many eyes, although some examples, such as the 
Heartbleed exploit in SSL, show that all software is 
vulnerable. Many, indeed most, individuals with a 
computer science or computer engineering background 
are committed to ideals of an open and free Internet. For 
that to occur, programs need to be secure. Available open 
source software tends to get examined more often because 
it is publicly available and this reveals vulnerabilities faster, 
leading to quicker fixes and more security. In comparison, 
proprietary programs tend, in general terms, to eventually 
get leaked, so criminals have access to that code too, but it 
is not examined by as many eyes, leading to less security 
on average (Clarke, Dorwin and Nash, n.d.).