https://citris-uc.org/research-exchange-secure-insure-or-ignore-economics-of-information-security/