Abstract. Economic aspects of information security are of growing interest for researchers as well as for decision makers in IT-depending companies. From a business perspective cost-benefit-justifications for information security investments are in the focus. While previous research has mostly focused on economic models for security investments or on how to quantify the benefits of information security this paper aims to take a closer look at the costs for information security. After providing the reader with basic knowledge and a motivation for the topic, we identify and describe the problems and difficulties in quantifying an enterprise's cost for information security in a comprehensive and comparable way with the lack of a common model of information security costs being the most prominent one. Following, this paper discusses four approaches to categorise and determine information security costs in an enterprise. Starting with the classic approach frequently used in surveys, we continue by describing three alternative approaches. To support research on information security costs we propose two metrics. We conclude with inputs for future research, especially for an empirical analysis of the topic.

Protecting the privacy of VANET users is an important issue. We present in this paper an architecture that aims at this goal by integrating Chaum's mix network into a distributed but infrastructure-based location service for positionbased routing. In addition we enable the user to decide when he wants to reveal his position to anyone else. Thus neither entity of the VANET is in full knowledge about the location and the identity of any user at the same time. The proposed system can be integrated in most published VANET security frameworks and our evaluation shows that an implementation is feasible.