The best laid plans or lack thereof: Security decision-making of different stakeholder groups

by   Benjamin Shreeve, et al.

Cyber security requirements are influenced by the priorities and decisions of a range of stakeholders. Board members and CISOs determine strategic priorities. Managers have responsibility for resource allocation and project management. Legal professionals concern themselves with regulatory compliance. Little is understood about how the security decision-making approaches of these different stakeholders contrast, and if particular groups of stakeholders have a better appreciation of security requirements during decision-making. Are risk analysts better decision makers than CISOs? Do security experts exhibit more effective strategies than board members? This paper explores the effect that different experience and diversity of expertise has on the quality of a team's cyber security decision-making and whether teams with members from more varied backgrounds perform better than those with more focused, homogeneous skill sets. Using data from 208 sessions and 948 players of a tabletop game run in the wild by a major national organization over 16 months, we explore how choices are affected by player background (e.g., cyber security experts versus risk analysts, board-level decision makers versus technical experts) and different team make-ups (homogeneous teams of security experts versus various mixes). We find that no group of experts makes significantly better game decisions than anyone else, and that their biases lead them to not fully comprehend what they are defending or how the defenses work.


page 1

page 2

page 3

page 4


BASCPS: How does behavioral decision making impact the security of cyber-physical systems?

We study the security of large-scale cyber-physical systems (CPS) consis...

The Role of Diversity in Cybersecurity Risk Analysis: An Experimental Plan

Cybersecurity threat and risk analysis (RA) approaches are used to ident...

Decisions Disruptions 2: Decide Harder

Cyber incident response is critical to business continuity – we describe...

Post-Incident Audits on Cyber Insurance Discounts

We introduce a game-theoretic model to investigate the strategic interac...

When Scientists Become Social Scientists: How Citizen Science Projects Learn About Volunteers

Online citizen science projects involve recruitment of volunteers to ass...

Enhancing the Accuracy and Fairness of Human Decision Making

Societies often rely on human experts to take a wide variety of decision...

NERD: Neural Network for Edict of Risky Data Streams

Cyber incidents can have a wide range of cause from a simple connection ...

Please sign up or login with your details

Forgot password? Click here to reset