The best laid plans or lack thereof: Security decision-making of different stakeholder groups

by   Benjamin Shreeve, et al.

Cyber security requirements are influenced by the priorities and decisions of a range of stakeholders. Board members and CISOs determine strategic priorities. Managers have responsibility for resource allocation and project management. Legal professionals concern themselves with regulatory compliance. Little is understood about how the security decision-making approaches of these different stakeholders contrast, and if particular groups of stakeholders have a better appreciation of security requirements during decision-making. Are risk analysts better decision makers than CISOs? Do security experts exhibit more effective strategies than board members? This paper explores the effect that different experience and diversity of expertise has on the quality of a team's cyber security decision-making and whether teams with members from more varied backgrounds perform better than those with more focused, homogeneous skill sets. Using data from 208 sessions and 948 players of a tabletop game run in the wild by a major national organization over 16 months, we explore how choices are affected by player background (e.g., cyber security experts versus risk analysts, board-level decision makers versus technical experts) and different team make-ups (homogeneous teams of security experts versus various mixes). We find that no group of experts makes significantly better game decisions than anyone else, and that their biases lead them to not fully comprehend what they are defending or how the defenses work.



page 1

page 2

page 3

page 4


BASCPS: How does behavioral decision making impact the security of cyber-physical systems?

We study the security of large-scale cyber-physical systems (CPS) consis...

Modeling multistage decision processes with Reflexive Game Theory

This paper introduces application of Reflexive Game Theory to the matter...

When Scientists Become Social Scientists: How Citizen Science Projects Learn About Volunteers

Online citizen science projects involve recruitment of volunteers to ass...

Post-Incident Audits on Cyber Insurance Discounts

We introduce a game-theoretic model to investigate the strategic interac...

NERD: Neural Network for Edict of Risky Data Streams

Cyber incidents can have a wide range of cause from a simple connection ...

Enhancing the Accuracy and Fairness of Human Decision Making

Societies often rely on human experts to take a wide variety of decision...

When confidence and competence collide: Effects on online decision-making discussions

Group discussions are a way for individuals to exchange ideas and argume...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.