EAGER: Quantifying Information Security Risks in Complex Systems at the Interface of Users, Policies, and Technologies

这一提议代表着一个机会，可以孕育一个高度创新的跨学科研究项目，该项目有可能对信息安全管理产生重大的实践和理论影响？一个正在受到越来越多公众关注的地区。在过去的十年里，信息安全的研究已经从纯粹的技术重点扩展到更一般的技术-经济重点。尽管扩大了规模，但仍缺乏一种多学科的方法来理解和从理论上解释复杂的伙伴系统内的安全和经济相互作用。这项拟议研究的主要目标是与医疗保健系统合作开发一个创新的跨学科信息安全框架，以优化和大幅提高其系统信息安全和系统生产力。例如，假设一家医院与政府数据库交换患者的数据记录，另一方面呢？由保险公司访问。此外，医院还直接与这些保险公司交换信息。这可能允许保险公司合并和推断来自不同数据源的信息，这些信息可能构成传统安全考虑事项没有解决的安全威胁。从安全经济学的角度来看，必须考虑合作伙伴之间的信息交换对其生产率的影响，以了解合作伙伴遵守或违反信息安全政策的条件。拟议的项目有可能在大幅推进信息安全和管理科学的研究方面产生重大影响。虽然该项目将解决医疗保健行业内的系统信息安全问题，但其成果预计将适用于其他行业，例如国防。拟议项目的跨学科性质预计还将确定跨学科教育的机会。

This proposal represents an opportunity to seed a highly innovative interdisciplinary research project that has the potential for significant practical and theoretical impact for the management of information security ? an area which is receiving more and more public attention. During the past decade, research in information security has expanded from a purely technical focus to a more general technology-economic focus. Despite its expansion, a multidisciplinary approach to understand and theoretically explain the interaction of security and economy within complex systems of partners is still missing. The principle objective of this proposed research is to develop an innovative interdisciplinary information security framework in collaboration with a healthcare system to optimize and substantially advance both its system information security and system productivity. For example, consider a hospital that exchanges data records of patients with governmental data bases that ? on the other hand ? are accessed by insurance companies. Furthermore, hospitals directly exchange information with these insurance companies. This may allow an insurance company to combine and deduce information from different data sources that could pose a security threat which is not addressed by traditional security considerations. From a security economics perspective, the impact of information exchange between partners on their productivity has to be considered to understand the conditions under which partners will obey or violate information security policies. The proposed project provides the potential for high impact in substantially advancing research in information security as well as in management science. Although the project will address systems information security within the health care industry, its outcomes are expected to be applicable in other industries, e.g., defense. The cross-disciplinary nature of the proposed project is also expected to identify opportunities for interdisciplinary education.