SBES: Medium: Economic Incentives and Organizations for a Trustworthy Cyberspace

在这项研究中，受控经济学实验被用来检验经济理论的预测，这些理论假设一个组织内有效的网络安全权衡取决于员工的激励和工作职责的结构。在这些实验中，一个由经济学家和网络安全专家组成的团队正在共同设计虚拟世界实验，以衡量不同的激励安排和工作设计对运营网络安全风险的影响。这在计算机密集型环境中尤其令人感兴趣，在这种环境中，相互竞争的任务的组合包括易于监视且对组织目标的影响易于验证的任务(例如由应用程序编程团队执行的任务)，以及对组织绩效具有更模糊影响的任务(例如与网络安全实践相关的任务)。在前一种情况下，强有力的激励往往与相对较弱的激励相竞争，从而导致对网络安全风险的低效管理。这项研究的目标是更好地了解管理实践如何与可用的网络安全技术和网络安全威胁相互作用，以便在组织内实施更好的风险管理战略。这类研究提供了基于证据的研究结果，将使组织更清楚地认识到他们的网络安全/业务效率权衡，从而使他们能够改进其组织做法，从而改进其应对网络安全威胁的风险管理战略。

In this research controlled economics experiments are used to test the predictions of economic theories that hypothesize effective cybersecurity tradeoffs within an organization depends on both worker incentives and the structure of job duties. In these experiments a team of economists and cybersecurity experts are working together to design virtual world experiments that measure the impact of different incentive arrangements and job design on operational cybersecurity risks. This is particularly interesting in computer intensive environments where the mix of competing tasks include easily monitored tasks with easily verified impact on organizational goals, such as tasks performed by application programming teams, and tasks that have a more ambiguous impact on organizational performance such as tasks associated with cybersecurity practices. In the former case high powered incentives often compete against the relatively low powered incentives associated resulting in the inefficient management of cybersecurity risks. The goal of this research is to better understand how management practice interacts with available cybersecurity technologies and cybersecurity threats to enable better risk management strategies within organizations. Such research provides evidence based findings that will make organizations more aware of their cybersecurity/operational-efficiency tradeoffs and thus allow them to improve their organizational practices and consequently their risk management strategies against cybersecurity threats.