Choice Architecture for Information Security

信息安全决策通常在没有任何正式或严格支持的情况下做出。例如，有关安全漏洞的影响或可能性的数据很少可用。仔细的预测，例如使用蒙特卡洛模拟，往往被忽略。这是自然的，但也有点容易，说，我们需要更严格的技术，当我们做出信息安全决策。在调查员自己的工作中，以下关键挑战仍未得到解决。首先，严格的方法可能会引入一个错误的安全感，决策者不完全披露的假设决策者（例如，模型可能会假设一个有限的攻击场景）。第二，人们可能会在完善严格性方面进行投资，而不会获得太多的信息;也就是说，增加严格性的价值可能不会导致更好的决策。这违背了巴菲特的口头禅，即近似正确比完全错误更好。第三，决策者往往忽视他们通过严格评估获得的信息，除非这些信息证实了他们已经打算做出的决定。为了解决这些问题，我们从行为经济学社区的推动工作中获得灵感，该工作提供了一个尽可能有效地影响决策者的框架。特别是，我们需要工具和技术来形成为信息安全量身定制的选择架构。信息安全具有众所周知的特性，我们将利用这些特性来提供足够的选择架构。特别是，该项目将建立严格的数学方法，以将未知数的不确定性纳入我们的分析中，并将推导出关于“严格价值”的理论，使专家能够判断哪些严格因素可以支付进一步的投资。我们做我们的研究连接到一个总体的信息安全问题具有高度的实际重要性，即“消费化”，即在工作场所使用人们自己的技术。这可能是IT部门在未来几年面临的主要挑战，即随着工作和个人生活之间的界限变得更加模糊，如何保持工作场所的安全。根据企业的不同，做“正确的事情”可能会导致不同的政策。该项目将通过完善的渠道与大型组织和中小企业合作。它将通过一个中小企业的案例研究来证明所提倡的选择架构的好处。具体而言，最终用户可能会体验到以下项目的结果。我们对选择心理学的研究可能会揭示，数据的所有权感有助于员工更好的安全行为。作为选择架构基础的定量技术测量了员工为此目的使用手机的频率。Nudging工具既作为移动的手机应用程序安装，也作为CISO的桌面工具安装。例如，用于雇员的工具可以是移动的应用，其从雇员的角度可视地显示数据丢失的后果，例如在他们的工作的成功可能如何受到威胁方面。它战略性地使用选择退出和选择加入，以推动员工根据潜在的预测模型平衡安全性和生产力。CISO的推动工具可以是一个桌面工具，提供最新的数据，并可以为组织的特定部分进行配置。CISO工具通过呈现未知的风险来小心地防止错误的安全感，并帮助CISO了解哪些数据以及哪些基础评估或决策最有助于改善决策。

Information security decisions are often made without any formal or rigorous backing. For instance, data about impact or likelihood of security breaches is rarely available. Careful prediction, for instance using monte carlo simulation, is often ommitted. It is natural, but also somewhat easy, to say that we need more rigorous techniques when we make information security decision. In the investigator's own work the following key challenges remain unresolved. First, rigorous approaches may introduce a false sense of security to decision-makers by not fully disclosing assumptions to decision makers (e.g, a model may assume a restricted attack scenario). Secondly, one may invest in perfecting the rigorous aspect without gaining too much more information; that is, the value of the added rigour may not lead to better decisions. This violates Buffett's mantra to better be approximately right than precisely wrong. Thirdly, decision-makers tend to ignore the information they receive through rigorous assessment, unless it validates the decision they already intended to make. To address these issues, we take inspiration from the work on nudging in the behavioural economics community, which provides a framework to influence decision makers as effectively as possible. In particular, we need tools and techniques to form a choice architecture tailored to information security. Information security has particular well-known characteristics, which we will exploit to provide sufficient rigour underlying the choice architecture. In particular, the project will establish rigorous mathematical approaches to include uncertainty about unknowns in our analysis, and will derived a theory about the 'value of rigour', allowing experts to judge which elements of rigour pay off further investment. We do our research in connection to one overarching information security issue of high practical importance, namely 'consumerization', that is, the use in the workplace of people's own technologies. This is possibly the main challenge that IT departments face in the coming years, to keep the workplace secure as the boundaries between work and personal life become more blurred. Depending on the enterprise, doing the "right thing" may result in different policies. The project will work with large organisations and SMEs through well-established channels. It will demonstrate the benefits of the advocated choice architecture through a case study in an SME. In very concrete terms, a possible outcome that an end user may experience as result of the project is as follows. Our research in the psychology of choice may reveal that a sense of ownership of data contributes to better security behaviour of employees. Quantitative techniques underlying the choice architecture measure the frequency with which an employee uses the phone for this purpose. Nudging tools are installed both as a mobile phone application and as a desktop tool for the CISO. For example, the tool for employees may be a mobile app that visually displays the consequence of data loss from the perspective of the employee, for instance in terms of how success in their job may be at stake. It makes strategic use of opt-outs and opt-ins to nudge the employee to balance security and productivity based on an underlying predictive model. The nudging tool for the CISO may be a desktop tool that provides the latest data and can be configured for a particular part of the organisation. The CISO tool carefully protects against a false sense of security by presenting the risk of unknowns and helps the CISO understand what data and which underlying assessment or decision-making would help improve the decision-making most.