SBES: Medium: Economic Incentives and Organizations for a Trustworthy Cyberspace

在本研究中，控制经济学实验用于测试经济理论的预测，这些理论假设组织内有效的网络安全权衡取决于员工激励和工作职责结构。在这些实验中，一个由经济学家和网络安全专家组成的团队正在共同设计虚拟世界实验，以衡量不同激励安排和工作设计对运营网络安全风险的影响。这在计算机密集型环境中特别有趣，在这种环境中，竞争任务的混合包括容易监控的任务，这些任务对组织目标的影响很容易验证，比如由应用程序编程团队执行的任务，以及对组织绩效影响更模糊的任务，比如与网络安全实践相关的任务。在前一种情况下，高功率激励往往与相关的相对低功率激励竞争，导致网络安全风险管理效率低下。本研究的目的是更好地了解管理实践如何与可用的网络安全技术和网络安全威胁相互作用，从而在组织内实现更好的风险管理策略。此类研究提供了基于证据的发现，将使组织更加意识到其网络安全/运营效率的权衡，从而使他们能够改进其组织实践，从而改进其针对网络安全威胁的风险管理策略。

In this research controlled economics experiments are used to test the predictions of economic theories that hypothesize effective cybersecurity tradeoffs within an organization depends on both worker incentives and the structure of job duties. In these experiments a team of economists and cybersecurity experts are working together to design virtual world experiments that measure the impact of different incentive arrangements and job design on operational cybersecurity risks. This is particularly interesting in computer intensive environments where the mix of competing tasks include easily monitored tasks with easily verified impact on organizational goals, such as tasks performed by application programming teams, and tasks that have a more ambiguous impact on organizational performance such as tasks associated with cybersecurity practices. In the former case high powered incentives often compete against the relatively low powered incentives associated resulting in the inefficient management of cybersecurity risks. The goal of this research is to better understand how management practice interacts with available cybersecurity technologies and cybersecurity threats to enable better risk management strategies within organizations. Such research provides evidence based findings that will make organizations more aware of their cybersecurity/operational-efficiency tradeoffs and thus allow them to improve their organizational practices and consequently their risk management strategies against cybersecurity threats.