Abstract

Cyber security is increasingly seen as the management of economic trade-offs: balancing losses from actual attacks (eg, monetary costs, psychological costs due to loss of privacy, etc.) against the costs of threat/attack mitigation mechanisms (eg, monetary costs, degradation of performance and productivity, etc.). While tackling this multi-attribute decision problem in a highly dynamic and uncertain environment, individuals frequently diverge from rationality. To better understand the deviation from rational behavior and to find effective ways to remediate this (when necessary), a systematic study will be undertaken with the results used to model the human behavior of malicious actors (attackers), non-malicious actors-those who intend to maintain the security of a system (defenders) and actors whose behavior/attitudes are indifferent to system security, but do not intend to attack the system (end users).

Date

2013

Authors

Michael Orosz, Tatyana Ryutov, Heather Rosoff

Journal

NSF Award

Volume

13

Issue

1314644

Pages

14644