We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:


Current browse context:


Change to browse by:


References & Citations

DBLP - CS Bibliography


(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: The best laid plans or lack thereof: Security decision-making of different stakeholder groups

Abstract: Cyber security requirements are influenced by the priorities and decisions of a range of stakeholders. Board members and CISOs determine strategic priorities. Managers have responsibility for resource allocation and project management. Legal professionals concern themselves with regulatory compliance. Little is understood about how the security decision-making approaches of these different stakeholders contrast, and if particular groups of stakeholders have a better appreciation of security requirements during decision-making. Are risk analysts better decision makers than CISOs? Do security experts exhibit more effective strategies than board members? This paper explores the effect that different experience and diversity of expertise has on the quality of a team's cyber security decision-making and whether teams with members from more varied backgrounds perform better than those with more focused, homogeneous skill sets. Using data from 208 sessions and 948 players of a tabletop game run in the wild by a major national organization over 16 months, we explore how choices are affected by player background (e.g.,~cyber security experts versus risk analysts, board-level decision makers versus technical experts) and different team make-ups (homogeneous teams of security experts versus various mixes). We find that no group of experts makes significantly better game decisions than anyone else, and that their biases lead them to not fully comprehend what they are defending or how the defenses work.
Comments: 13 pages plus 2 page appendix. IEEE Transactions on Software Engineering 2020
Subjects: Cryptography and Security (cs.CR)
MSC classes: 00Axx
ACM classes: I.0
DOI: 10.1109/TSE.2020.3023735
Cite as: arXiv:2104.00284 [cs.CR]
  (or arXiv:2104.00284v1 [cs.CR] for this version)

Submission history

From: Benjamin Shreeve Dr [view email]
[v1] Thu, 1 Apr 2021 06:41:59 GMT (731kb,D)

Link back to: arXiv, form interface, contact.