Choosing Protection: User Investments in Security Measures for Cyber Risk Management
Firewalls, Intrusion Detection Systems (IDS), and cyber-insurance are widely used to protect against cyber-attacks and their consequences. The optimal investment in each of these security measures depends on the likelihood of threats and the severity of the damage they cause, on the user’s ability to distinguish between malicious and non-malicious content, and on the properties of the different security measures and their costs. We present a model of the optimal investment in the security measures, given that the effectiveness of each measure depends partly on the performance of the others. We also conducted an online experiment in which participants classified events as malicious or non-malicious, based on the value of an observed variable. They could protect themselves by investing in a firewall, an IDS or insurance. Four experimental conditions differed in the optimal investment in the different measures. Participants tended to invest preferably in the IDS, irrespective of the benefits from this investment. They were able to identify the firewall and insurance conditions in which investments were beneficial, but they did not invest optimally in these measures. The results imply that users’ intuitive decisions to invest resources in risk management measures are likely to be non-optimal. It is important to develop methods to help users in their decisions.
KeywordsDecision making Cyber insurance Cybersecurity
The research was partly funded by the Israel Cyber Authority through the Interdisciplinary Center for Research on Cyber (ICRC) at Tel Aviv University. This research was also supported by NCR2016NCR-NCR001-0002, MOE, and NTU.
- 3.Bissell, K., Ponemon, L.: The cost of cybercrime - unlocking the value of improved cybersecurity protection (2019). https://www.accenture.com/_acnmedia/PDF-96/Accenture-2019-Cost-of-Cybercrime-Study-Final.pdf
- 5.Botzer, A., Meyer, J., Bak, P., Parmet, Y.: Cue threshold settings for binary categorization decisions. J. Exp. Psychol.: Appl. 16(1), 1–15 (2010)Google Scholar
- 6.Botzer, A., Meyer, J., Borowsky, A., Gdalyahu, I., Shalom, Y.B.: Effects of cues on target search behavior. J. Exp. Psychol. 21(1), 73–88–539 (2014)Google Scholar
- 7.Bowen, B.M., Devarajan, R., Stolfo, S.: Measuring the human factor of cyber security. In: 2011 IEEE International Conference on Technologies for Homeland Security (HST), pp. 230–235. IEEE (2011)Google Scholar
- 9.Cisco: Cisco website. https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html. Accessed 2 May 2019
- 10.Lindros: CIO website. https://www.cio.com/article/3065655/what-is-cyber-insurance-and-why-you-need-it.html. Accessed 2 May 2019
- 12.MAS: Annual report 2014/15. http://www.parliament.gov.sg/lib/sites/default/files/paperpresented/pdf/2015/. Accessed 2 May 2019
- 19.de Vries, J.: What drives cybersecurity investment?: organizational factors and perspectives from decision-makers. Master’s thesis, System engineering, Policy Analysis and Management, Technical University Delft, Delft (2017)Google Scholar
- 21.Wickens, T.D.: Elementary Signal Detection Theory. Oxford University Press, USA (2002)Google Scholar