No abstract

Purpose The purpose of this paper is to investigate security decision-making during risk and uncertain conditions and to propose a normative model capable of tracing the decision rationale. Design/methodology/approach The proposed risk rationalisation model is grounded in literature and studies on security analysts’ activities. The model design was inspired by established awareness models including the situation awareness and observe–orient–decide–act (OODA). Model validation was conducted using cognitive walkthroughs with security analysts. Findings The results indicate that the model may adequately be used to elicit the rationale or provide traceability for security decision-making. The results also illustrate how the model may be applied to facilitate design for security decision makers. Research limitations/implications The proof of concept is based on a hypothetical risk scenario. Further studies could investigate the model’s application in actual scenarios. Originality/value The paper proposes a novel approach to tracing the rationale behind security decision-making during risk and uncertain conditions. The research also illustrates techniques for adapting decision-making models to inform system design.

Research on decision making during risk and uncertainty facilitates risk-based decision making by understanding techniques decision makers use to arrive at informed decisions. Approaches to the research usually involve a mix of cognitive techniques for information discovery and sense-making; these were methodologically not intended to inform design. We detail our experience in applying qualitative techniques to elicit persona characteristics from risk-based decision making data.

Abstract-The perception of risk is a driver for security analysts' decision making. However, security analysts may have conflicting views of a risk based on personal, system and environmental factors. This difference in perception and opinion, may impact effective decision making. In this paper, we propose a model that highlights areas contributing to the perception of risk in a socio-technical environment and their implication to system design. We validate the model through the use of a hypothetical scenario, which is grounded in both the literature and empirical data.

The current consensus is that a lack of skilled young persons entering the cyber security industry is contributing significantly to the accrescent cyber security skills gap. However, little progress has been made in terms of handling key contributing factors such as cyber security education. While Capture The Flag (CTF) exercises in cyber security education present some of the necessary requirements, we hypothesise that the current CTF forms do not possess the requirements necessary for promoting student engagement and learning. The paper presents the results of a study aimed at identifying the requirements of a studentfocused CTF.