Effects of information security risk visualization on managerial decision making

Abstract

This paper documents a controlled experiment on the effect of adding a graphical model to a fictitious corporate security decision problem. The control group (N=44) saw a textual description, and the treatment group (N=41) was presented a graphical representation using the ArchiMate security extension modeling language in addition to the textual description. Besides the security investment decision, indicators of comprehension, risk perception, and decision confidence were measured as dependent variables. Significant positive effects were found for decision confidence and risk perception, but not for the main investment decision and indicators measuring problem comprehension. Two intervening variables, domain knowledge and spatial ability, both derived from the Cognitive Theory of Multimedia Learning, were found to have no significant effect. The experiment presents preliminary evidence from a small sample of educated professionals indicating that visualizations may not have an unconditional advantage over text for decision support in the security domain. Permission to freely reproduce all or part of this paper for non-commercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

No search allowed

“…The last one contains empirical studies comparing graphical and textual representations for, e.g., business processes [36], software architectures [17], safety and system requirements [9, 42, 44ś46]. Recently, there were published a few empirical studies examining representations for security risks [15,19,25,50] or comparing graphical and tabular methods for security risk assessment in full scale application [22,24,27,30].…”

“…Yildiz and Böhme [50] recently conducted a controlled experiment with 85 participants to investigate the effects of risk visualization on managerial decision making in information security. This study showed that supplementing a textual description of security decision problem with graphical representation improves risk perception and participants' confidence in decisions, but does not contribute to the comprehension of the problem or security investment decision.…”