How Task Familiarity and Cognitive Predispositions Impact Behavior in a Security Game of Timing

Abstract

This paper addresses security and safety choices that involve a decision on the timing of an action. Examples of such decisions include when to check log files for intruders and when to monitor financial accounts for fraud or errors. To better understand how performance in timing-related security situations is shaped by individuals' cognitive predispositions, we effectively combine survey measures with economic experiments. Two behavioral experiments are presented in which the timing of online security actions is the critical decision-making factor. The feedback modality in the decision-environment is varied between visual feedback with history (Experiment 1), and temporal feedback without history (Experiment 2). Using psychometric scales, we study the role of individual difference variables, specifically risk propensity and need for cognition. The analysis is based on the data from over 450 participants. We find that risk propensity is not a hindrance in timing tasks. Participants of average risk propensity generally benefit from a reflective disposition (high need for cognition), particularly when visual feedback is given. Overall, participants benefit from need for cognition; however, in the more difficult, temporal-estimation task, this requires familiarity with the task.

The Positive Impact of Task Familiarity, Risk Propensity, and Need For Cognition on Observed Timing Decisions in a Security Game

“…In contrast, average risk-seeking individuals benefit strongly from a high NFC and suffer considerably from a low NFC. 4 This effect is particularly strong for Study 1 (see Figure 9b).…”

“…In this paper, we present two exploratory studies that show how an individual's personality characteristics of risk propensity and need for cognition influence behavior over increasing task experience in a game that models safety and security decisions. Our paper benefits from earlier conference presentations of this data [3,4]. Here, we add context and an analysis of timing bias in addition to the analysis of the payoff bias we observed.…”

Personality and Social Framing in Privacy Decision-Making: A Study on Cookie Acceptance

“…Risk taking was a stronger predictor of cookie acceptance than impulsivity in this study. Risk taking has been found to be a predictor of other security behaviors (see Grossklags and Reitter, 2014 ). This supports findings by Zeelenberg et al (1996) that risk takers are less likely to be concerned about the repercussions of their actions and less likely to consider any subsequent regret.…”

“…Existing research also suggests that personality factors may interact with social manipulations to influence decision-making as personality traits may often affect behavior indirectly through influencing normative determinants of behavior ( Rosenstock, 1974 ; Ajzen, 1991 ). In the security and privacy domains, a range of candidate personality traits can be identified that are likely to affect decision-making, including impulsivity, risk-taking/risk propensity ( Grossklags and Reitter, 2014 ), willingness to self-disclose information about oneself, and sociability. These are described in more detail below.…”

$$\mathsf {QFlip}$$ : An Adaptive Reinforcement Learning Strategy for the $$\mathsf {FlipIt}$$ Security Game

“…Zhang et al consider limited resources with an upper bound on the frequency of moves and analyze Nash Equilibria in this setting [25]. Several games study human defenders players against automated attackers using Periodic strategies [20,8,18]. All of this work uses exclusively non-adaptive players, often limiting analysis to solely opponents playing periodically.…”