Opportunity Cost of Action Bias in Cybersecurity Incident Response

Abstract

The hours and days immediately following the discovery of a cyber intrusion can be stressful and chaotic for victims. Without a documented and well-rehearsed incident response plan, people are prone to costly fear-based reactions. Action bias is the human tendency to favor action over inaction. It feels better for victims to do something even if rushed decisions are suboptimal to thoughtful, careful alternatives. Furthermore, the null baseline of doing nothing or watchful waiting can sometimes be advantageous. This paper describes an application of opportunity cost to action bias. While these insights are not yet backed by empirical data, this is the first work to examine the intersection of opportunity cost with action bias in cybersecurity incident response. Using Sony Pictures Entertainment as a case study, we discuss the implications of opportunity costs from acting prematurely and, conversely, the opportunity costs of waiting to act.

The relevance, effectiveness, and future prospects of cyber deception implementation within organizations

“…According to the Federal Bureau of Investigations, cybercrime accounted for a total loss of $27.6 billion in 2022 [6]. By limiting the resources an adversary has at their disposal in a process called sludge, organizations are able to manipulate the very psychology of an attacker to avoid or slow potential attacks [7]. This can be as simple as a warning or notice explaining that a user will be trespassing which reinforces that what the hacker is doing is wrong.…”

“…Conversely, high-interaction honeypots like Sebek & HonSSH offer attackers real operating systems, facilitating deeper engagement and analysis [11]. These systems exemplify the strategic deployment of cyber deception to study and mitigate cyber threats effectively [7].…”

“…A honeypot serves to lead malicious actors to a deceptive cyber treasure; it is defined as a security mechanism designed to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems [7]. It can come in the form of a fake file, account, or even network, which seamlessly imitates an asset valuable or vulnerable to potential hackers while reporting their activity in the process [14].…”

“…In turn, the attackers undergo stress and may be deterred from entering the network. For example, if a company warns to persecute those who enter a network for trespassing, the attacker might lose motivation to do so [7]. The options available only complexify and increase the more utilities a business has.…”

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

“…Participants incurred more cost to the system in the loss frame, as putting machines into quarantine was generally avoided more than bringing them out (Bos et al 2016). Other factors of decision-making, such as action-bias and opportunity costs have also been examined in defensive contexts (Dykstra, Shortridge, Met, & Hough, 2022a).…”