The Best Laid Plans or Lack Thereof: Security Decision-Making of Different Stakeholder Groups

Abstract

Cyber security requirements are influenced by the priorities and decisions of a range of stakeholders. Board members and CISOs determine strategic priorities. Managers have responsibility for resource allocation and project management. Legal professionals concern themselves with regulatory compliance. Little is understood about how the security decision-making approaches of these different stakeholders contrast, and if particular groups of stakeholders have a better appreciation of security requirements during decision-making. Are risk analysts better decision makers than CISOs? Do security experts exhibit more effective strategies than board members? This paper explores the effect that different experience and diversity of expertise has on the quality of a team's cyber security decision-making and whether teams with members from more varied backgrounds perform better than those with more focused, homogeneous skill sets. Using data from 208 sessions and 948 players of a tabletop game run in the wild by a major national organization over 16 months, we explore how choices are affected by player background (e.g., cyber security experts versus risk analysts, board-level decision makers versus technical experts) and different team make-ups (homogeneous teams of security experts versus various mixes). We find that no group of experts makes significantly better game decisions than anyone else, and that their biases lead them to not fully comprehend what they are defending or how the defenses work. ! 1. www.decisions-disruptions.org 2. 13 additional recordings were untranscribable due to noise.

Project stakeholder engagement through gamification: what do we know and where do we go from here?

“…One example of how gamification may be used in practice to overcome communication barriers with project stakeholders is provided by Simon (2006), who proposes that design games may be used to “scaffold” dialogue between stakeholders in development projects, also in the early phases of co-design. Shreeve et al . (2020) overcome barriers through a game where stakeholders can test their risk level and through this harmonized way be able to discuss risk and risk-taking on shared terms.…”

“…One example of how gamification may be used in practice to overcome communication barriers with project stakeholders is provided by Simon (2006), who proposes that design games may be used to "scaffold" dialogue between stakeholders in development projects, also in the early phases of co-design. Shreeve et al (2020) overcome barriers through a game where stakeholders can test their risk level and through this harmonized way be able to discuss risk and risk-taking on shared terms. Ghanbari et al (2015) propose the use of serious gaming to elicit information in software development projects, in which the temporal, geographic and sociocultural diversity of the stakeholders could otherwise present formidable barriers to successful project development.…”

Security risks in the software development lifecycle: A review

“…To help software developers understand decision making around security, the authors in [175] have used a facilitated game, Agile App Security Game based on the game Decisions Disruptions. This game is now utilized extensively in the UK in the management of cyber security training [176]. Static analysis is a software testing mechanism that does not require code execution (unlike dynamic analysis).…”

How Does Usable Security (Not) End Up in Software Products? Results From a Qualitative Interview Study

“…Organizational Processes and Security Culture. In addition to individual factors that contribute to security, research has identified organizational processes and culture that impact software security [23], [26], [28], [49], [57], [58], [63]. Haney et al studied organizations developing cryptographic products [24] and found a strong security mindset as well as high expertise in cryptography.…”