Using the Conflicting Incentives Risk Analysis Method

Proceedings of the 10th International Workshop on Security in Information Systems

2013

Typically, a risk analysis may identify and document sensitive and confidential information regarding threats, vulnerabilities, assets and their valuation, etc. The intrusive nature of the risk analysis process makes it difficult for researchers (or students) to gain access to scenarios from operational organizations for evaluating (or training on) risk analysis methods. In order to resolve these issues, we propose Case Study Role Play (CSRP). We elaborate the use of CSRP in combination with the Conflicting Incentives Risk Analysis (CIRA) method to analyze privacy risks to an end-user from using the eGovernment service. This paper contributes by demonstrating how CSRP helps to establish a platform for doing risk management related research and training in a 'reasonably' realistic environment, where confidentiality, sensitivity issues, red tape and the need for permissions do not create roadblocks. Furthermore, CSRP ensures that the time and resources needed to set up the required environment is low and predictable.

Section: Discussionmentioning

confidence: 99%

Section: Using Csrp For Cira Research and Trainingmentioning

confidence: 99%

See 1 more Smart Citation

Case Study Role Play for Risk Analysis Research and Training

Rajbhandari¹,

Proceedings of the 10th International Workshop on Security in Information Systems

2013

“…In order to reduce the complexities associated with conducting the aforementioned risk-analysis methods, and to overcome some of their limitations, the Conflicting Incentives Risk Analysis (CIRA) method proposes a novel way to describe the risk situation. CIRA develops a different concept of risk, where risk is the result of misaligned stakeholder incentives [22] and risk is analyzed from the perspective of an individual facing a risk. Two types of risks are distinguished: threat risk -undesirable events-and opportunity risk -desirable events not realized.…”

Section: Related Workmentioning

confidence: 99%

Construction of Human Motivational Profiles by Observation for Risk Analysis

Szekeres

2020

IEEE Access

This study aimed at analyzing the extent to which publicly observable pieces of information representing stakeholders' past and current choices can be utilized for the construction of motivational profiles. Motivation is operationalized by the theory of Basic Human Values, which organizes 10 values capturing distinct aspects of human motivation into a hierarchical order. The construction of motivational profiles for individual stakeholders is motivated by the need to enhance the existing decision-maker model in the Conflicting Incentives Risk Analysis (CIRA) method. This study utilized an online questionnaire to collect responses from participants (n = 331) about a wide range of habits and personal items that are easily observable in various contexts by an analyst. The validity of the set of observables as surrogate predictors of the motivational profiles is evaluated by various methods (i.e. comparison to previous results, cross-validation of models, comparison to test-retest reliability of the psychometric instrument) and techniques (calculation of prediction interval for individual profile scores). The assessment of the uncertainties associated with predicting motivational profiles is explored in detail. Additionally, an example illustrates how the profiles can be utilized for the assessment of action desirability (i.e. prediction of behavior) based on the utility calculations established in CIRA. The results contribute to an improved understanding about the accuracy with which human stakeholder motivation can be inferred from public observables and utilized within the context of information security risk analysis. INDEX TERMS Conflicting Incentives Risk Analysis, human motivation, public observables, profiling, risk analysis, stakeholder behavior.

“…In a world characterized by increasing levels of interconnectedness and inter-dependency, where decision-makers and the people affected by critical decisions are linked together and separated by layers of complex technical solutions, there is a pressing need to understand and predict key decision-makers' behavior. The Conflicting Incentives Risk Analysis (CIRA) method was developed for the analysis of risks arising from deliberate human decisions, and re-conceptualizes risk, within the domains of information security and privacy [2]. CIRA requires the identification of two classes of stakeholders, their relevant utility factors and the actions that can be implemented to describe the risk situation.…”

Section: Introductionmentioning

confidence: 99%

A Taxonomy of Situations within the Context of Risk Analysis

Szekeres

2019 25th Conference of Open Innovations Association (FRUCT)

2019

Prediction of deliberate human decisions with potential negative impact on others would have great practical and scientific utility. The Conflicting Incentives Risk Analysis (CIRA) method defines risk as a result of misaligned incentives between various stakeholders. The method makes predictions based on action desirability from the perspective of the individual in the position to implement the action. Therefore, in order to assess action desirability it is necessary to characterize stakeholders and their perceptions about the situation as well. While classification systems and taxonomies related to stakeholder attributes are wellestablished, systematic classifications of situational aspects are underdeveloped in the literature. Therefore, the main objective of this paper is to present a classification of situational variables in the form of a taxonomy capturing key situational features that exert influence on decision-makers. The development of the taxonomy begins with mapping two major types of risks distinguished in the CIRA method to relevant psychological constructs. The principled, systematic development of dilemmas enabled by the taxonomy allows researchers to investigate the predictability of stakeholder behavior which may result in various types of risks. The taxonomy is extensible, thus additional concepts and variables can be included depending on the needs of the analysis and according to future developments within the fields of psychology and information security.