Choosing Protection: User Investments in Security Measures for Cyber Risk Management

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11836)


Firewalls, Intrusion Detection Systems (IDS), and cyber-insurance are widely used to protect against cyber-attacks and their consequences. The optimal investment in each of these security measures depends on the likelihood of threats and the severity of the damage they cause, on the user’s ability to distinguish between malicious and non-malicious content, and on the properties of the different security measures and their costs. We present a model of the optimal investment in the security measures, given that the effectiveness of each measure depends partly on the performance of the others. We also conducted an online experiment in which participants classified events as malicious or non-malicious, based on the value of an observed variable. They could protect themselves by investing in a firewall, an IDS or insurance. Four experimental conditions differed in the optimal investment in the different measures. Participants tended to invest preferably in the IDS, irrespective of the benefits from this investment. They were able to identify the firewall and insurance conditions in which investments were beneficial, but they did not invest optimally in these measures. The results imply that users’ intuitive decisions to invest resources in risk management measures are likely to be non-optimal. It is important to develop methods to help users in their decisions.


Decision making Cyber insurance Cybersecurity 



The research was partly funded by the Israel Cyber Authority through the Interdisciplinary Center for Research on Cyber (ICRC) at Tel Aviv University. This research was also supported by NCR2016NCR-NCR001-0002, MOE, and NTU.


  1. 1.
    Bajcsy, R., Benzel, T., et al.: Cyber defense technology networking and evaluation. Commun. ACM 47(3), 58–61 (2004)CrossRefGoogle Scholar
  2. 2.
    Ben-Asher, N., Meyer, J.: The triad of risk-related behaviors (TriRB): a three-dimensional model of cyber risk taking. Hum. Factors 60(8), 1163–1178 (2018)CrossRefGoogle Scholar
  3. 3.
    Bissell, K., Ponemon, L.: The cost of cybercrime - unlocking the value of improved cybersecurity protection (2019).
  4. 4.
    Borgida, E., Nisbett, R.E.: The differential impact of abstract vs. concrete information on decisions 1. J. Appl. Soc. Psychol. 7(3), 258–271 (1977)CrossRefGoogle Scholar
  5. 5.
    Botzer, A., Meyer, J., Bak, P., Parmet, Y.: Cue threshold settings for binary categorization decisions. J. Exp. Psychol.: Appl. 16(1), 1–15 (2010)Google Scholar
  6. 6.
    Botzer, A., Meyer, J., Borowsky, A., Gdalyahu, I., Shalom, Y.B.: Effects of cues on target search behavior. J. Exp. Psychol. 21(1), 73–88–539 (2014)Google Scholar
  7. 7.
    Bowen, B.M., Devarajan, R., Stolfo, S.: Measuring the human factor of cyber security. In: 2011 IEEE International Conference on Technologies for Homeland Security (HST), pp. 230–235. IEEE (2011)Google Scholar
  8. 8.
    Cavusoglu, H., Mishra, B., Raghunathan, S.: A model for evaluating it security investments. Commun. ACM 47(7), 87–92 (2004)CrossRefGoogle Scholar
  9. 9.
  10. 10.
  11. 11.
    Marcum, J.: A statistical theory of target detection by pulsed radar. IRE Trans. Inf. Theory 6(2), 59–267 (1960)MathSciNetCrossRefGoogle Scholar
  12. 12.
  13. 13.
    Meyer, J.: Conceptual issues in the study of dynamic hazard warnings. Hum. Factors 46(2), 196–204 (2004)CrossRefGoogle Scholar
  14. 14.
    Meyer, J., Sheridan, T.B.: The intricacies of user adjustment of system properties. Hum. Factors 59(6), 901–910 (2017)CrossRefGoogle Scholar
  15. 15.
    Möller, S., Ben-Asher, N., Engelbrecht, K.P., Englert, R., Meyer, J.: Modeling the behavior of users who are confronted with security mechanisms. Comput. Secur. 30(4), 242–256 (2011)CrossRefGoogle Scholar
  16. 16.
    Nevin, J.A.: Signal detection theory and operant behavior: a review of David M. Green and John A. Swets’ signal detection theory and psychophysics1. J. Exp. Anal. Behav. 12(3), 475 (1969)CrossRefGoogle Scholar
  17. 17.
    Pastore, R., Scheirer, C.: Signal detection theory: considerations for general application. Psychol. Bull. 81(12), 945 (1974)CrossRefGoogle Scholar
  18. 18.
    Tanner Jr., W.P., Swets, J.A.: A decision-making theory of visual detection. Psychol. Rev. 61(6), 401 (1954)CrossRefGoogle Scholar
  19. 19.
    de Vries, J.: What drives cybersecurity investment?: organizational factors and perspectives from decision-makers. Master’s thesis, System engineering, Policy Analysis and Management, Technical University Delft, Delft (2017)Google Scholar
  20. 20.
    West, R.: The psychology of security. Commun. ACM 51(4), 34 (2008)CrossRefGoogle Scholar
  21. 21.
    Wickens, T.D.: Elementary Signal Detection Theory. Oxford University Press, USA (2002)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  1. 1.Tel Aviv UniversityTel AvivIsrael
  2. 2.Nanyang Technological UniversitySingaporeSingapore

Personalised recommendations