The best laid plans or lack thereof: Security decision-making of different stakeholder groups

TL;DR

This study investigates how different stakeholder groups in cybersecurity make decisions, revealing that expertise and team diversity do not necessarily lead to better security choices, and biases influence their understanding of defenses.

Contribution

It provides empirical evidence on decision-making differences among cybersecurity stakeholders and highlights that expertise alone does not guarantee better security decisions.

Findings

No group outperforms others in decision quality.

Expert biases affect understanding of security defenses.

Diverse team compositions do not significantly improve decision outcomes.

Abstract

Cyber security requirements are influenced by the priorities and decisions of a range of stakeholders. Board members and CISOs determine strategic priorities. Managers have responsibility for resource allocation and project management. Legal professionals concern themselves with regulatory compliance. Little is understood about how the security decision-making approaches of these different stakeholders contrast, and if particular groups of stakeholders have a better appreciation of security requirements during decision-making. Are risk analysts better decision makers than CISOs? Do security experts exhibit more effective strategies than board members? This paper explores the effect that different experience and diversity of expertise has on the quality of a team's cyber security decision-making and whether teams with members from more varied backgrounds perform better than those with more focused, homogeneous skill sets. Using data from 208 sessions and 948 players of a tabletop game run in the wild by a major national organization over 16 months, we explore how choices are affected by player background (e.g.,~cyber security experts versus risk analysts, board-level decision makers versus technical experts) and different team make-ups (homogeneous teams of security experts versus various mixes). We find that no group of experts makes significantly better game decisions than anyone else, and that their biases lead them to not fully comprehend what they are defending or how the defenses work.