Decision-making and biases in cybersecurity capability development: Evidence from a simulation game experiment

We developed a simulation game to study the effectiveness of decision-makers in overcoming two complexities in building cybersecurity capabilities: potential delays in capability development; and uncertainties in predicting cyber incidents. Analyzing 1479 simulation runs, we compared the performance...

Full description

Bibliographic Details
Main Authors: Jalali, Seyed Mohammad Javad (Contributor), Siegel, Michael D (Contributor), Madnick, Stuart E (Contributor)
Other Authors: Sloan School of Management (Contributor)
Format: Article
Language:English
Published: Elsevier, 2019-02-27T15:06:56Z.
Subjects:
Online Access:Get fulltext
LEADER 01758 am a22002053u 4500
001 120555
042 |a dc 
100 1 0 |a Jalali, Seyed Mohammad Javad  |e author 
100 1 0 |a Sloan School of Management  |e contributor 
100 1 0 |a Jalali, Seyed Mohammad Javad  |e contributor 
100 1 0 |a Siegel, Michael D  |e contributor 
100 1 0 |a Madnick, Stuart E  |e contributor 
700 1 0 |a Siegel, Michael D  |e author 
700 1 0 |a Madnick, Stuart E  |e author 
245 0 0 |a Decision-making and biases in cybersecurity capability development: Evidence from a simulation game experiment 
260 |b Elsevier,   |c 2019-02-27T15:06:56Z. 
856 |z Get fulltext  |u http://hdl.handle.net/1721.1/120555 
520 |a We developed a simulation game to study the effectiveness of decision-makers in overcoming two complexities in building cybersecurity capabilities: potential delays in capability development; and uncertainties in predicting cyber incidents. Analyzing 1479 simulation runs, we compared the performances of a group of experienced professionals with those of an inexperienced control group. Experienced subjects did not understand the mechanisms of delays any better than inexperienced subjects; however, experienced subjects were better able to learn the need for proactive decision-making through an iterative process. Both groups exhibited similar errors when dealing with the uncertainty of cyber incidents. Our findings highlight the importance of training for decision-makers with a focus on systems thinking skills, and lay the groundwork for future research on uncovering mental biases about the complexities of cybersecurity. Keywords: Cybersecurity; Decision-making; Simulation; Capability development 
655 7 |a Article 
773 |t Journal of Strategic Information Systems