The Economics of Information and Human Factors in Cybersecurity

To design and apply effective countermeasures to hacking and related threats, it helps to have some way to structure one’s educated guesses and inferences about hackers’ current activities and future moves. This is especially the case when the decision-maker must consider not only the risk of attack but the unquantifiable risk of an attack (i.e., uncertainty). Computer science is not a decision-making framework and, while obviously necessary, is not sufficient to guide the design and implementation of effective countermeasures. We show how to use Schelling’s focal points together with Kahneman & Tversky’s reference points and related concepts from behavioural economics to complement technical innovations and improve threat detection and deterrence