Dynamic awareness and strategic adaptation in cybersecurity : a game-theory approach

Awareness and human factors are becoming ever more important in cybersecurity, particularly in the context of small companies that may need more resources to deal with cybersecurity effectively. This paper introduces a theoretical framework for game analysis of the role of awareness in strategic interactions between the manager and a hacker. A computable approach is proposed based on Bayesian updating to model awareness in a cybersecurity context. The process of gaining awareness considers the manager's perception of the properties of the hacker's actions, game history, and common knowledge. The role of awareness in strategy choices and outcomes is analyzed and simulated, providing insights into decision-making processes for managers and highlighting the need to consider probabilistic assessments of threats and the effectiveness of countermeasures. The accuracy of the initial frequencies plays a significant role in the manager's success, with aligned frequencies leading to optimal results. Inaccurate information on prior frequencies still outperforms complete uncertainty, emphasizing the value of any available intelligence. However, the results suggest that other awareness modeling approaches are necessary to enhance the manager's agility and adaptiveness when the prior frequencies do not reflect the immediate attacker's type, indicating the need for improved intelligence about cyber-attacks and examinations of different awareness modeling approaches.