A Prospect Theory approach to Security
Vilhelm Verendel · 2008
The correct control of security often depends on decisions under uncertainty. Using quantified information about risk, one may hope to achieve more precise control by making better decisions. We discuss and examine how Prospect Theory, the major descriptive theory of risky decisions, predicts such decisions will go wrong and if such problems may be corrected. 1 Can security decisions go wrong? Security is both a normative and descriptive problem. We would like to normatively follow how to make correct decisions about security, but also descriptively understand where security decisions may go wrong. According to Schneier [1], security risk is both a subjective feeling and an objective reality, and sometimes those two views are different so that we fail acting correctly. Assuming that people act on perceived rather than actual risks, we will sometimes do things we should avoid, and sometimes fail to act like we should. In security, people may both feel secure when they are not, and feel insecure when they are actually secure [1]. With the recent attempts in security that aim to quantifying security properties, also known as security metrics, we are interested in