The Community for Technology Leaders
Green Image
Issue No. 06 - November/December (2011 vol. 9)
ISSN: 1540-7993
pp: 20-28
Debin Liu , Websense
XiaoFeng Wang , Indiana University
Ninghui Li , Purdue University
L. Jean Camp , Indiana University
ABSTRACT
The authors propose an incentive-based access control (IBAC) that uses separate mechanisms for controlling aggregated risks and incentivizing users to reduce unnecessary risks. This mechanism encourages users to make necessary accesses while discouraging them from taking unnecessary risks. To achieve this, the authors introduce novel incentive mechanism based on contract theory. They demonstrate that Nash equilibriums can be achieved in which users' optimal strategy is performing the risk-mitigation efforts to minimize their organization's risk; the authors' human-subject studies empirically confirm these theoretical results.
INDEX TERMS
Insider threat, access control, risk management, incentive engineering, human-subject experiment
CITATION
Debin Liu, XiaoFeng Wang, Ninghui Li, L. Jean Camp, "Security Risk Management Using Incentives", IEEE Security & Privacy, vol. 9, no. , pp. 20-28, November/December 2011, doi:10.1109/MSP.2011.99
107 ms
(Ver )