Issue No. 06 - November/December (2011 vol. 9)
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MSP.2011.99
Debin Liu , Websense
Ninghui Li , Purdue University
XiaoFeng Wang , Indiana University
L. Jean Camp , Indiana University
The authors propose an incentive-based access control (IBAC) that uses separate mechanisms for controlling aggregated risks and incentivizing users to reduce unnecessary risks. This mechanism encourages users to make necessary accesses while discouraging them from taking unnecessary risks. To achieve this, the authors introduce novel incentive mechanism based on contract theory. They demonstrate that Nash equilibriums can be achieved in which users' optimal strategy is performing the risk-mitigation efforts to minimize their organization's risk; the authors' human-subject studies empirically confirm these theoretical results.
Insider threat, access control, risk management, incentive engineering, human-subject experiment
D. Liu, X. Wang, N. Li and L. J. Camp, "Security Risk Management Using Incentives," in IEEE Security & Privacy, vol. 9, no. , pp. 20-28, 2011.