Fostering an environment where honesty and disclosure are valued

Question

UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc observations, does not address the question, nor does it add value to the question.

---

Reading a PCWorld article titled, "VeriSign Hacked: What We Don't Know Might Hurt Us", I ran across a quote:

nCircle CTO Tim ‘TK’ Keanini points out that the hack itself isn’t the crux of the problem. No network is impervious, and a company as high-profile as VeriSign is a prime target. The key is that organizations need to do more to foster an environment where honesty and disclosure are valued. If the fear of negative consequences is greater than the incentive for quick disclosure and response, you end up with a situation where IT staff would rather hide evidence of a breach.

Guess in part this was the core of my question about "Business-to-Business Security Disclosure and Agreement" - that being how important reaching an operational agreement where an environment of honesty and disclosure are essentially to doing business.

That said, it's unclear how such an "economy of honesty" would work in the real world.

Are there any fact-based opinions on an "economy of honesty" that provide some insight into if it really is a logical step toward the both security of individuals and their ecosystems?

Answer 1

Mission impossible?
I do not have research into implementing an 'economy of honesty' and it is my understanding that you will not find any. 'Honesty' is a moral value, and it is not effective for a business organization to engender moral values in people. It is my opinion that your question misses the mark based on the Keanini quote, which summarized a set of 'behaviors' as a value system he called 'honesty'.

Behaviors
What an organization can do, for which there is significant research, is modify behaviors. 'Behavioral Modification' would accomplish the goals of the Keanini quote, but I am not sure if it is what you are looking for, if you are hoping for an ethical/moral approach. Train a person to respond in pre-selected ways when presented with certain triggers. Ethics and morals need not be aligned in any particular way.

BJ Fogg
BJ Fogg has a large body of work on the subject, which incorporates technology with organizational behavioral change. His methods are what I use with my clients' users to affect a response to certain triggers. As a result, my users pro-actively seek me out without apology, fear, or reticence to deal with issues even if they caused them.

Personal Research
By using Fogg's approach, I shift user perception from seeing IT Security as a fragile monolithic infrastructure that they can break, into a dynamic system of pro-active countermeasures against threats. From here, I train my users to respond to certain triggers, like a local AV pop-up event (even though I am also alerted by the system) or receiving a phishing email. Their expected response is a simple behavior (send an email). There is nothing to 'fail' at, only a response to learn. If they notice a breach of any kind, even if they caused it, they send an email, or call if they want to. The perception I create is that the attackers are cunning, therefore succumbing to an attack is not their fault: the focus is on the attacker, not the employee. So, threats become a competition in the user's mind between the cunning of the attacker and the proper response of the employee (which, in my case, is to simply send an email). "Defeat an attacker with a single email". My engagement levels are very high.

The Goal
The question is: do you want 'Honest' people, or people who 'do' the right thing?

Answer 2

If there is anything we know for certain, it is that people respond to incentives.

It is trivially true that an environment where employees are incentivised to hide mistakes from management does decrease the ability of management to identify and respond to internal failures. It is also trivially true that a company that is internally crippled in such a way that they cannot identify and respond to its failures is inherently less trustworthy than a company that can identify and respond to its own failures.

Internal failures and problems do not, as a rule, disappear by being buried; they instead tend to grow and metastasize more than a disclosed failure would precisely because the people dealing with the problem have fewer options available to them. If I don't want my mistake to become public, then my range of options in dealing with that mistake are severely limited, and I will end up choosing a less-than-optimal option that protects myself at the expense of the company.

So yes, an internal environment of honesty does increase overall security. Problems can be dealt with swiftly and cleanly, and catastrophes can be averted.

And certainly a company that has an internal environment that promotes honesty is more valuable to me as a customer than one that doesn't. But every manager thinks he fosters an environment of honesty; he wouldn't knowingly set out to encourage his subordinates to lie to him. Asking management whether or not their environment encourages honesty would be a pointless affair.

Instead, you have to look at the incentives.

If an employee sees a mistake -- perhaps his own, perhaps his supervisor, perhaps his subordinate, perhaps his coworker -- then what is his incentive to make that mistake known? What is his incentive to keep it quiet? And the person he tells; what it that person's incentive to keep it quiet?

The concept of an economy deals not just with money but rather with incentives. An economy of honesty is therefore an incentive structure that encourages honesty; be that an internal incentive structure or a structure of incentives between organizations.

Answer 3

If by “economy of honesty” the question is focused on the economic value of ethical and transparent business behavior as compared to unethical and hidden business behavior then economic factors favor the former.

Let’s start with legal and regulatory statutes. In this example we are talking about Symantec Corporation which is a NASDAQ listed corporation. They posted the fact in their required public filings because failure to do so would constitute a violation of their duties. That failure would have exposed them to potential lawsuits by stockholders as well as regulatory sanctions and fines. At this point we have answered the question about the value of honesty. For a publicly traded corporation honesty trumps the value of dishonesty. Enron, Tyco, and WorldCom are 21st century examples of this force in action.

Now we are left with the 'buried in small print' aspect of this example. It seems the small print keep the issue from those who would have fretted about the technical aspects of this event for over a year. Well, times up! We, the folks that fret about the integrity of companies like VeriSign and parent Symantec, are now aware of the compromise and an apparently less than forthcoming method of addressing it. The economic impact of that fact will be considerable in the coming months. Trust in that organization just took a large self-induced shellacking.

So to your question as to the “economy of honesty” I would ask as opposed to what? As opposed to the short term gain of a few months or years of quiet garnered by lighting the fuse on a ticking time bomb buried in a quarterly report? The good news is the economic value of honesty is in fine shape.

Answer 4

Since you tagged your question with "incident-response", perhaps you may find this paper beneficial: Connected Giving: Ordinary People Coordinating Disaster Relief on the Internet (pdf). It is about volunteers establishing ad-hoc online groups and relationships to coordinate disaster relief after hurricane Katrina.

Search the document for two separate sections titled "developing trust". One of those sections cites several other papers on specific aspects of this subject.

Answer 5

There's a lot of research into trust done from an economic perspective. Starting with Game Theory like Nash and the Prisoner's Dilemma, research into how groups or individuals behave in n-player games and other experiments is an ongoing research topic.

Here's a searchable repository - with links to a ton of papers.

The basis for lots of these are "can people trust each other enough to make a risky but mutually beneficial deal if both play along?" which is the essence of the prisoner's dilemma, but presumably they are going a fair bit beyond it, since prisoner's dilemman's a bit simplistic for the complexity of this type of research.

Not sure how much of the context holds true with what you want - an environment where people are more open about reporting incidents... but it might be a start.

Answer 6

I don't know much about theories behind economics and don't have many facts but I do have an opinion I think most people will relate to.

Firstly I think it starts at the top. Big executives, CEOs or whatever need to worry less about the bottom line more about doing the right thing and doing that well. The companies that follow the business model, where they truly care about their product and their customers, are oftentimes more successful (in many ways) than the the companies that solely exist to turn a profit. These are the companies that respond well to incidents

The rest falls in to place from there. When the Higher-ups stress stability and excellence, other aspects of the environment will help employees not be afraid to report security compromises.

edit: But high-ups who don't only care about their company's bottom line? They are a dieing breed.

Answer 7

I read an article in IEEE Security&Privacy. Authors built a model to analyse the impacts on different vulnerabilities disclosure policies.

In there, you can find a reference to another article of one of the author, that seem to talk more about economics. I did not read that last one.

Hope it helps.