Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc observations, does not address the question, nor does it add value to the question.


Reading a PCWorld article titled, "VeriSign Hacked: What We Don't Know Might Hurt Us", I ran across a quote:

nCircle CTO Tim ‘TK’ Keanini points out that the hack itself isn’t the crux of the problem. No network is impervious, and a company as high-profile as VeriSign is a prime target. The key is that organizations need to do more to foster an environment where honesty and disclosure are valued. If the fear of negative consequences is greater than the incentive for quick disclosure and response, you end up with a situation where IT staff would rather hide evidence of a breach.

Guess in part this was the core of my question about "Business-to-Business Security Disclosure and Agreement" - that being how important reaching an operational agreement where an environment of honesty and disclosure are essentially to doing business.

That said, it's unclear how such an "economy of honesty" would work in the real world.

Are there any fact-based opinions on an "economy of honesty" that provide some insight into if it really is a logical step toward the both security of individuals and their ecosystems?

share|improve this question
2  
This is a good question. The only thing I could think of remotely close to this is the open source vs closed source debate. Please let me know if I am off topic here, but one of the main reasons Linux is open source is because of the idea that open sharing is more secure. The environment is one of openness. That being said, I don't think I acutally answered the question, anyone else? –  Jeff Feb 3 '12 at 18:29
2  
+1 @Jeff: Yes, it's a related topic, but not the same topic in my opinion. The original Open Source vs Closed Source Systems on Security.SE was in fact asked by me. Main difference is that internally "Closed Source Systems" might in fact be "Open Source" within the company [or not, doesn't matter in fact in this context] but having access to the system implementation is only indirectly related to an "economy of honesty"; which is more about communication in my opinion. –  blunders Feb 3 '12 at 22:38
    
One downside of incentivizing behavior - It is good behavior for employees to wear a "photobadge," a credential of some sort that can be checked. It was such a good idea that one company decided to incentivize catching people that didn't have their badge on. They made sure to issue safety lanyards to clip the badge to, so no one had an excuse for not wearing theirs. One employee took advantage of this, and would open the quick release then point out the person wasn't wearing their badge. The point is, you have to ensure employees don't game the system. –  Everett Aug 19 '12 at 14:50
    
@Everett: Thank you! -- If you have any suggestions for making the question more clear, please let me know, or feel free to edit the question directly. Again, thank you! –  blunders Aug 19 '12 at 14:54

7 Answers 7

up vote 1 down vote accepted
+100

Mission impossible?
I do not have research into implementing an 'economy of honesty' and it is my understanding that you will not find any. 'Honesty' is a moral value, and it is not effective for a business organization to engender moral values in people. It is my opinion that your question misses the mark based on the Keanini quote, which summarized a set of 'behaviors' as a value system he called 'honesty'.

Behaviors
What an organization can do, for which there is significant research, is modify behaviors. 'Behavioral Modification' would accomplish the goals of the Keanini quote, but I am not sure if it is what you are looking for, if you are hoping for an ethical/moral approach. Train a person to respond in pre-selected ways when presented with certain triggers. Ethics and morals need not be aligned in any particular way.

BJ Fogg
BJ Fogg has a large body of work on the subject, which incorporates technology with organizational behavioral change. His methods are what I use with my clients' users to affect a response to certain triggers. As a result, my users pro-actively seek me out without apology, fear, or reticence to deal with issues even if they caused them.

Personal Research
By using Fogg's approach, I shift user perception from seeing IT Security as a fragile monolithic infrastructure that they can break, into a dynamic system of pro-active countermeasures against threats. From here, I train my users to respond to certain triggers, like a local AV pop-up event (even though I am also alerted by the system) or receiving a phishing email. Their expected response is a simple behavior (send an email). There is nothing to 'fail' at, only a response to learn. If they notice a breach of any kind, even if they caused it, they send an email, or call if they want to. The perception I create is that the attackers are cunning, therefore succumbing to an attack is not their fault: the focus is on the attacker, not the employee. So, threats become a competition in the user's mind between the cunning of the attacker and the proper response of the employee (which, in my case, is to simply send an email). "Defeat an attacker with a single email". My engagement levels are very high.

The Goal
The question is: do you want 'Honest' people, or people who 'do' the right thing?

share|improve this answer
    
+1 Thanks for sharing; agree it's not an exact match, but of use none the less. Have you done simulated attacks (paired with awareness training) to benchmark user response to your training? If not, why? –  blunders Aug 21 '12 at 16:59
    
Simulated attacks are crucial to the process. The attacks themselves are the real training after the theory is covered. I do not benchmark the awareness training effectiveness, but the user response to the attacks. –  schroeder Aug 21 '12 at 17:06
    
Right, the awareness training is for users that enable an attack, or fail to report an attack even though they believe they stopped the attack. By benchmark, I meant have you done a baseline simulated attack to see what percent of users either enable or report the attack without training, then do training followed by another simulated attack that's paired with meaningful followup to the users? Point being that without a baseline, it's hard, if not impossible to tell what the effect was of the training; make sense? Thanks! –  blunders Aug 21 '12 at 17:35
    
Training is not remedial to me: it is unending evolution. The baseline before training is not important or informative to me. I want them to respond in a certain way to triggers that will change. All go through training, then constant increasingly complex attacks that are designed to make the user 'fail'. When they 'fail' they get training on recognizing the trigger. This means I can create new triggers for new threats. The benchmark I want is how far from 100% correct response to the most complex trigger they are as a whole. Think: "User as IDS". –  schroeder Aug 21 '12 at 18:13
1  
Incentives cannot be the focus, but rather, incentives are an indication to the user that they displayed the correct behavior. Once incentives become the focus, instead of the desired behavior, you are stuck with trying to make sure the incentives are relevant to the user, and that dispersing multiple incentives is scalable. But by focusing on the behavior, you can create a system that scales per user and per organization and you are free to change 'incentives' as needed. "If you see X, do Y" versus "if you do Y, you get Z". The latter is economy-based. The former is behavior-based. –  schroeder Aug 23 '12 at 14:40

If there is anything we know for certain, it is that people respond to incentives.

It is trivially true that an environment where employees are incentivised to hide mistakes from management does decrease the ability of management to identify and respond to internal failures. It is also trivially true that a company that is internally crippled in such a way that they cannot identify and respond to its failures is inherently less trustworthy than a company that can identify and respond to its own failures.

Internal failures and problems do not, as a rule, disappear by being buried; they instead tend to grow and metastasize more than a disclosed failure would precisely because the people dealing with the problem have fewer options available to them. If I don't want my mistake to become public, then my range of options in dealing with that mistake are severely limited, and I will end up choosing a less-than-optimal option that protects myself at the expense of the company.

So yes, an internal environment of honesty does increase overall security. Problems can be dealt with swiftly and cleanly, and catastrophes can be averted.

And certainly a company that has an internal environment that promotes honesty is more valuable to me as a customer than one that doesn't. But every manager thinks he fosters an environment of honesty; he wouldn't knowingly set out to encourage his subordinates to lie to him. Asking management whether or not their environment encourages honesty would be a pointless affair.

Instead, you have to look at the incentives.

If an employee sees a mistake -- perhaps his own, perhaps his supervisor, perhaps his subordinate, perhaps his coworker -- then what is his incentive to make that mistake known? What is his incentive to keep it quiet? And the person he tells; what it that person's incentive to keep it quiet?

The concept of an economy deals not just with money but rather with incentives. An economy of honesty is therefore an incentive structure that encourages honesty; be that an internal incentive structure or a structure of incentives between organizations.

share|improve this answer

If by “economy of honesty” the question is focused on the economic value of ethical and transparent business behavior as compared to unethical and hidden business behavior then economic factors favor the former.

Let’s start with legal and regulatory statutes. In this example we are talking about Symantec Corporation which is a NASDAQ listed corporation. They posted the fact in their required public filings because failure to do so would constitute a violation of their duties. That failure would have exposed them to potential lawsuits by stockholders as well as regulatory sanctions and fines. At this point we have answered the question about the value of honesty. For a publicly traded corporation honesty trumps the value of dishonesty. Enron, Tyco, and WorldCom are 21st century examples of this force in action.

Now we are left with the 'buried in small print' aspect of this example. It seems the small print keep the issue from those who would have fretted about the technical aspects of this event for over a year. Well, times up! We, the folks that fret about the integrity of companies like VeriSign and parent Symantec, are now aware of the compromise and an apparently less than forthcoming method of addressing it. The economic impact of that fact will be considerable in the coming months. Trust in that organization just took a large self-induced shellacking.

So to your question as to the “economy of honesty” I would ask as opposed to what? As opposed to the short term gain of a few months or years of quiet garnered by lighting the fuse on a ticking time bomb buried in a quarterly report? The good news is the economic value of honesty is in fine shape.

share|improve this answer
    
Not so sure, Symantec announced the acquisition agreement of VeriSign on May 19, 2010 and completed on August 9, 2010; meaning it's possible Symantec might have dumped the deal, if then knew about the hack, really have no idea though; and Symantec's stock is up today and this year. That said, I'm not looking for ad-hoc analysis, I'm looking for quantitative research; for example, Why be honest if honesty doesn't pay Harvard Business. –  blunders Feb 3 '12 at 20:21
1  
@blunders there are many studies of species that are 'dishonest' or parasitic such as the Cuckoos plus the current meme about corporations being criminally psychopathic by design and how that relates to their ecological economics. If that is your focus perhaps if you updated your question to narrow down the issue to the Harvard study you would get better responses. As for a daily stock price you should also check the twitter hit count on this issue and consider Moxie and PKI are getting another loud round of discussion with VeriSign as centerpiece. –  zedman9991 Feb 3 '12 at 20:58
1  
So, the behavioral economist suggested the the topic was really about the “economy of trust" and that "Trust: The Social Virtues and The Creation of Prosperity" by Francis Fukuyama was a good book on the subject, but does is also lacking the quantitative basis I'm looking for too. –  blunders Feb 7 '12 at 20:36
3  
Of course Bruce Schneier's new book 'Liars an Outliers' schneier.com/book-lo.html is a good read in this area. –  zedman9991 Feb 8 '12 at 13:40
2  
@blunders I can testify to it being a good read. I got a free signed copy from the man himself! :D –  Polynomial Aug 23 '12 at 11:48

Since you tagged your question with "incident-response", perhaps you may find this paper beneficial: Connected Giving: Ordinary People Coordinating Disaster Relief on the Internet (pdf). It is about volunteers establishing ad-hoc online groups and relationships to coordinate disaster relief after hurricane Katrina.

Search the document for two separate sections titled "developing trust". One of those sections cites several other papers on specific aspects of this subject.

share|improve this answer

There's a lot of research into trust done from an economic perspective. Starting with Game Theory like Nash and the Prisoner's Dilemma, research into how groups or individuals behave in n-player games and other experiments is an ongoing research topic.

Here's a searchable repository - with links to a ton of papers.

The basis for lots of these are "can people trust each other enough to make a risky but mutually beneficial deal if both play along?" which is the essence of the prisoner's dilemma, but presumably they are going a fair bit beyond it, since prisoner's dilemman's a bit simplistic for the complexity of this type of research.

Not sure how much of the context holds true with what you want - an environment where people are more open about reporting incidents... but it might be a start.

share|improve this answer

I don't know much about theories behind economics and don't have many facts but I do have an opinion I think most people will relate to.

Firstly I think it starts at the top. Big executives, CEOs or whatever need to worry less about the bottom line more about doing the right thing and doing that well. The companies that follow the business model, where they truly care about their product and their customers, are oftentimes more successful (in many ways) than the the companies that solely exist to turn a profit. These are the companies that respond well to incidents

The rest falls in to place from there. When the Higher-ups stress stability and excellence, other aspects of the environment will help employees not be afraid to report security compromises.

edit: But high-ups who don't only care about their company's bottom line? They are a dieing breed.

share|improve this answer

I read an article in IEEE Security&Privacy. Authors built a model to analyse the impacts on different vulnerabilities disclosure policies.

In there, you can find a reference to another article of one of the author, that seem to talk more about economics. I did not read that last one.

Hope it helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.