Abstract
There is considerable research being conducted on insider threats is directed to developing new technologies. At the same time, ex- isting technology is not being fully utilized because of non-technological issues that pertain to economics and the human dimension. Issues re- lated to how insiders actually behave are critical to ensuring that the best technologies are meeting their intended purpose. In our research, we have investigated accepted models of perceptions of risk and charac- teristics unique to insider threat, and we have introduced ordinal scales to these models to measure insider perceptions of risk. We have also in- vestigated decision theories, leading to a conclusion that Prospect The- ory, developed by Tversky and Kahneman, may be used to describe the risk-taking behavior of insiders and can be accommodated in our model. We discuss the results of validating that model with thirty-five senior information security executives from a variety of organizations. We also discuss how the model may be used to identify characteristics of insid- ers’ perceptions of risk and benefit, their risk-taking behavior and how to frame insider decisions.
