Security when people matter: structuring incentives for user behavior

Humans are "smart components" in a system, but cannot be directly programmed to perform; rather, their autonomy must be respected as a design constraint and incentives provided to induce desired behavior. Sometimes these incentives are properly aligned, and the humans don't represent a vulnerability. But often, a misalignment of incentives causes a weakness in the system that can be exploited by clever attackers. Incentive-centered design tools help us understand these problems, and provide design principles to alleviate them. We describe incentive-centered design and some tools it provides. We provide a number of examples of security problems for which Incentive Centered Design might be helpful. We elaborate with a general screening model that offers strong design principles for a class of security problems. Categories and Subject Descriptors D.2.2 [Software Engineering]: Design Tools and Techniques; K.4.4 [Computers and Society]: Electronic Commerce--security; K.6.5 [...

• Type: Conference
• Year: 2007
• Where: ACMICEC
• Authors: Rick Wash, Jeffrey K. MacKie-Mason
• Keywords: ACMICEC 2007, Design, ECommerce, Incentive, Incentive-centered Design