Security Risk Management Using Incentives

The authors propose an incentive-based access control (IBAC) that uses separate mechanisms for controlling aggregated risks and incentivizing users to reduce unnecessary risks. This mechanism encourages users to make necessary accesses while discouraging them from taking unnecessary risks. To achieve this, the authors introduce novel incentive mechanism based on contract theory. They demonstrate that Nash equilibriums can be achieved in which users' optimal strategy is performing the risk-mitigation efforts to minimize their organization's risk; the authors' human-subject studies empirically confirm these theoretical results.