Using Prospect Theory to Investigate Decision-Making Bias within an Information Security Context

Information security is an issue that has increased greatly in importance to bothindustry executives as well as military leadership over the past decade. In this time bothpractitioner and academic circles have researched and developed practices and process tomore effectively handle information security. Even with growth in these areas there hasbeen almost no research conducted into how decision makers actually behave. This isproblematic because information security decision makers in the Department of Defensehave been observed exhibiting risk seeking behavior when making information securitydecisions that seemingly violate accepted norms. There are presently no models in theliterature that provide sufficient insight into this phenomenon.This study used Prospect Theory, developed by Kahneman and Tversky, as aframework to develop a survey in an effort to obtain insight into how decision makersactually behave while making information security decisions.