Incentive-Centered Design in Information Security
ACM First Conference on Computers and Communications Security, 1993
6 Pages Posted: 26 Mar 2007 Last revised: 23 Jul 2013
Date Written: 1993
Abstract
Humans are smart components in a system, but cannot be directly programmed to perform; rather, their autonomy must be respected as a design constraint and incentives provided to induce desired behavior. Sometimes these incentives are properly aligned, and the humans don't represent a vulnerability. But often, a misalignment of incentives causes a weakness in the system that can be exploited by clever attackers. Incentive-centered design tools help us understand these problems, and provide design principles to alleviate them. We describe incentive-centered design and some tools it provides. We provide a number of examples of security problems for which incentive- centered design might be helpful. We elaborate with a general screening model that offers strong design principles for a class of security problems.
Suggested Citation: Suggested Citation