Characterizing Conflicting User Values for Cyber Authentication Using a Virtual Public Values Forum

摘要

Authentication is a major component in protecting the security of online user services. An effective implementation of security policies requires compliance from users, who are one class of key stakeholders in the cybersecurity policy decision problem. We examine this multiple stakeholder decision problem by conducting a virtual public values forum, a policy decision structuring methodology to characterize stakeholder values by eliciting essential trade-offs among conflicting objectives. We assess trade-offs for a sample of users to explore heterogeneity in user values and the relationship of trade-offs to both individual user characteristics and online context. We obtained responses from 265 online service users and elicited their trade-offs among three conflicting objectives related to authentication security: (1) maximizing security, (2) maximizing convenience, and (3) minimizing cost. Using an additive multiattrlbute value model with four attributes, we obtained scaling coefficients that denote the relative valuation of each attribute to the decision maker and discovered that for the attribute ranges considered, security followed by cost receive the highest priority; however, there is a group of respondents who consider convenience to have higher valuation than either cost or security. We also explore the relationships between user characteristics (self-efficacy, response efficacy, response cost, and perceived severity) and the calculated scaling coefficients.