Title: "Perfect is the Enemy of Good": The CISO's Role in Enterprise Security as a Business Enabler
Chief Information Security Officers (CISOs) are responsible for setting and executing organizations’ information security strategies. This role has only grown in importance as a result of today’s increasingly high-stakes threat landscape. To understand these key decision-makers, we interviewed 16 current and former CISOs to understand how they build a security strategy and the day-to-day obstacles that they face. Throughout, we find that the CISO role is strongly shaped by a business enablement perspective, driven by broad organizational goals beyond solely technical protection. Within that framing, we describe the most salient concerns for CISOs, isolate key decision-making factors they use when prioritizing security investments, and surface practical complexities and pain points that they face in executing their strategy. Our results surface opportunities to help CISOs better navigate the complex task of managing organizational risk, as well as lessons for how security tools can be made more deployable in practice.  more » « less
Award ID(s):
2319080
PAR ID:
10656499
Author(s) / Creator(s):
; ; ; ; ; ;
Publisher / Repository:
ACM CHI conference on Human Factors in Computing Systems
Date Published:
Format(s):
Medium: X
Sponsoring Org:
National Science Foundation
More Like this
  1. How do organizational structures influence organizational decision making? This article reveals organizational structures’ dual function: they both (1) aggregate and (2) shape individuals’ decisions. What makes this dual function so remarkable is that the two effects are diametrically opposed to one another. Ceteris paribus, a less stringent decision-making structure reduces the amount of support required for a given project to be greenlit at the organizational level, which should result in more investments getting approved. However, we find that this ceteris paribus assumption does not hold, because a less stringent decision-making structure also reduces individuals’ tendency to provide their support for an investment. Our experimental investigation of organizational voting provides evidence for our position that organizational structure plays an important role beyond mere aggregation: voting thresholds also affect individuals’ voting behavior. The combination of both effects explains why the organizational adoption of a new voting threshold may not yield the intended outcome. Funding: This work was supported by a National Science Foundation CAREER Award from the Directorate for Social, Behavioral and Economic Sciences [Grant 1943688] granted to O. Schilke. Supplemental Material: The online appendices are available at https://doi.org/10.1287/orsc.2023.1653 . 
    more » « less
  2. Abstract This paper develops the concept of flood problem framing to understand decision-makers’ priorities in flood risk management in the Los Angeles Metropolitan Region in California (LA Metro). Problem frames shape an individual’s preferences for particular management strategies and their future behaviors. While flooding is a complex, multifaceted problem, with multiple causes and multiple impacts, a decision-maker is most likely to manage only those dimensions of flooding about which they are aware or concerned. To evaluate flood decision-makers’ primary concerns related to flood exposure, vulnerability, and management in the LA Metro, we draw on focus groups with flood control districts, city planners, nonprofit organizations, and other flood-related decision-makers. We identify numerous concerns, including concerns about specific types of floods (e.g., fluvial vs pluvial) and impacts to diverse infrastructure and communities. Our analyses demonstrate that flood concerns aggregate into three problem frames: one concerned with large fluvial floods exacerbated by climate change and their housing, economic, and infrastructure impacts; one concerned with pluvial nuisance flooding, pollution, and historic underinvestment in communities; and one concerned with coastal and fluvial flooding’s ecosystem impacts. While each individual typically articulated concerns that overlapped with only one problem frame, each problem frame was discussed by numerous organization types, suggesting low barriers to cross-organizational coordination in flood planning and response. This paper also advances our understanding of flood risk perception in a region that does not face frequent large floods. Significance Statement This paper investigates the primary concerns that planners, flood managers, and other decision-makers have about flooding in Southern California. This is important because the way that decision-makers understand flooding shapes the way that they will plan for and respond to flood events. We find that some decision-makers are primarily concerned with large floods affecting large swaths of infrastructure and housing; others are concerned with frequent, small floods that mobilize pollution in low-income areas; and others are concerned with protecting coastal ecosystems during sea level rise. Our results also highlight key priorities for research and practice, including the need for flexible and accessible flood data and education about how to evacuate. 
    more » « less
  3. Youth, while tech-savvy and highly active on social media, are still vulnerable to online privacy and security risks. Therefore, it is critical to understand how they negotiate and manage social connections versus protecting themselves in online contexts. In this work, we conducted a thematic analysis of 1,318 private conversations on Instagram from 149 youth aged 13-21 to understand the digital privacy and security topics they discussed, if and how they engaged in risky privacy behaviors, and how they balanced the benefits and risks (i.e., privacy calculus) of making these decisions. Overall, youth were forthcoming when broaching a wide range of topics on digital privacy and security, ranging from password management and account access challenges to shared experiences of being victims of privacy risks. However, they also openly engaged in risky behaviors, such as sharing personal account information with peers and even perpetrating privacy and security risks against others. Nonetheless, we found many of these behaviors could be explained by the unique ''privacy calculus'' of youth, where they often prioritized social benefits over potential risks; for instance, youth often shared account credentials with peers to foster social connection and affirmation. As such, we provide a nuanced understanding of youth decision-making regarding digital security and privacy, highlighting both positive behaviors, tensions, and points of concern. We encourage future research to continue to challenge the potentially untrue narratives regarding youth and their digital privacy and security to unpack the nuance of their privacy calculus that may differ from that of adults. 
    more » « less
  4. null (Ed.)
    Design can be seen as a series of decisions that are informed by information that the designer has gathered from the environment and transformed into actionable knowledge. The sheer volume and variety of available information compels designers to impose structure upon the desired information, which in turn may affect subsequent design activities. To better understand how information may inform design decisions, this study investigates the relationship between designers’ information organization behaviors and their generated ideas by recruiting eight professionals (four from software design and four from graphic design) for individual 3-hour design sessions. They were asked to generate ideas for a design problem (reducing pedestrian accidents in Nebraska) using the provided information. Results reveal that designers structured the information in three different ways (Clusters, Relations, and Nests), and both designer background and organizational strategy display different roles in the features generated in their ideas. 
    more » « less
  5. Background: A person’s cultural background shapes how they interpret and navigate problems. Given that large numbers of international researchers work and train in the U.S. we sought to better understand how researchers use the decision-making strategy of seeking help to navigate ethical and professional challenges.Methods: Participants (N = 300) were researchers working or training in the U.S. who were born in East Asia (EA) or born in the U.S. They completed a screening survey; then a subset completed think-aloud interviews (n = 66) focused on how they would respond to three hypothetical research scenarios.Results: Thematic analysis of the transcripts showed that seeking help was a commonly endorsed strategy, with some nuances between groups. Themes included seeking help in the form of getting advice, seeking someone to help solve the problem, and gathering information. Endorsement of the seeking help strategy frequently depended on participants’ relationships; desiring to seek help from people they trusted. Notably, EA participants tended to prefer seeking help in ways that avoided reputational harm to others.Conclusion: A better understanding of how researchers from different cultural backgrounds use decision-making strategies can inform how to make educational programs more inclusive and comprehensive to more effectively develop researchers’ ethical and professional decision-making skills. 
    more » « less