Incentive-Centered Design for Security

Security problems are incentives problems: we build defenses because people want to do things that (intentionally or inadvertently) cause harm. Yet, much research disregards systematic study of the motivations of smart, responsive, autonomous humans in the loop. Meanwhile, the maturing sciences of motivated behavior offer a growing body of theoretical, statistical, and laboratory evidence on systematic responses to motivations that can be incorporated in the system design toolkit. By adjusting incentives, it´s sometimes possible to induce bad guys to stay out, encourage good guys to improve secure practices, and discourage otherwise good guys with system access from becoming delinquent.