Behavioral Economics

Behavioral economics is the study of how psychological, cognitive, emotional, cultural, and social factors impact the economic decisions of individuals and institutions and how these factors influence market prices, returns, and resource allocation. It also studies the impact of different kinds of behavior in environments of varying experimental values. An overview of the topic can be found on Wikipedia (2018).

It is primarily concerned with the rational behavior of economic agents and the bounds of this behavior. In our case, we are interested in the rational behavior of cyberattackers and defenders. Behavioral models typically integrate insights from psychology, neuroscience, and microeconomic theory and, in our case, cybersecurity theory. The study of behavioral economics includes how financial decisions are made.

We have chosen to introduce this topic in a study of the behavioral aspects of cybersecurity because, as we have seen in previous chapters, we can often describe cybersecurity scenarios using an economics model. Among the leading scholars in this new branch of economics are Daniel Kahneman, Amos Tversky, and others. Three Nobel prizes in Economics have been awarded for this field of research in the past decade.

Origins of Behavioral Economics

In the 1960s, cognitive psychology began to shed more light on the brain as an information processing device (in contrast to behaviorist models). Scholars such as Amos Tversky and Daniel Kahneman began to compare their cognitive models of decisionmaking under risk and uncertainty to economic models of rational behavior.

It is suggested that humans take shortcuts that may lead to suboptimal decision-making.

A seminal work in introducing this field appeared in 1979, when Kahneman and Tversky published Prospect Theory: An Analysis of Decision under Risk, which used cognitive psychology to explain various divergences of economic decision-making from neoclassical theory.

Utility

Utility is a most interesting word in the English language, with many different connotations. In our case, it will not refer to the backup shortstop on a baseball team, nor the company that provides the distribution of electrical services to a community.

In economics, generally, and behavioral economics, in particular, the concept of utility is used to denote worth or value.

If you have a set of potential economic alternatives and you have a way of ordering these preferences in your favor, a utility function can represent those preferences if it is possible to assign a number to each alternative; then, also, you can say that alternative a is assigned a number greater than alternative b, if and only if you prefer alternative a to alternative b. Consider creating an example that will illustrate the thinking about maximizing utility over the first century-plus of utility theory. Suppose that we value a number of commodities at different levels. For the sake of the example, let us choose pairs of shoes, and let us say that we value them as follows:

Classical utility theory concludes that if you have a range of choices of different values, and every one of the choices increases in value by the same amount, the set of choices would remain the same. Going to our example in the chart, if a consumer decided that the greatest value to him or her would be the $30 sneakers, and if the shoe store next door to the original one was selling sneakers at the same prices also offering a free $30 gift bag, then the customer would still choose the sneakers among the other choices. In general, we describe the utility function as u(), i.e. u(Flip-flops) = $10, u(Sandals) = $20.

Challenge to Utility Theory

Here are two examples developed by Kahneman and Tversky (1979):

We first show that people give greater weight to outcomes that are considered certain relative to outcomes that are merely probable (the certainty effect). Here are two choice problems: The number of respondents who answered each problem is denoted by N, and the percentage of respondents who chose each option is given in brackets.

We will show the paradox demonstrated by these results. We assume that the specific choice chosen more often is indicated by the majority of results for the N subjects. In Table 16.1, 18% of the subjects chose A, and 82% chose B. But for the same subjects, when asked to choose for Table 16.2, 83% of the subjects chose C, and 17% chose D.

Clearly the subjects picked choice B from Table 16.1 by a substantial majority. The same respondents, when given Table 16.2, were even more definitive in choosing choice C over choice D.

TABLE 16.1

Choose between choices A and B Where You Would Receive a

Payoff in a Given Amount, Subject to the Corresponding

Probability

This pattern of preferences violates expected utility theory in the manner originally described by Allais.

According to that theory, with u(0) = 0, Table 16.1 implies, since choice B is preferred by the subjects over choice A:

0.33u(2500) + 0.66u(2400) < u(2400)

=> 0.33u(2500) > 0.34u(2400)

while the preference in Table 16.2 implies the reverse inequality:

0.33u(2500) < 0.34u(2400)

Note that Table 16.2 is obtained from Table 16.1 by eliminating a 0.66 chance of winning $2400 from both prospects under consideration. In other words, the representation of the choices from A and B to C and D is a constant. Classical utility theory would say that since the relationship between the choices has not changed, the preference for the outcome would not change. But this change produces a greater reduction in desirability when it alters the character of the prospect from a sure gain to a probable one than when both the original and the reduced prospects are uncertain. A simpler demonstration of the same phenomenon involving only two-outcome gambles is given in the following. This example is also based on Allais.

Again, according to classic utility theory, with u(0) = 0, Table 16.3 implies, since choice B is preferred by the subjects over choice A:

0.80u(4000) < u(3000)

while the preference in Table 16.4 implies the reverse inequality:

• 0.20u(4000) > 0.25u(3000) => 0.80u(4000) > u(3000)
• (multiply each side by 4)

In this pair of problems, as well as in all other problem pairs in this section, almost half the respondents (45%) violated expected utility theory by flipping from one side to the other. To show that the modal pattern of preferences in Tables 16.3 and 16.4 is not compatible with the theory, set u(0) = 0, and recall that the choice of B implies u(3000)/u(4000)>4/5, whereas the choice of C implies the reverse inequality.

TABLE 16.3

Choose Between

Result of testing the experiment with N = 95 subjects 20% 80%

TABLE 16.4

Choose Between

Result of testing the experiment with N = 95 subjects 65% 35%

TABLE 16.5

Choose between choices A and B Where You Would Receive a Nonmonetary Payoff in a Given Amount (Even Though the Subjects Could Perform a Conversion to a Monetary Value), Subject to the Corresponding Probability

Result of testing the experiment with N = 72 subjects 22% 78%

The examples of Tables 16.5 and 16.6 demonstrate that the same effect, the certainty effect, even when the outcomes are nonmonetary.

TABLE 16.6

Choose between choices A and B Where You Would Receive a Nonmonetary Payoff, Subject to the Corresponding Probability

Result of testing the experiment with N = 72 subjects 67% 33%

TABLE 16.7

Choose between choices A and B Where You Would Receive a Payoff in a Given Amount, Subject to the Corresponding Probability

Result of testing the experiment with N = 66 subjects 14% 86%

The same effect is also demonstrated when there is a significant probability of an outcome as opposed to when there is a possibility of winning, even though extremely remote. Where winning is possible but not probable, most people choose the prospect that offers the larger gain.

Note that in Table 16.7, the probabilities of winning are substantial (0.90 and 0.45), and most people chose the prospect where winning is more probable. In Table 16.8, there is a possibility of winning, although the probabilities of winning are minuscule (0.002 and 0.001) in both prospects. In this situation where winning is possible but not probable, most people chose the prospect that offers the larger gain.

TABLE 16.8

Choose between choices A and B Where You Would Receive a Payoff in a Given Amount, Subject to the Corresponding Probability

Result of testing the experiment with N = 66 subjects 73% 27%

Application of the Kahneman–Tversky Approach to Cybersecurity

Consider now the development of similar choice problems set in the cybersecurity environment. Suppose we have an attacker who has identified as a target for a ransomware attack a potential victim for which a hacker can assign a monetary value as a ransom.

The attacker can launch a ransomware attack for which he or she could estimate the likelihood of obtaining the ransom. He or she could configure the attack to request a ransom of either $2400 or $2500 and estimates that the lower level of ransom will, on the one hand (choice A), succeed 66% of the time for the $2400 ransom, but only 33% of the time for the larger ransom, and fail completely 1% of the time. Or, the attacker’s second choice would be to simply employ the $2400 ransom request, which it is felt would succeed 100% of the time.

Problem 16.1: Choose between choices A and B where you would receive a payoff in a given amount, subject to the corresponding probability.

Choice A

Choice B

Payoff Probability

$2500 0.33

$2400 0.66

$0 0.01

Payoff Probability

$2400 1.00

On the other hand, the attacker could make the following choices:

Problem 16.2: Choose between:

The numbers may seem familiar from the example in Table 16.2, and of course this is not by accident. Although this experiment has not yet been conducted (to our knowledge), if the results would be similar to the Allais-Kahneman-Tversky data, this would be very useful in comparing cybersecurity economic behavior to the more general research on microeconomics in the context of what we are learning in behavioral economics.

Nudge

Nudging is a subtle (or perhaps “stealth”) mechanism to influence behavior as opposed to direct education or legislation. Nudge is a concept in behavioral science, political theory, and economics that proposes positive reinforcement and indirect suggestions as ways to influence the behavior and decision-making of groups or individuals.

• • One of the most frequently cited examples of a nudge is the etching of the image of a housefly into the men’s room urinals at Amsterdam’s Schiphol Airport, which is intended to “improve the aim.” Men now had something to aim for—even subconsciously—and spillage is reduced by 80%.
• • Nudge theory urged healthier food be placed at sight level in order to increase the likelihood that a person will opt for that choice instead of less healthy option.
• • In some schools, the cafeteria lines are carefully laid out to display healthier foods to the students. In an experiment to determine its effect, it was shown that students in the healthy lines make better food choices, with sales of healthy food increasing by 18%.

Both Prime Minister David Cameron and President Barack Obama sought to employ nudge theory to advance domestic policy goals during their terms.

An Application of Nudge Theory to Cybersecurity

Suppose there are ten files, each containing some information of value, perhaps, for example, the location of a bank account. All of these files are encrypted on the host’s system. A cyberattacker is able to penetrate the system and determines that he or she has enough time before being detected to obtain the information from at least one of the ten encrypted files. For 9 of these 10 values, the file sizes are between 1 and 5 kB.

The tenth file, as established by the defender, is information of an economic value of only, say, $5.00. But on the other hand, the file is padded before printing so that the file size becomes 25 kB.

When the attacker finds the 10 encrypted files, he or she may be nudged toward the 10th file, of 25 kB, because the clear perception of the file size being greater than all the others would suggest the potential of greater value in successfully attacking that file. Of course, being nudged toward the 25 kB file will cause the attacker to have to spend considerably more effort to decrypt the file, thus increasing exposure to detection and capture.

Problems

• 1. Find your own sample of students to conduct the four Kahneman-Tversky choice problems. Compare your results to the published data.
• 2. Should one expect the aforementioned results to change depending on the sector of the economy utilized, for example, the cyberenvironment, for one case?
• 3. Find a number of examples of the application of nudge theory.

References

Kahneman, D. & Tversky, A. 1979. Prospect theory: An analysis of decision under risk. Econometrica. The Econometric Society, 47(2), 263-291. doi: 10.2307/1914185. JSTOR 1914185.

Wikipedia. 2018. Behavioral Economics, https://en.wikipedia.org/wiki/ Behavioral economics.