Information handling in security solution decisions

Abstract

A security solution (SS) is a mechanism, process or procedure to handle security problems for an organization. The decision makers are responsible to choose and implement the SS for their organizations. For the selection of a decision, handling of information plays a very important role. The decision makers collect information both in explicit and implicit form, then take their decision based on trusting or distrusting that collected information. The way of collecting information and the way of using it are not well structured for them. Sometimes they do know how to collect information, but do not collect and analyze information in a structural way while making their security solution decisions (SSDs). Very often they collect information as knowledge, experience, and recommendation in both forms (explicit and implicit). This paper focuses on SSDs and in particular, how information is gathered and used in such decision processes. This paper also works on trust, how trust can reflect the status of a certain piece of information based on knowledge, experience, and recommendation. This paper conducts a survey to investigate how the decision makers (experienced and inexperienced participants in the survey) use empirical data (explicit information) and their knowledge and experience (implicit information) to deal with SSDs. The survey further studies the effect of implicit information in the answers provided by the experienced participates and observes that the variation in the answers provided by the experienced participants is larger than the answers provided by the inexperienced participants. © Springer Science+Business Media B.V. 2010.