Percolation Model of insider threats to assess the optimum number of rules

Abstract

Abstract-Rules, regulations, and policies are the basis of civilized society and are used to coordinate the activities of individuals who have a variety of goals and purposes. History has taught that over-regulation (too many rules) makes it difficult to compete and under-regulation (too few rules) can lead to crisis. This implies an optimal number of rules that avoids these two extremes. Rules create boundaries that define the latitude an individual has to perform their activities. This paper creates a Toy Model of a work environment and examines it with respect to the latitude provided to a normal individual and the latitude provided to an insider threat. Simulations with the Toy Model illustrate four regimes with respect to an insider threat: underregulated, possibly optimal, tipping-point, and over-regulated. These regimes depend up the number of rules (N) and the minimum latitude (L min ) required by a normal individual to carry out their activities. The Toy Model is then mapped onto the standard 1D Percolation Model from theoretical physics and the same behavior is observed. This allows the Toy Model to be generalized to a wide array of more complex models that have been well studied by the theoretical physics community and also show the same behavior. Finally, by estimating N and L min it should be possible to determine the regime of any particular environment.

Resilience of Cyber Systems with Over‐ and Underregulation

“…Then, the amount of DL between barriers is defined as L i = X i – X i –1 . The sum of all the DL amounts equals unity …”

“…As regulations become too restrictive, impeding people's ability to perform their jobs, people inevitably start to circumvent or outright disregard these regulations. Hence, in practice, the regulations might as well not exist . Additionally, as the number of rules exceeds a certain threshold, people are more likely to make mistakes and be less motivated to follow the rules .…”

“…Even though the influence of over‐ and underregulation on the system's performance has been widely discussed in the academic literature and there is a significant number of studies on how to change people's habits, the reports on quantitative modeling that incorporate both are lacking. Specifically, rule–risk models have been developed for analyzing individual behavior (e.g., Kepner et al …”

“…Hence, in practice, the regulations might as well not exist. (4,9,10) Additionally, as the number of rules exceeds a certain threshold, people are more likely to make mistakes and be less motivated to follow the rules. (11)(12)(13) Most people's objective is not to stay secure, but to get their job done.…”

Application of systems modeling and risk assessment to address real-world decision-making challenges

“…Nguyen et al (2015) use expert interviews and causal mapping to illustrate how small and medium enterprises in Vietnam can enhance their adaptive capacity to changing environmental conditions. Kepner et al (2015) build a percolation-based model for determining the optimal number of rules to create an organizational decision-making climate that minimizes the risks posed by insider threats. In the domain of environmental management, Foran et al (2015) develop a model to assess the potential cumulative effects of anthropogenic activities based on vulnerability of aquatic resources based on water quality, water quantity, and habitat value metrics.…”