Multicriteria Decision Framework for Cybersecurity Risk Assessment and Management

Risk assessors and managers face many difficult challenges related to novel cyber systems. Among these challenges are the constantly changing nature of cyber systems caused by technical advances, their distribution across the physical, information, and sociocognitive domains, and the complex network structures often including thousands of nodes. Here, we review probabilistic and risk-based decision-making techniques applied to cyber systems and conclude that existing approaches typically do not address all components of the risk assessment triplet (threat, vulnerability, consequence) and lack the ability to integrate across multiple domains of cyber systems to provide guidance for enhancing cybersecurity. We present a decision-analysis-based approach that quantifies threat, vulnerability, and consequences through a set of criteria designed to assess the overall utility of cybersecurity management alternatives. The proposed framework bridges the gap between risk assessment and risk management, allowing an analyst to ensure a structured and transparent process of selecting risk management alternatives. The use of this technique is illustrated for a hypothetical, but realistic, case study exemplifying the process of evaluating and ranking five cybersecurity enhancement strategies. The approach presented does not necessarily eliminate biases and subjectivity necessary for selecting countermeasures, but provides justifiable methods for selecting risk management actions consistent with stakeholder and decisionmaker values and technical data.     

An Agent‐Based Model for Pathogen Persistence and Cross‐Contamination Dynamics in a Food Facility

We used an agent‐based modeling (ABM) framework and developed a mathematical model to explain the complex dynamics of microbial persistence and spread within a food facility and to aid risk managers in identifying effective mitigation options. The model explicitly considered personal hygiene practices by food handlers as well as their activities and simulated a spatially explicit dynamic system representing complex interaction patterns among food handlers, facility environment, and foods. To demonstrate the utility of the model in a decision‐making context, we created a hypothetical case study and used it to compare different risk mitigation strategies for reducing contamination and spread of Listeria monocytogenes in a food facility. Model results indicated that areas with no direct contact with foods (e.g., loading dock and restroom) can serve as contamination niches and recontaminate areas that have direct contact with food products. Furthermore, food handlers’ behaviors, including, for example, hygiene and sanitation practices, can impact the persistence of microbial contamination in the facility environment and the spread of contamination to prepared foods. Using this case study, we also demonstrated benefits of an ABM framework for addressing food safety in a complex system in which emergent system‐level responses are predicted using a bottom‐up approach that observes individual agents (e.g., food handlers) and their behaviors. Our model can be applied to a wide variety of pathogens, food commodities, and activity patterns to evaluate efficacy of food‐safety management practices and quantify contamination reductions associated with proposed mitigation strategies in food facilities.     

Cognitive Mapping Tools: Review and Risk Management Needs

Risk managers are increasingly interested in incorporating stakeholder beliefs and other human factors into the planning process. Effective risk assessment and management requires understanding perceptions and beliefs of involved stakeholders, and how these beliefs give rise to actions that influence risk management decisions. Formal analyses of risk manager and stakeholder cognitions represent an important first step. Techniques for diagramming stakeholder mental models provide one tool for risk managers to better understand stakeholder beliefs and perceptions concerning risk, and to leverage this new understanding in developing risk management strategies. This article reviews three methodologies for assessing and diagramming stakeholder mental models—decision‐analysis‐based mental modeling, concept mapping, and semantic web analysis—and assesses them with regard to their ability to address risk manager needs.     

A Framework for Estimating the Adverse Health Effects of Contamination Events in Water Distribution Systems and its Application

Intentional or accidental releases of contaminants into a water distribution system (WDS) have the potential to cause significant adverse health effects among individuals consuming water from the system. A flexible analysis framework is presented here for estimating the magnitude of such potential effects and is applied using network models for 12 actual WDSs of varying sizes. Upper bounds are developed for the magnitude of adverse effects of contamination events in WDSs and evaluated using results from the 12 systems. These bounds can be applied in cases in which little system‐specific information is available. The combination of a detailed, network‐specific approach and a bounding approach allows consequence assessments to be performed for systems for which varying amounts of information are available and addresses important needs of individual utilities as well as regional or national assessments. The approach used in the analysis framework allows contaminant injections at any or all network nodes and uses models that (1) account for contaminant transport in the systems, including contaminant decay, and (2) provide estimates of ingested contaminant doses for the exposed population. The approach can be easily modified as better transport or exposure models become available. The methods presented here provide the ability to quantify or bound potential adverse effects of contamination events for a wide variety of possible contaminants and WDSs, including systems without a network model.     

同类异质产品市场博弈Nash均衡最优策略模型

本文按照Nash均衡解的要求,建立同类异质产品市场用户需求分布及效用结构模型,导出不同定位的企业所实施竞争策略的若干最优条件,通过计算不同策略设计下产品相应的临界功能效用值,参与竞争的企业可找到适合于市场需求的最优决策。     

A Diagnostic Tree for Improving Production Line Performance

Improving performance of production systems is a critical but often unstructured activity. To help managers convert ad hoc or trial & error improvement efforts into efficient and systematic reviews, we develop a diagnostic tree which decomposes a performance improvement objective into successively more concrete sub‐objectives and finally into potential improvement strategies. Based on principles from the Operations Management literature, this tree is structured to enable a non‐specialist to better understand the links between corrective actions and performance. It also provides an important foundation for a principles‐based knowledge management system that couples the decision tree with a search engine for locating relevant documents within an intranet.     

Measuring the Dynamic Efficiency Costs of Regulators' Preferences: Municipal Water Utilities in the Arid West

Evidence suggests that municipal water utility administrators in the western US price water significantly below its marginal cost and, in so doing, inefficiently exploit aquifer stocks and induce social surplus losses. This paper empirically identifies the objective function of those managers, measures the deadweight losses resulting from their price‐discounting decisions, and recovers the efficient water pricing policy function from counterfactual experiments. In doing so, the estimation uses a “continuous‐but‐constrained‐ control” version of a nested fixed‐point algorithm in order to measure the important intertemporal consequences of groundwater pricing decisions.     

Overcoming Learning Aversion in Evaluating and Managing Uncertain Risks

Decision biases can distort cost‐benefit evaluations of uncertain risks, leading to risk management policy decisions with predictably high retrospective regret. We argue that well‐documented decision biases encourage learning aversion, or predictably suboptimal learning and premature decision making in the face of high uncertainty about the costs, risks, and benefits of proposed changes. Biases such as narrow framing, overconfidence, confirmation bias, optimism bias, ambiguity aversion, and hyperbolic discounting of the immediate costs and delayed benefits of learning, contribute to deficient individual and group learning, avoidance of information seeking, underestimation of the value of further information, and hence needlessly inaccurate risk‐cost‐benefit estimates and suboptimal risk management decisions. In practice, such biases can create predictable regret in selection of potential risk‐reducing regulations. Low‐regret learning strategies based on computational reinforcement learning models can potentially overcome some of these suboptimal decision processes by replacing aversion to uncertain probabilities with actions calculated to balance exploration (deliberate experimentation and uncertainty reduction) and exploitation (taking actions to maximize the sum of expected immediate reward, expected discounted future reward, and value of information). We discuss the proposed framework for understanding and overcoming learning aversion and for implementing low‐regret learning strategies using regulation of air pollutants with uncertain health effects as an example.     

Integrating Operational and Organizational Aspects in Interdependent Infrastructure Network Recovery

Managing risk in infrastructure systems implies dealing with interdependent physical networks and their relationships with the natural and societal contexts. Computational tools are often used to support operational decisions aimed at improving resilience, whereas economics‐related tools tend to be used to address broader societal and policy issues in infrastructure management. We propose an optimization‐based framework for infrastructure resilience analysis that incorporates organizational and socioeconomic aspects into operational problems, allowing to understand relationships between decisions at the policy level (e.g., regulation) and the technical level (e.g., optimal infrastructure restoration). We focus on three issues that arise when integrating such levels. First, optimal restoration strategies driven by financial and operational factors evolve differently compared to those driven by socioeconomic and humanitarian factors. Second, regulatory aspects have a significant impact on recovery dynamics (e.g., effective recovery is most challenging in societies with weak institutions and regulation, where individual interests may compromise societal well‐being). And third, the decision space (i.e., available actions) in postdisaster phases is strongly determined by predisaster decisions (e.g., resource allocation). The proposed optimization framework addresses these issues by using: (1) parametric analyses to test the influence of operational and socioeconomic factors on optimization outcomes, (2) regulatory constraints to model and assess the cost and benefit (for a variety of actors) of enforcing specific policy‐related conditions for the recovery process, and (3) sensitivity analyses to capture the effect of predisaster decisions on recovery. We illustrate our methodology with an example regarding the recovery of interdependent water, power, and gas networks in Shelby County, TN (USA), with exposure to natural hazards.     

A Decision Framework for Managing Risk to Airports from Terrorist Attack

This article presents an asset‐level security risk management framework to assist stakeholders of critical assets with allocating limited budgets for enhancing their safety and security against terrorist attack. The proposed framework models the security system of an asset, considers various threat scenarios, and models the sequential decision framework of attackers during the attack. Its novel contributions are the introduction of the notion of partial neutralization of attackers by defenders, estimation of total loss from successful, partially successful, and unsuccessful actions of attackers at various stages of an attack, and inclusion of the effects of these losses on the choices made by terrorists at various stages of the attack. The application of the proposed method is demonstrated in an example dealing with security risk management of a U.S. commercial airport, in which a set of plausible threat scenarios and risk mitigation options are considered. It is found that a combination of providing blast‐resistant cargo containers and a video surveillance system on the airport perimeter fence is the best option based on minimum expected life‐cycle cost considering a 10‐year service period.     

Reference model for collaborative management in the automotive industry

Changes in the competitive environment require corporate restructuring, strengthening the relationship between the participants in a supply chain, implementing inter-organisational collaborative actions. Different strategies for collaborative actions render the subject relevant to researchers and managers. Integration, cooperation and partnership are essential to the success of this restructuring; the practices in this subject will be treated as Collaborative Management. The main objective is to analyse and synthesise the requirements of Collaborative Management in the automotive industry. The multicase study begins with an exploratory study to identify the theoretical elements that involve collaborative activity between companies, followed by a multiple case study in order to analyse the collaborative strategies used by companies. With the data collected a reference model will be produced using the Enterprise Knowledge Development methodology under a collaborative management approach. The data will enable the systematic and consistent representation of the collaboration between companies, helping to clarify the Collaborative role, and the integration relationship with the inter-organisational managing strategies.     

A framework for optimizing managerial decision

There have been numerous attempts to analyze and formulate management problems within the general framework of Management Science and Operations Research, so as to help managers in their decision making problems. This paper focuses on the fundamental aspects of management decision making and introduces a conceptual framework in which problems of management and its different levels of functioning are systematically identified. Management problems are considered within two major categories: Enterprise and Operations problems. In spite of the difficulties in defining a clear-cut boundary between Enterprise and Operations problems, such a broad classification leads to three basic levels of management functioning, namely: Policy making, coordinating and implementation. The universal relationship among these three basic levels of functioning provides a basic functional element called the Management Triad. In contrast to classical higherarchial structure, triad structure provides a methodology to analyze relationships among different levels of management functions in terms of a given decision problem. It is demonstrated that for different decision making problems individuals can shift from one end of the triad to another and perform a different management function.A quantitative approach has been introduced for operations management decision making by adapting Shewhart's control chart philosophy which in turn provides for quasi-automated decisions for corrective action and also for filtering significant signals of change to appropriate management functioning levels.     

A conceptual framework for understanding the outsourcing decision

Outsourcing is an increasingly important initiative being pursued by corporations in North America and Europe in pursuit of improved efficiency. This paper provides a conceptual framework to assist managers in identifying and implementing outsourcing decisions. In particular, the framework suggests a way for managers to identify the pre- and post-contractual risks associated with outsourcing decisions along with strategies that can be implemented in the pre-contractual stage in order to mitigate those risks. Empirical findings from the ‘transactions cost' literature are referenced to illustrate elements of our conceptual framework.     

Application of the Precautionary Principle by Senior Policy Officials: Results of a Canadian Survey

Though use of the controversial precautionary principle in risk management has increasingly been recommended as a guide for the construction of public policy in Canada and elsewhere, there are few data available characterizing its use in risk management by senior public policymakers. Using established survey methodology we sought to investigate the perceptions and terms of application of the precautionary principle in this important subset of individuals. A total of 240 surveys were sent out to seven departments or agencies in the Canadian government. The overall survey response rate was 26.6%, and our findings need to be interpreted in the context of possible responder bias. Of respondents, the overwhelming majority perceived the precautionary principle and the management of risk as complementary, and endorsed a role for the precautionary principle as a general guideline for all risk management decisions. However, 25% of respondents responded that the lack of clarity of the definition of the principle was a limitation to its effective use. The majority of respondents viewed their own level of understanding of the precautionary principle as moderate. Risk managers appeared to favor an interpretation of the precautionary principle that was based on the seriousness and irreversibility of the threat of damage, and did not endorse as strongly the need for cost effectiveness in the measures taken as a precaution against such threats. In contrast with its perceived role as a general guideline, the application of the precautionary principle by respondents was highly variable, with >60% of respondents reporting using the precautionary principle in one-quarter or less of all risk management decisions. Several factors influenced whether the precautionary principle was applied with the perceived seriousness of the threat being considered the most influential factor. The overwhelming majority of risk managers felt that "preponderance of evidence" was the level of evidence required for precautionary action to be instituted against a serious negative event. Overall, the majority of respondents viewed the precautionary principle as having a significant and positive impact on risk management decisions. Importantly, respondents endorsed a net result of more good than harm to society when the precautionary principle was applied to the management of risk.     

Quality Provision with Heterogeneous Consumer Reservation Utilities

This study examines a firm's quality and price decisions when consumers differ not only in their willingness‐to‐pay for quality but also in their reservation utility for the basic product. We find that while the firm offers lower‐quality products when consumers' valuations for quality deteriorate, the optimal quality may increase with a negative shift in consumers' reservation utilities. We also investigate the optimal price and quality of the products within a vertically differentiated product line when the number of products is exogenously given. The existing literature shows that when consumers differ only in their willingness‐to‐pay for quality, the firm sets the efficient quality for consumers with the highest valuation for quality, whereas the concern for cannibalization pushes down the quality of inferior products. We find that when consumers are heterogeneous in both their reservation utility and valuation for quality, the concern for cannibalization may distort the quality upwards, even for consumers with the highest willingness‐to‐pay for quality. In addition, a low‐quality product may enjoy a higher profit margin than a high‐quality product within the product line.     

Bob Hayes: Forty Years of Leading Operations Management Into Uncharted Waters

The enormous contributions of Bob Hayes to Operations Management (OM) are reviewed. His early work made innovative contributions to probability theory and utility estimation that enabled existing Operations Research theory to be applicable to real problems. Later, inspired by field trips to Japanese and German manufacturers, he joined Kim Clark to conduct an ambitious study of 12 plants in three companies, establishing the impact on productivity of factors such as reject rate, work‐in‐process, and production rate variation. In the 1980s, when adoption of advanced manufacturing automation was in vogue, Bob joined Jai Jaikumar to offer a caution, that new manufacturing technologies required new ways of managing and that advanced technology coupled with obsolete management would produce poorer, not better, results. Perhaps Bob's greatest contribution was to raise OM to a more strategic level. With numerous coauthors, notably Steve Wheelwright, he provided a framework for corporate and manufacturing strategy and showed how to achieve alignment between the two, particularly in the choice of production processes. Recent papers articulated a vision for OM in which a focus on the issues of operating managers provides a consistent framework, but enables our research agenda to evolve as the world's economy changes.     

Decision Making,Risk and Gender: Are Managers Different?

This paper explores differences in the nature of decisions taken by males and females. Women are playing an increasingly important role in business management and managers are ultimately tested and evaluated in terms of their success in making decisions. Consequently any difference in the character and quality of decisions taken by male and female managers will have important implications for organizations. This paper reviews the literature, and reports two pieces of empirical work which investigate the connections between gender and decision making. The decision-making characteristics of males and females in a ‘non-managerial’ population in which the majority of individuals have not undergone formal management education are contrasted with a ‘managerial’ population of potential and actual managers who have undertaken such education. It is argued that women are often excluded from managerial positions of authority and leadership due to stereotypes, which have been constructed by observing ‘non-managerial’ populations at large. The paper concludes, however, that these stereotypes may not apply to managers as in the ‘managerial’ sub-population males and females display similar risk propensity and make decisions of equal quality.     

e‐Business and Supply Chain Management

In recent years, the area of Supply Chain Management has generated a substantial amount of interest both by managers and researchers. This interest has also been fueled by the growth in the development and application of e‐business technologies. These technologies enable the supply chain manager to make coordinated decisions by integrating the diverse and sometimes conflicting objectives of the various trading partners in a chain. The purpose of this paper is to: (a) highlight strategic and tactical issues for analyzing supply chains in an e‐business setting based on papers published in this special issue; and (b) describe future research opportunities in this emerging interdisciplinary area.     

Risk Preferences in Strategic Wildfire Decision Making: A Choice Experiment with U.S. Wildfire Managers

Federal policy has embraced risa management as an appropriate paradigm for wildfire management. Economic theory suggests that over repeated wildfire events, potential economic costs and risas of ecological damage are optimally balanced when management decisions are free from biases, risa aversion, and risa seeking. Of primary concern in this article is how managers respond to wildfire risa, including the potential effect of wildfires (on ecological values, structures, and safety) and the likelihood of different fire outcomes. We use responses to a choice experiment questionnaire of U.S. federal wildfire managers to measure attitudes toward several components of wildfire risa and to test whether observed risa attitudes are consistent with the efficient allocation of wildfire suppression resources. Our results indicate that fire managers’ decisions are consistent with nonexpected utility theories of decisions under risa. Managers may overallocate firefighting resources when the likelihood or potential magnitude of damage from fires is low, and sensitivity to changes in the probability of fire outcomes depends on whether probabilities are close to one or zero and the magnitude of the potential harm.