Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Vista
Digg this story   Add to del.icio.us  
The Principal-Agent Problem in Security
adam, Emergent Chaos 2008-03-26
There's a fascinating article in the New York Times, "At Bear Stearns, Meet the New Boss." What makes it fascinating is the human emotion displayed:
“In this room are people who have built this firm and lost a lot, our fortunes,” one Bear executive said to Mr. Dimon with anger in his voice. “What will you do to make us whole?”

The packed room of senior managing directors applauded.

Mr. Dimon responded gingerly. “You’re acting like it’s our fault, and it’s not. If you stay we will make you happy.”

But the Bear employee was not satisfied. “I think it’s galling you come into our house and you call this a ‘merger,’ ” the Bear executive went on.

Now, there's an easy slam on that exec, but I'd like to do better than that. There's a very real desire to not go from the mansion to the poorhouse overnight. Picking arbitrary numbers of shares, on Friday, this fellow might have held 10,000 shares, worth $300,000, representing a large fraction of his savings. Monday morning, it was worth $20,000. He's worried about how he's going to pay for his kid's education or his next vacation. (There's more excellent analysis in Jeffrey Lipshaw's "Exuberant Bulls, Rueful Bears, and Rational Frogs"

People's concerns, first and foremost, are for themselves.

People who work in security are often deeply concerned with security, because it's the thing that makes or breaks their careers. They're focused on the impact of security on them, as well as their business. So sometimes they make choices which aren't perfect for the business, but take their perspectives into account. It's only human.

Nick Owen talks a bit about the motives of security chiefs in "On the short tenure of CISOs and low-frequency, high-impact events." (Damnit, Nick, I should have seen that. Now you're banned from the prom.) ((Which is yet another instance of a principal-agent problem. I'd like to appear smarter and more insightful than Nick, so I have to ensure I don't link to him.))

Economists call this set of issues principal-agent problems, with the classic example being Alice hiring Bob to sell a car that she doesn't have time to sell. How does she know that he's not selling it to a friend? Economists are generally worried about the CEO, but the thinking can and should be applied across a company. How do you ensure people's motives are well aligned with that of the business and it's shareholders?

Nick Szabo has some interesting points about "representation distances" in a political analysis of principal agent problems. I'm surprised that he talks about the distance from one agent to a group. I would think that the interesting questions involve average distances between various groups and agents, and the tensions between them.




The information, views, and opinions contained on this page are those of the author and do not necessarily reflect the views and opinions of SecurityFocus.






 

Privacy Statement
Copyright 2007, SecurityFocus