"A Picture Is Worth a 1,000 Words": Quantitative Risk Management Using Visual Presentation of Information

We present a risk management decision aid for commanders conducting cyberwar operations. It combines deterministic multiobjective decision making (MODM) with the scatter diagram of statistics. We use MODM to capture the commander's preferences producing a two-attribute representation of risk for each management alternative: the likelihood to yield (a) less effectiveness and (b) more cost than critical values implied by the decision maker's preferences. Organizational subject matter expert (SME) information combined with nonparametric bootstrap simulation produces estimates of the uncertainty in these attributes. This information is then presented in the form of scatter diagrams for each risk management alternative. This presents a quantitative picture of the gambles likely to confront the commander. Risk preferences can now be expressed in a natural way without requiring the use of abstract gambles and construction of utility functions. We find bootstrapping of information from multiple SMEs greatly mitigates the effects of over confidence usually associated with SMEs. We illustrate implementation with a risk management problem in offensive cyberwar and conduct an experiment using real cyber warfare practitioners to assess the value of our aid. Results show (1) an increase in the ability of inexperienced personnel to choose alternatives on par with experienced personnel; (2) greater perception of the simultaneous risks of higher cost and deficient effectiveness; (3) mitigation of confusion or ambiguity from use of subjective terms; and (4) greater consensus in the selection of alternatives among practitioners.