Less is more

Abstract

In the last few years the amount of witnessed accidents (such as stolen information) following from cyber-attacks has increased. It is considered that organisations cannot keep up with adversaries by themselves anymore. For that reason organisations would have to collaborate with each other, by sharing information, to improve each other’s awareness of cyber security related matters. However, it is unknown how such collaborations would have to look like. The collaborations that are already implemented differ quite a bit. Some are very large, consisting of organisations that are active in different sectors, and other collaborations are actually small and ad-hoc collaborations between rather similar organisations. This research project focused on identifying factors that determine the design of a collaboration. The main goal was to determine what the default collaboration design should be in order for organisations to be able to share pragmatic information. The main findings are that collaborations should be rather small for organisations to be able and willing to productively share information with each other. With large collaborations the differences between organisations will increase. Their views on the reality of cyber security differ in various ways. Because of this, the ability of the organisations to productively share information is affected. But furthermore, with increases in differences between organisations, the willingness of such organisations to share sensitive information can be affected. They have a harder time assessing trustworthiness. For that reason they might opt for extensive use of contracts (with negative consequences in the long run) or refrain from sharing the sensitive information. Future research should focus on validating the findings of this research empirically. But also future research should further study the constituents of pragmatic information sharing collaborations.