The three categories of decision-making and information security