Deriving Cyber Security Risks from Human and Organizational Factors – A Socio-technical Approach
| Autor: | Thomas Richard McEvoy, Stewart Kowalski |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2019 |
| Předmět: |
Sociotechnical system
lcsh:T58.5-58.64 lcsh:Information technology Human Factors Socio-technical Secure Behavior Computer security computer.software_genre Grounded theory Security culture Security Culture Systemic risk General Materials Science Narrative Business computer Risk analysis and management Qualitative research methodology Coding (social sciences) |
| Zdroj: | Complex Systems Informatics and Modeling Quarterly; No 18 (2019): Complex Systems Informatics and Modeling Quarterly; 47-64 Complex Systems Informatics and Modeling Quarterly, Vol 0, Iss 18, Pp 47-64 (2019) |
| ISSN: | 2255-9922 |
| Popis: | Cyber security risks are socio-technical in nature. They result not just from technical vulnerabilities but also, more fundamentally, from the degradation of working practices over time – which move an organization across the boundary of secure practice to a place where attacks will not only succeed, but also have a significantly greater impact on the organization. Yet current risk analysis and management methodologies are not designed to detect these kinds of systemic risks. We present an approach, devised in the field, to deriving these risks – using a qualitative research methodology, akin to grounded theory, but based on preset coding descriptors. This allows organizational and individual behavior identified during interviews, observations or document research to be thematically analyzed, collated and mapped to potential risks, linked to poor working practices. The resulting risk factors can be linked together forming “risk narratives”, showing how the degradation of working practices in one part of the organization can contribute to undermining its ability to respond to cyber security threats in another part of the organization. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|