A Conceptual Framework to Study Socio-Technical Security

Ferreira, Ana; Huynen, Jean-Louis; Koenig, Vincent; Lenzini, Gabriele

doi:10.1007/978-3-319-07620-1_28

Cited by 15 publications

(13 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although this impact is clearly computable when it only concerns a limited control over a technological system (e.g., hiding some attributes in an access control system), it is not necessarily the case in general. Research in psychology tells us that decision-makers can be influenced (e.g., [11,23,10,5]), and there is a growing interest in using behavioural sciences when developing and implementing security products revealed recently (e.g., [15,20,24,18,6]). However, more research is needed to eventually provide a catalog of effects applicable to a decision-maker, together with a measure of their impact.…”

Section: Resultsmentioning

confidence: 99%

Nudging for Quantitative Access Control Systems

Morisset

Groβ

Moorsel

et al. 2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose in this paper a formal model for soft enforcement, where a decision-maker is influenced towards a decision, rather than forced to select that decision. This novel type of enforcement is particularly useful when the policy enforcer cannot fully control the environment of the decision-maker, as we illustrate in the context of attribute-based access control, by limiting the control over attributes. We also show that soft enforcement can improve the security of the system when the influencer is uncertain about the environment, and when neither forcing the decision-maker nor leaving them make their own selection is optimal. We define the general notion of optimal influencing policy, that takes into account both the control of the influencer and the uncertainty in the system.

show abstract

Section: Resultsmentioning

confidence: 99%

Nudging for Quantitative Access Control Systems

Morisset

Groβ

Moorsel

et al. 2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Indeed, it is impossible to model all security-relevant devices, protocols and behaviours in a single model. Typically, socio-technical models look at capturing organisational infrastructure (e.g., [10], [16], [18], [12]), but sometimes they can focus only on some aspects of human-computer interactions (e.g., [19], [6]).…”

Section: Socio-technical Models Versus Attack-defence Modelsmentioning

confidence: 99%

How to Generate Security Cameras: Towards Defence Generation for Socio-Technical Systems

Gadyatskaya

2016

Graphical Models for Security

View full text Add to dashboard Cite

Abstract. Recently security researchers have started to look into automated generation of attack trees from socio-technical system models. The obvious next step in this trend of automated risk analysis is automating the selection of security controls to treat the detected threats. However, the existing socio-technical models are too abstract to represent all security controls recommended by practitioners and standards. In this paper we propose an attack-defence model, consisting of a set of attack-defence bundles, to be generated and maintained with the sociotechnical model. The attack-defence bundles can be used to synthesise attack-defence trees directly from the model to offer basic attack-defence analysis, but also they can be used to select and maintain the security controls that cannot be handled by the model itself. Full version of this paper has appeared in GraMSec 2015, to be published by Springer.

show abstract

“…The international work towards threat models for socio-technical analysis has only just begun [34,54]. For example, it is as yet unclear how society shapes up users with a generally negative (that is, reluctant, impatient, etc.)…”

Section: The Socio-technical Perspectivementioning

confidence: 99%

“…It enables the researcher to take the guarantees of security and privacy that the technology establishes and to transmit them reliably and effectively to its users. For example, Bella et al have recently adopted it to analyse the TLS certificate validation ceremony [17], Huynen et al to identify critical decision points in the ceremonies that users follow to access WiFi networks via Hotspots [35], and Ferreira et al to outline a research framework [34].…”

Section: Introductionmentioning

confidence: 99%

Service security and privacy as a socio-technical problem

Bella

Curzon

Lenzini

2015

JCS

Self Cite

View full text Add to dashboard Cite

Abstract. The security and privacy of the data that users transmit, more or less deliberately, to modern services is an open problem. It is not solely limited to the actual Internet traversal, a sub-problem vastly tackled by consolidated research in security protocol design and analysis. By contrast, it entails much broader dimensions pertaining to how users approach technology and understand the risks for the data they enter. For example, users may express cautious or distracted personas depending on the service and the point in time; further, pre-established paths of practice may lead them to neglect the intrusive privacy policy offered by a service, or the outdated protections adopted by another.The approach that sees the service security and privacy problem as a socio-technical one needs consolidation. With this motivation, the article makes a threefold contribution. It reviews the existing literature on service security and privacy, especially from the socio-technical standpoint. Further, it outlines a general research methodology aimed at layering the problem appropriately, at suggesting how to position existing findings, and ultimately at indicating where a transdisciplinary task force may fit in. The article concludes with the description of the three challenge domains of services whose security and privacy we deem open socio-technical problems, not only due to their inherent facets but also to their huge number of users.

show abstract

A Conceptual Framework to Study Socio-Technical Security

Cited by 15 publications

References 25 publications

Nudging for Quantitative Access Control Systems

Nudging for Quantitative Access Control Systems

How to Generate Security Cameras: Towards Defence Generation for Socio-Technical Systems

Service security and privacy as a socio-technical problem

Contact Info

Product

Resources

About