Improving security decision under uncertainty: A multidisciplinary approach

Abstract

Security decision-making is a critical task in tackling security threats affecting a system or process. It often involves selecting a suitable resolution action to tackle an identified security risk. To support this selection process, decision-makers should be able to evaluate and compare available decision options. This article introduces a modelling language that can be used to represent the effects of resolution actions on the stakeholders' goals, the crime process, and the attacker. In order to reach this aim, we develop a multidisciplinary framework that combines existing knowledge from the fields of software engineering, crime science, risk assessment, and quantitative decision analysis. The framework is illustrated through an application to a case of identity theft.

Comparative Analysis of Crime Scripts: One CCTV Footage—Twenty-One Scripts

“…Specifically, his approach involves gaining a better understanding of offenders' operational requirements and decision-making process to identify a fuller range of possible intervention points [5]. Over the year this approach has become applied to a variety of problems [7][8][9][10][11][12], including joyriding and pickpocketing, as represented in Tables I and II [13] The quality of crime scripts is a concept built on the premise that some scripts are 'better' than others. Although this seems logical, we could not find any empirical evidence of this in the literature.…”

Toward a More Structured Crime Scripting Method

“…The information requirements can be divided into two categories: (i) those specifying what types of states, events or activities should be modelled and (ii) those specifying what aspects of those states/events/activities should be detailed. As an example, let us consider a study previously published by the authors [4]. First, after identifying the application of the crime scripts (i.e., assessing the potential effects of different interventions on a particular type of identity theft), we considered the purpose of the script, and concluded that it should represent successful attacks (e.g., sequences of actions that would result in identify theft despite the presence of the authentication system) as well as attacks that are unsuccessful as a direct or indirect effect of the measure.…”

“…accuracy, traceability) [12]. Although the need for assessing crime scripts was mentioned in several studies [4,12,20], none of the reviewed studies explicitly addressed this.…”

“…narratives, tables, or flowcharts-, and (4) Borrion [12], Hutchings and Holts [20], and Dehghanniri, Letier, and Borrion [4] suggested the need for assessing crime scripts.…”

“…This crime reduction approach is usually implemented by modifying environmental elements, processes and policies, and has been used successfully in tackling a variety crimes, including cybercrime [2], fraud [3], identity theft [4], theft [5], and drug manufacturing [6].…”