Reducing normative conflicts in information security

Abstract

Security weaknesses often stem from users trying to comply with social expectations rather than following security procedures. Such normative conflicts between security policies and social norms are therefore undesirable from a security perspective. It has been argued that system developers have a "meta-task responsibility", meaning that they have a moral obligation to enable the users of the system they design to cope adequately with their responsibilities. Depending on the situation, this could mean forcing the user to make an "ethical" choice, by "designing out" conflicts. In this paper, we ask the question to what extent it is possible to detect such potential normative conflicts in the design phase of security-sensitive systems, using qualitative research in combination with so-called system models. We then envision how security design might proactively reduce conflict by (a) designing out conflict where possible in the development of policies and systems, and (b) responding to residual and emergent conflict through organisational processes. The approach proposed in this paper is a so-called subcultural approach, where security policies are designed to be culturally sympathetic. Where normative conflicts either cannot be avoided or emerge later, the organisational processes are used to engage with subcultures to encourage communally-mediated control.

I'm OK, You're OK, the System's OK

“…This will include implementation of intrusion detection techniques that build on our results in [31,32]. We are also interested in exploring the role of social and behavioral norms in human-computer interaction, however, we would agree with [33] that using qualitative research methods to discover norms in social behavior is an onerous undertaking, therefore requires resource allocation for something that may appear intangible and difficult to justify in the short-term.…”

“…This also reflects an often overlooked part of security which is that users are part of the system, exercising their own judgment and following informal and unexpected processes [44]. Note that social norms can also underpin behavior that is at odds with security policies [33]. Of course, a challenge with social norms is that they can be difficult to recognize and understand.…”

“…As noted above, the function of the norm is that we understand the world. Thus, using the norm as a guide reduces uncertainty, and enhances confidence that a choice made is the correct course of action [33]. Applying this to the context of making decisions about choosing a system password, drawing attention to a norm within a group can be a useful tool [45].…”

A Layered Trust Information Security Architecture

“…Normatives are fundamental for prioritizing goals, organizing and planning actions in order to define how things should be done. Considering the user's perspective, it is much more common than it may seem, but users generally try to follow social expectations rather than following security procedures [ 29 ]. This is not desirable regarding security perspectives, because such conflicts lead to security policy inconsistency.…”

When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

“…Understanding risk management in critical infrastructures is a multifaceted issue of both qualitative and quantitative nature (Shreeve et al 2020). Despite the rise of rule-based and probabilistic risk methodologies, for example, attack trees, attribute-based algorithms (Tatam et al, 2021), security risk is ‘incalculable’ since there are limits of what could be inferred from scientific data (Amoore, 2014: 424). Risk methodologies are ‘already political’ as they involve combinatorial possibilities whose arrangement has effects on risk scores, and associated countermeasures (Amoore, 2014: 423).…”