Techno‐Social Contracts for Security Orchestration in the Future of Systems Engineering

Abstract

Security orchestration is the command and control behind security operations. Command includes governance and adjudication logic and rules. Control includes the messaging infrastructure and message set for bidirectional communication between the orchestration engine and the constituent parts of its enclave. Open Command and Control (OpenC2)1 is one effort advancing the messaging infrastructure and message set. Automating the command portion of orchestration remains largely unexplored and will emerge as a symbiosis between people and technology. Technology will have some autonomy including the ability to establish and sustain relationships (argued in a social sense) with other technology. To help facilitate trust relationships and interactions that secure the respective systems and their environment, techno‐social contracts are explored as an approach to explicitly encode technology‐to‐technology rules of intra‐protection and inter‐protection as part of security orchestration.

Multilayer Network Models for Coordinating Orchestration of Systems Security Engineering

“…One attempt at modeling these interactions is addressed in another fundamental element of systems security engineering-techno-social contracts. As discussed by Dove and Willett (2021), techno-social contracts for systems security is an "approach to explicitly encode technology-to-technology rules of intra-protection and inter-protection as part of security orchestration." While a good first step, this approach does not entirely address the lack of coordination across domain-specific security strategies.…”

“…The resulting multi-domain security approaches should include the design and evaluation of the interactions within domains (e.g., ensuring sufficient cyber security architectures) and between disparate domains (e.g., ensuring coordination between digital controllers and physical processes). Such multi-domain approaches to security would support "dynamic security decisions in operations resulting in fast, relevant, and adaptable system defense" (Dove, et al 2021). By extension, systems security performance would also be further enhanced with coordination with non-security elements in the broader facility or system.…”

“…A multilayer network-based approach, however, is not a silver bullet solution for all thirteen fundamental elements for the future of systems security engineering (Dove, et al 2021). Yet, based on the conceptual similarities provided in (Williams, A.D. et al 2021a), a multilayer network-based solution can directly support several of these fundamental elements-most notable element no.…”

Using the Security Views in UAF

“…Innovative techniques are being proposed and studied. Dove & Willett (2020) suggested a new approach in a paper entitled "Techno-Social Contracts for Security Orchestration in the Future of Systems Engineering". (Dove, Willett, 2020) "The cyber-physical-social aspects of systems engineering are gaining attention in the social dimension principally for human-human and human-technology interaction.…”

“…Dove & Willett (2020) suggested a new approach in a paper entitled "Techno-Social Contracts for Security Orchestration in the Future of Systems Engineering". (Dove, Willett, 2020) "The cyber-physical-social aspects of systems engineering are gaining attention in the social dimension principally for human-human and human-technology interaction. This paper suggests that systems and systems of systems can be viewed as social communities of technical elements, where security of the community and its technical members can benefit from collective and distributed mutual protection behaviors."…”