Current methodologies for cyber security risk analysis are largely focused on process and technology. They do not systematically incorporate sociotechnical thinking. We argue this reduces their predictive power in determining the risks of cyber threats to organizations and hence limits the range of responses. A remedy is to augment such systems using suitable socio-technical models. As an example, we propose a re-working of Rasmussen's model for safety in systems, applying it to cyber security. The updated model gives rise to a set of predictors and boundary conditions which can be used to determine an organization's resilience in the face of external and internal cyber threats, enabling analysts to propose an extended range of countermeasures. We propose using this approach as a basis to include socio-technical analysis in risk assessment. As an example, we provide a critique of the risk methodology used in SABSA against this model. We discuss practical applications of the approach and some associated issues. Future work will focus on incorporating this approach into a variety of risk methodologies and the creation of novel techniques that can be tested in the simulated cyber security environment of a cyber range or in the field.
Current methodologies used for cyber security risk analysis and management largely focus on technical and process requirements. Evidence from incidents such as the Sony hacks and failures at SingHealth (see section 3) point to social failures as much as technical or procedural weaknesses as reasons for the occurrence of security incidents. Threats and vulnerabilities in organizations are also not simply technical or procedural in nature but result from complex systemic factors arising in modern organizations and societies. We argue that the lack of socio-technical systems analysis in commonly used risk analysis methodologies leaves organizations more vulnerable to cyber security risk than they should be. As one possible means of addressing this, we show how Rasmussen’s model of a complex socio-technical systems for safety engineering can be adapted for cyber security purposes. This adaptation, in turn, provides a basis for enhancing current approaches to risk analysis and management. We give an example of applying our approach to the risk methodology SABSA, outlining the current weaknesses in the approach and making recommendations for its improvement. Future work will focus both on enhancing current approaches in other methodologies and developing new ones. Verification and validation of our techniques will be aided not only by case studies in real life, but also the use of simulated studies in the Norwegian Cyber Range.
Section 2, “Literature Review”, puts our approach in the context of current research.
In section 3, “A Socio-technical Risk Vacuum?”, we provide evidence of the current
techno-centric nature of cyber security risk analysis methodologies. Following on in
Section 4, “4 Cyber Systems as Complex Socio-Technical Systems”, we model the
socio-technical nature of cyber security risk to organizations in terms of Rasmussen’s
model of complex socio-technical systems
Socio-technical systems analysis is an established part of safety engineering practice
for over fifty years
Where socio-technical or human factors are addressed, generally, the treatment is
superficial. Users are treated as hostile, lazy, or ignorant – and the highest standard is
conformance to cyber security policy, which may be out-of-step with actual security
requirements, or place an unacceptable burden on costs or workloads -leading to their
“shadow” abandonment
This shortcoming is starting to be addressed in academia where there is a recognition
that cyber security requires approaches including human and organizational factors and
that technical solutions no longer provide satisfactory answers – see, for example,
This paper attempts to bridge this gap by showing how socio-technical models can
be adapted to create practical set of criteria for judging risk analysis and management
techniques from a socio-technical viewpoint as a basis for the assessment and
development of current techniques to make them more complete. As an example of this
approach, it draws on and adapts Rasmussen’s model of a complex socio-technical
system
Ultimately, we propose to validate the plausibility of these models through action research on real-world systems and realistic simulations (Checkland and Holwell 1998). 3
We argue that most current approaches to cyber security risk analysis center on
technology and procedures, reflecting their origins in engineering practice
We carried out a brief review, based on a survey of major cyber security risk analysis methodologies in the marketplace (Ionita 2013). We define socio-technical thinking as the consideration of a combination of factors - Culture (for example, human factors, behavior, ethnicity, organizational culture), Structure (for example, economics, social structures, politics, regulation, policy, procedure management and governance), Methods (policies and procedures, working practices) and Machines (technology) and their Interaction – see Figure 1.
The criterion used was that, during the risk discovery phase (according to
ISO27005
The results of the review are shown in Table 1. The total score (out of 10) shows the
completeness of the methodology in socio-technical terms in our interpretation.
Although not exhaustive, the list shows that most common methods in the marketplace
have a shortfall in terms of socio-technical systems analysis. We have also been
informed by experienced colleagues in industry that even where an approach is
theoretically more complete (e.g., NIST
To demonstrate how scores were assigned, we use SABSA
Having said this, the SABSA approach is business-oriented, rather than
socio-technically oriented. Underlying factors which lead to the kinds of vulnerabilities identified
in the approach are not addressed – for example, aspects such as power relations
between groups(Bălan 2010), social and economic pressures which militate against
process maintenance, the results of changes over time
OCTAVE Allegro, in contrast, takes an information centric approach to risk analysis where the organization’s information assets represent the organizing principle. Information moves between various “containers” in a system which can include people as well as technical objects which store and transmit information assets. Each type of container is associated with a set of questions about potential vulnerabilities and various counter-measures are proposed at container level. From a socio-technical point of view, this model focuses on technology and procedures. For example, it does not address social or human reasons why vulnerabilities might occur and does not consider interaction between system components or aspects such as change over time. Similar remarks can be made about CRAMM, other OCTAVE methodologies, FAIR, Infosec Standard 1, attack path analysis and MEHARI. In essence, all these approaches focus on technical, physical and procedural security control measures and do not consider social factors leading to technical vulnerabilities or poor behavior.
We believe this socio-technical deficit represents a serious gap in thinking about cyber security risk which affects all aspects of risk analysis from gathering threat intelligence to contingency planning, since almost all threats have a strong socio-technical element to them, both in terms of how and where the threat originates, who implements 1 In conversation. it, what organizations are affected, how they are impacted, their resilience and their ability to recover from the attack.
Examples of threats with marked socio-technical elements include2 1. Hostilities between nation-states 2. Political protestors engaging with social media to launch attacks 3. Insider attacks 4. Malware attacks making use of (ultimately disposable) human agents 5. Hardware and software backdoors 6. Insider trading 7. State-sponsored espionage
Where organizations do not take account of socio-technical factors, they fail to defend themselves effectively or respond appropriately to threats because they do not understand the full extent of the risks they face, the vulnerabilities they have or the potential impacts of such attacks on them, not just at the technological level, but at the organizational level.
For example, the “Wannacry” attack(Hillier April 2018) on the NHS (National
Health Service) in the UK proved more devastating than it should have been due to a
failure to appreciate the weaknesses of the organization from a socio-technical point of
view. Central governing bodies were not aware of shortcomings in technical defenses
– demonstrating weaknesses in control and feedback within the organization and a
resultant weakness in the vertical integration of its working practices. The close-coupled
and complex nature of NHS systems (where, for example, medical equipment, patient
management systems, IoT and ICS devices and office systems reside on the same
unsegmented network) ensured a non-linear impact of any successful attacks
Other attacks show similar patterns. The Sony attacks represented a set of internal management failings as much as they did the work of sophisticated attackers(Berghel 2015) including the willingness of the director of IT to cover up audit failings. Similar statements can be made about the failures at SingHealth3.
These real-world examples show that socio-technical considerations are vital during
risk analysis. This is further emphasized by the complex nature of modern cyber
systems which we consider in Section 4.
2
https://www.forbes.com/sites/firewall/2010/04/29/seven-cyber-scenarios-to-keep-you-awakeat-night/#2e701f576f7d
3
https://www.straitstimes.com/singapore/probe-report-on-singhealth-data-breach-points-tobasic-failings?utm_medium=Social&utm_campaign=STFB&utm_source=Facebook&fbclid=IwAR0HHFtADeIC5jLquA3bZuMGUgBAx
nnPK96NzmHRAXvkf6rwc7Ml-K9yhs8#Echobox=1547076196
Rasmussen’s model
These models are useful because they allow us not just to analyze incidents but also to derive incident predictors and determine boundary conditions (Cassano-Piché, Vicente et al. 2006). But these predictors are currently written with a view to preventing accidents which threaten health and safety, rather than specifically cyber security incidents – that is, triggering events are normally endogenous rather than exogenous. They also do not take account of reputational costs and their influence on security decisions, nor of failures in organizational learning due to organizational inertia(Kleiner and Corrigan 1989) – which specifically includes organizational response to threat intelligence and to the introduction of new technologies in the cyber security context.
Furthermore, although possibly unintentionally, the current version of the model might lead analysts to the belief that primary focus should be on a single organization and its integration. However, most critical systems are now provided on a multi-party basis, which induces a requirement for lateral as well as vertical integration. This leads us to propose two extensions to the model, shown in Figures 1 and 2.
Risk Analysis & Management Methodology
CRAMM OCTAVE Allegro NIST Infosec Standard 1 FAIR MEHARI STRIDE SABSA (Risk) Attack Path Analysis
IRAM 0 – Not present 1 – Partially present 2 – Systematically addressed N/A – Not applicable
Figure 1 – Rasmussen’s Model - Adapted for Cyber Organizations
Original Predictors Safety is an emergent property of a complex socio-technical system. It is impacted by the decisions of all the actors.
Threats to safety are usually caused by multiple contributing factors, not just a single catastrophic decision or action.
Threats to safety or accidents usually result from a lack of vertical integration across all levels of a complex socio-technical system, not just from deficiencies at any one level alone.
The lack of vertical integration is caused, in part, by a lack of feedback across levels of a complex socio-technical system. Actors at each level cannot see how their decisions interact with those made by actors at other levels, so the threats to safety are far from obvious before an accident.
Work practices in a complex socio-technical system are not static. They will migrate over time under the influence of a cost gradient driven by financial pressures in an aggressive competitive environment and under the influence of an effort gradient driven by the psychological pressure to follow the path of least resistance.
The migration of work practices can occur at multiple levels of a complex socio-technical system, not just one level alone.
Migration of work practices causes the system’s defenses to degrade and erode gradually over time, not all at once. Accidents are released by a combination of this systematically-induced migration in work practices and a triggering event, not by an unusual action or an entirely new, one-time threat to safety.
Updated Cyber Security Predictors Security is an emergent property of a complex cyber system. It is impacted by the decisions of all the actors.
Threats to security are usually caused by multiple malicious actors, vulnerabilities in organisations by multiple contributing factors: not just a single catastrophic threat, decision or action.
Security incidents or vulnerabilities usually result from a lack of vertical and lateral integration across all levels of a complex cyber system, not just from deficiencies at any one level alone.
The lack of integration is caused, in part, by a lack of feedback across and between levels of a complex cyber system. Actors at each level cannot see how their decisions interact with those of others so the threats to security are far from obvious before an incident.
Work practices in a complex cyber system are not static. They will migrate over time under the influence of a cost gradient driven by financial pressures in an aggressive competitive environment and under the influence of an effort gradient driven by the psychological pressure to follow the path of least resistance. Organizations may resist change for a number of other cultural reasons.
The migration of work practices can occur at and across multiple levels of a complex cyber system, not just one level or in one organisation alone.
Migration of work practices causes the system’s defences to degrade and erode gradually over time, not all at once. Incidents occur due to a combination of changes in malicious action and this systemically-induced migration in work practices – not by a single unusual action or an entirely new, one-time threat to security.
In Figure 1, we extend the view of cyber systems to encompass other organizations in the service and supply chain.
In Figure 2, we include two additional features to the conventional Rasmussen model. We add the label “Barriers to Learning” to show that social and cultural factors can impede the pace of organizational change in working practices in response to threats (i.e., social cognition). We also display the barrier posed by working practices as a jagged edge to show that such practices can degrade to the point they cross the security boundary which – due to the constant nature of attacks – can lead to catastrophic failure.
In Table 3, we re-write and extend the predictors which can be derived from Rasmussen’s model(Cassano-Piché, Vicente et al. 2006), both to make the wording match the vocabulary of cyber security, and also to take into account the extensions we have proposed. The major changes are the dual factor cause of cyber security incidents (both malicious acts and a breakdown in work practices; the incorporation of the need for lateral as well as horizontal integration; and the consideration of cultural barriers to organizational learning. 5
Developing and Assessing Techniques for Cyber Security Risk Analysis The predictive model proposed in Section 4 thus provides us with one possible basis for assessing and improving cyber security risk analysis and management methods using socio-technical analysis. We summarize the assessment criteria in Table 4.
Factor Decision-making
Note, the requirement for dynamic modelling leads to the use of techniques such as
risk narratives as a sense-making account of cyber security behavioral patterns (the
term ‘figuration’ (configuration)
SABSA
Contextual Conceptual Logical Physical Component
Business planning and decision-making, e.g., business risk assessment, business requirements, organizational and cultural development Business operations, e.g., process development, audit and reviews, standards and procedures Security governance, e.g., security policymaking, information classification, service management, audit trails Security administration, e.g., development and execution of security rules, access list maintenance, event log file management Technical capability, e.g., products, tools, project management, operation of individual systems
Table 5 – SABSA Layers This not the same as a technical architecture. Rather it is a layered organizational blueprint for ensuring cyber security is maintained throughout all parts of the organisation. The layers are described in Table 5.
SABSA makes use of soft systems methodology
Based on our review above, SABSA does refer to socio-technical factors, but the coverage is not complete as the methodology is business-oriented – making it ultimately policy and procedurally driven, rather than sociologically motivated.
In Table 6, we provide our assessment the strengths and weaknesses of SABSA risk methodology in relation to our predictive criteria and its dynamic modelling capability. Predictive Capability Decision-making Threat Actors Integration Control & Feedback Work Practices Security Boundaries Strengths SABSA is quite strong in terms of gathering decision-making criteria (business requirements) from all parts of the business.
SABSA identifies multiple threat actors both internal and external at different layers.
SABSA does not use methods to promote intra-organizational integration.
SABSA’s approach is likely to promote feedback on poor decision-making.
SABSA does consider business requirements changing over time SABSA is likely to uncover where work practices have violated security policy.
Identify New Security Working Practices
SABSA is likely to identify the need for new or updated security working practices.
Dynamic Modelling
The use of threat scenarios goes part way to capturing risk narratives. But accounts of countermeasures are not connective.
Recommendations SABSA focuses too narrowly on a single organisation and should consider vertical or horizontal integration of requirements.
The analysis would need to also consider issues raised by changes in external actors and external pressures over time as well as the potential degradation in working practices.
Lateral integration should be considered.
There should be a focus on the completeness of feedback mechanisms, either vertically or laterally.
SABSA should consider historical or current changes to work practices, particularly in other organizations.
SABSA should seek to uncover underlying reasons for the violation such as pressure on costs or workloads or other cultural or human factors as well as breaches in the security boundary Barriers to the adoption of new practice may not be identified in SABSA. It also needs to incorporate responses to threat intelligence and new technology into consideration.
SABSA should seek to capture dynamic aspects of the narrative and avoid a static ontology of threat capabilities/motivations.
Countermeasures should be related to one another to form both defense-in-depth and defense-in-breadth. ©Copyright held by the author(s)
In practical terms, many of these issues are easy to address in the SABSA methodology by incorporating some additional layers of analysis in the risk approach. For example, by considering the disintegrating effect of organizational issues at different layers in the model and providing additional means to carry out analysis of change over time.
It would be much harder to address the same issues in a methodology such as OCTAVE Allegro where the solution would appear to be to carry out a supplementary risk analysis from a socio-technical viewpoint in order to capture additional risks. This kind of multi-standpoint risk assessment approach is starting to become common in industry, suggesting that the deficiencies in purely technical and procedural approaches are being recognized and organizations are seeking to deal with them – see (McEvoy and Kowalski) for an example in the defense sector in the UK. 7
We believe that current approaches to cybersecurity risk analysis and management, are, for the most part, inadequate due to the omission of socio-technical systems analysis.
We propose using socio-technical models to enhance these methodologies, using a variant on Rasmussen’s model in relation to SABSA and OCTAVE Allegro as an example.
In future, these factors also lead us onto to a deeper discussion of how and why organizations identify risks, what we are trying to protect and what is regarded as a threat and why. These point to issues of identity and survival which would be difficult to address in the scope of this paper but lead us to believe that a model which unifies social learning and socio-technical factors might provide deeper insights into the nature of risk. We are aware that the very act of augmenting risk models in this manner could change how we think about risk in such systems, pointing us to underlying factors that are not addressed in systems design methodologies or even perceived as relevant(Checkland and Holwell 1998).
Future work will focus on developing and assessing novel approaches to both risk identification and risk evaluation and management in line with our findings. We also intend to develop and improve techniques for the dynamic modelling of socio-technical risks. In this, we will make use of the simulation of socio-technical systems (Hettinger, Kirlik et al. 2015) and their management on the Norwegian cyber range4. Computers and Applications (MIC-CCA), 2012 Mosharaka International Conference on, IEEE.
Al Sabbagh, B. and S. Kowalski (2015). "A socio-technical framework for threat modeling a software supply chain." IEEE Security & Privacy 13(4): 30-39. Anderson, R. and T. Moore (2007). Information security economics–and beyond. Annual International Cryptology Conference, Springer.
Bălan, S. (2010). "M. Foucault's view on power relations." Cogito-Multidisciplinary Research Journal 2: 55-61.
BBC (2017). "http://www.bbc.co.uk/news/technology-40875534." Berghel, H. (2015). "Cyber chutzpah: The sony hack and the celebration of hyperbole." Computer 48(2): 77-80.
Botta, D., et al. (2011). "Toward understanding distributed cognition in IT security management: the role of cues and norms." Cognition, Technology & Work 13(2): 121134.
Cassano-Piché, A., et al. (2006). A sociotechnical systems analysis of the BSE epidemic in the UK through case study. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, SAGE Publications Sage CA: Los Angeles, CA. Checkland, P. and S. Holwell (1998). "Action research: its nature and validity." Systemic practice and action research 11(1): 9-21.
Ehrenfeld, J. M. (2017). "WannaCry, Cybersecurity and Health Information Technology: A Time to Act." Journal of Medical Systems 41(7): 104. Hettinger, L. J., et al. (2015). "Modelling and simulation of complex sociotechnical systems: Envisioning and analysing work environments." Ergonomics 58(4): 600-614. Hillier (April 2018). Cyber Attack on the NHS. HC 787. H. o. C. C. o. P. Accounts. House of Commons, Public Accounts Committee, House of Commons. Ionita, D. (2013). Current established risk assessment methodologies and tools, University of Twente.
Kleiner, B. H. and W. A. Corrigan (1989). "Understanding organisational change." Leadership & Organization Development Journal 10(3): 25-31. Kowalski, S. (1994). "IT insecurity: a multi-discipline inquiry." Department of Computer and System Sciences, University of Stockholm and Royal Institute of Technology, Sweden.
Leveson, N. (2011). Engineering a safer world: Systems thinking applied to safety, MIT press.
Mattei, T. A. (2017). "Privacy, Confidentiality, and Security of Health Care Information: Lessons from the Recent WannaCry Cyberattack." World neurosurgery 104: 972-974.
McEvoy, R. and S. Kowalski "Beyond Training and Awareness: From Security Culture to Security Risk Management."
Schlienger, T. and S.
Wolstenholme, E. F. (2003). "Towards the definition and use of a core set of archetypal structures in system dynamics." System Dynamics Review 19(1): 7-26.