Defining "The Weakest Link" Comparative Security in Complex Systems of Systems

Wolter Pieters

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    6 Citations (Scopus)
    3 Downloads (Pure)

    Abstract

    Cloud architectures are complex socio-technical systems of systems, consisting not only of technological components and their connections, but also of physical premises and employees. When analysing security of such systems and considering countermeasures, the notion of "weakest link" often appears. Humans are then typically said to be the "weakest link" when it comes to security, but no proof is provided for this statement. One reason for this is the fact that there are no unified metrics of security that would apply to physical, digital and social components of complex systems alike. How does one compare the security of a room against the security of a piece of data, and how does social engineering an employee compare to exploiting a server vulnerability? Are we really comparing apples and oranges here, or would it be possible to present a comparative metric that would apply across the different domains? This paper explores the possibility of such a metric for complex systems, and proposes one in terms of the risk induced by an entity in the system. This also provides a foundation for the notion of "weakest link", in terms of the entity (set of entities) with the highest induced risk.
    Original languageUndefined
    Title of host publication2013 IEEE 5th International Conference on Cloud Computing Technology and Science, CloudCom
    Place of PublicationPiscataway, New Jersey
    PublisherIEEE Computer Society
    Pages39-44
    Number of pages6
    ISBN (Print)978-0-7695-5095-4
    DOIs
    Publication statusPublished - 5 Dec 2013
    Event5th IEEE International Conference on Cloud Computing Technology and Science, CloudCom 2013 - Bristol, United Kingdom
    Duration: 2 Dec 20135 Dec 2013
    Conference number: 5
    http://cipsijoomla.ux.uis.no/

    Publication series

    Name
    PublisherIEEE Computer Society

    Conference

    Conference5th IEEE International Conference on Cloud Computing Technology and Science, CloudCom 2013
    Abbreviated titleCloudCom
    CountryUnited Kingdom
    CityBristol
    Period2/12/135/12/13
    Internet address

    Keywords

    • SCS-Cybersecurity
    • Socio-technical security
    • EWI-24649
    • induced risk
    • comparative security
    • weakest link
    • METIS-304055
    • EC Grant Agreement nr.: FP7/318003
    • security risk assessment
    • Security Metrics
    • IR-90427
    • Attacker utility
    • EC Grant Agreement nr.: FP7/2007-2013

    Cite this

    Pieters, W. (2013). Defining "The Weakest Link" Comparative Security in Complex Systems of Systems. In 2013 IEEE 5th International Conference on Cloud Computing Technology and Science, CloudCom (pp. 39-44). Piscataway, New Jersey: IEEE Computer Society. https://doi.org/10.1109/CloudCom.2013.101