Abstract
Modern organisations are complex, socio-technical systems consisting of a mixture of physical infrastructure, human actors, policies and processes. An increasing number of attacks on these organisations exploits vulnerabilities on all different levels, for example combining a malware attack with social engineering. Due to this combination of attack steps on technical and social levels, risk assessment in socio-technical systems is complex. Therefore, established risk assessment methods often abstract away the internal structure of an organisation and ignore human factors when modelling and assessing attacks. In our work we model all relevant levels of socio-technical systems, and propose evaluation techniques for analysing the security properties of the model. Our approach simplifies the identification of possible attacks and provides qualified assessment and ranking of attacks based on the expected impact.
Original language | English |
---|---|
Title of host publication | 1st International Workshop on Socio-Technical Perspective in IS development (STPIS) |
Place of Publication | Aachen, Germany |
Publisher | CEUR |
Pages | 121-124 |
Number of pages | 4 |
Publication status | Published - 9 Jun 2015 |
Event | 1st International Workshop on Socio-Technical Perspective in IS development, STPIS 2015 - Stockholm, Sweden Duration: 9 Jun 2015 → 9 Jun 2015 Conference number: 1 |
Publication series
Name | CEUR Workshop Proceedings |
---|---|
Publisher | CEUR-WS.org |
Volume | 1374 |
ISSN (Print) | 1613-0073 |
Workshop
Workshop | 1st International Workshop on Socio-Technical Perspective in IS development, STPIS 2015 |
---|---|
Abbreviated title | STPIS |
Country/Territory | Sweden |
City | Stockholm |
Period | 9/06/15 → 9/06/15 |
Keywords
- SCS-Cybersecurity
- EC Grant Agreement nr.: FP7/318003
- EC Grant Agreement nr.: FP7/2007-2013