Modelling Socio-Technical Aspects of Organisational Security

Marieta G. Ivanova

    Research output: ThesisPhD Thesis - Research external, graduation external

    162 Downloads (Pure)

    Abstract

    Identification of threats to organisations and risk assessment often take into consideration the pure technical aspects, overlooking the vulnerabilities originating from attacks on a social level, for example social engineering, and abstracting away the physical infrastructure. However, attacks on organisations are far from being purely technical. After all, organisations consist of employees. Often the human factor appears to be the weakest point in the security of organisations. It may be easier to break through a system using a social engineering attack rather than a pure technological one. The StuxNet attack is only one of the many examples showing that vulnerabilities of organisations are increasingly exploited on different levels including the human factor. There is an urgent need for integration between the technical and social aspects of systems in assessing their security. Such an integration would close this gap, however, it would also result in complicating the formal treatment and automatic identification of attacks. This dissertation shows that applying a system modelling approach to sociotechnical systems can be used for identifying attacks on organisations, which exploit various levels of the vulnerabilities of the systems. In support of this claim we present a modelling framework, which combines many features. Based on a graph, the framework presents the physical infrastructure of an organisation, where actors and data are modelled as nodes in this graph. Based on the semantics of the underlying process calculus, we develop a formal analytical approach that generates attack trees from the model. The overall goal of the framework is to predict, prioritise and minimise the vulnerabilities in organisations by prohibiting the overall attack or at least increasing the difficulty and cost of fulfilling it. We validate our approach using scenarios from IPTV and Cloud Infrastructure case studies.
    Original languageEnglish
    QualificationDoctor of Philosophy
    Awarding Institution
    • Technical University of Denmark
    Supervisors/Advisors
    • Probst, Christian W., Supervisor, External person
    Thesis sponsors
    Award date1 Jan 2016
    Place of PublicationCopenhagen
    Publisher
    Publication statusPublished - 2016

    Keywords

    • IR-101820
    • METIS-318570
    • EC Grant Agreement nr.: FP7/318003
    • EC Grant Agreement nr.: FP7/2007-2013
    • EWI-27346

    Fingerprint

    Dive into the research topics of 'Modelling Socio-Technical Aspects of Organisational Security'. Together they form a unique fingerprint.

    Cite this