UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

Socio-Technical Security Metrics (Dagstuhl Seminar 14491)

Gollmann, D; Herley, C; Koenig, V; Pieters, W; Sasse, MA; (2015) Socio-Technical Security Metrics (Dagstuhl Seminar 14491). Dagstuhl Reports , 4 (12) pp. 1-28. 10.4230/DagRep.4.12.1. Green open access

[thumbnail of dagrep_v004_i012_p001_s14491.pdf] Text
dagrep_v004_i012_p001_s14491.pdf
Available under License : See the attached licence file.

Download (4MB)

Abstract

This report documents the program and the outcomes of Dagstuhl Seminar 14491 “Socio-Technical Security Metrics”. In the domain of safety, metrics inform many decisions, from the height of new dikes to the design of nuclear plants. We can state, for example, that the dikes should be high enough to guarantee that a particular area will flood at most once every 1000 years. Even when considering the limitations of such numbers, they are useful in guiding policy. Metrics for the security of information systems have not reached the same maturity level. This is partly due to the nature of security risk, in which an adaptive attacker rather than nature causes the threat events. Moreover, whereas the human factor may complicate safety and security procedures alike, in security this “weakest link” may be actively exploited by an attacker, such as in phishing or social engineering. In order to measure security at the level of socio-technical systems, one therefore needs to compare online hacking against such social manipulations, since the attacker may simply take the easiest path. In this seminar, we searched for suitable metrics that allow us to estimate information security risk in a socio-technical context, as well as the costs and effectiveness of countermeasures. Working groups addressed different topics, including security as a science, testing and evaluation, social dynamics, models and economics. The working groups focused on three main questions: what are we interested in, how to measure it, and what to do with the metrics.

Type: Article
Title: Socio-Technical Security Metrics (Dagstuhl Seminar 14491)
Open access status: An open access version is available from UCL Discovery
DOI: 10.4230/DagRep.4.12.1
Publisher version: http://dx.doi.org/10.4230/DagRep.4.12.1
Language: English
Additional information: Copyright © Dieter Gollmann, Cormac Herley, Vincent Koenig, Wolter Pieters, and Martina Angela Sasse 2015. Except where otherwise noted, content of this report is licensed under a Creative Commons BY 3.0 Unported license (http://creativecommons.org/licenses/by/3.0/).
Keywords: Security risk management, security metrics, socio-technical security, social engineering, multi-step attacks, return on security investment
UCL classification: UCL
UCL > Provost and Vice Provost Offices
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/1468941
Downloads since deposit
51Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item