SGER: A Socio-Technical Approach to Internet Security

技术安全措施经常被社会手段破坏，但很少有研究在整个社会技术系统的背景下解决系统安全问题，将社会和技术部分之间的相互作用集成到一个模型中。系统安全领域也存在类似的问题，但最近设计了一种新的事故模型，使用系统理论的方法来理解事故的原因。系统理论允许考虑事件和系统作为一个整体之间的复杂关系，因此这个新模型允许考虑事故不仅仅是由单个组件故障链引起的，而是由系统组件之间的相互作用引起的，包括那些没有故障的组件。这项探索性研究将以蠕虫为第一个例子，检验这种新的安全方法如何应用于互联网安全。长期目标是创建一个可信赖的通用模型，该模型可以结合安全性和安全性，以及可用于创建更值得信赖的社会技术系统的系统建模工具和分析方法。这项研究提供了一个独特的机会，将安全和安保这两个研究学科联系起来，这两个学科有许多共同点，但到目前为止，相对较少的交流或互动。

0550008SGER: A Socio-Technical Approach to Internet SecurityNancy G. LevesonTechnical security measures are often breached through social means, but little research has tackled the problem of system security in the context of the entire socio-technical system, with the interactions between the social and technical parts integrated into one model. Similar problems exist in the field of system safety, but recently a new accident model has been devised that uses a systems-theoretic approach to understand accident causation. Systems theory allows complex relationships between events and the system as a whole to be taken into account, so this new model permits an accident to be considered not simply as arising from a chain of individual component failures, but from the interactions among system components, including those that have not failed.This exploratory research will examine how this new approach to safety can be applied to Internet security, using worms as a first example. The long-term goal is to create a general model of trustworthiness that can incorporate both safety and security, along with system modeling tools and analysis methods that can be used to create more trustworthy socio-technical systems. This research provides a unique opportunity to link two research disciplines, safety and security, that have many commonalities but, up to now, relatively little communication or interaction.