Using systems thinking to model cyber defence strategies within the UK ecosystem

点击翻译按钮获取中文摘要

The PhD journey started from trying to understand the strategic approach which is used in order to engage with the complexity of the cyber domain. This journey led to deterrence theory within international relations literatures, however, subsequently the deterrence approach was found to be highly dependent on domains which did not possess the same crucial components, specifically: the large part played by the private sector; highly networked interaction; and low threshold interactions.This PhD aims to address some of these issues in order to better frame the area which is more aligned to the specificities of the cyber domain as opposed to frameworks taken from other areas. This will allow decision makers to be better informed when dealing with the cyber domain and discussing this area. This approach within cyber strategic studies research is at an early stage within the literatures which makes the potential of pushing forward in this area highly interesting.The PhD comprises a three-step process:1. Model Fundamentals: The first step is to create a model in order to represent the dynamics of the cyber domain. Through literatures and discussions, and using systems thinking, it is determined which drivers should be used in the modelling process and how this should be represented. After the model has been developed the drivers and assumptions used are validated though the use of experts. 2. Scenario development phase: At the next step, the outputs of the model are translated into a format suitable for dissemination and discussion within semi structured interviews. This is the process where it is decided what is the optimum format to allow information to be accessible whilst also providing participants to interact and influence decisions on the inputs (and thus outputs) of the model. 3. Semi-structured interview process: Using the scenarios created within the modelling process and the visualisations created from this, these are tested across different sectors in order to see how various stakeholders engage. This will be done in two parts: Case study exploration: Engagement will first be with stakeholders who know and understand either the cyber domain and/or modelling with iterations of this process, along with integrating learnings. Validation of learning: Using potentially updated modelling and visualisations engagement the second part of the interview process will be with decision makers. These participants are likely to have less knowledge of the cyber and/or modelling fields. The aim here is to get feedback on the usefulness of the approach and what learnings they may have taken away from.