2026-09-19T00:57:38Zhttps://dspace.mit.edu/server/oai/request

oai:dspace.mit.edu:1721.1/908042022-01-13T07:54:46Zcom_1721.1_7582com_1721.1_7581com_1721.1_104841col_1721.1_131023col_1721.1_141484

Stuart Madnick and Qi D. Van Eikema Hommes. Salim, Hamid M System Design and Management Program. System Design and Management Program. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Massachusetts Institute of Technology. Engineering Systems Division 2014-10-08T15:30:12Z 2014-10-08T15:30:12Z 2014 2014 http://hdl.handle.net/1721.1/90804 891594952 Thesis: S.M. in Engineering and Management, Massachusetts Institute of Technology, Engineering Systems Division, System Design and Management Program, 2014. Thesis: S.M., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2014. 93 Cataloged from PDF version of thesis. Includes bibliographical references (pages 148-156). If we are to manage cyber security risks more effectively in today's complex and dynamic Web 2.0 environment, then a new way of thinking is needed to complement traditional approaches. According to Symantec's 2014 Internet Security Threat Report, in 2012 more than ten million identities that included real names, dates of birth, and social security were exposed by a single breach. In 2013 there were eight breaches that each exposed over ten million identities. These breaches were recorded despite the fact that significant resources are expended, on managing cyber security risks each year by businesses and governments. The objective of this thesis was twofold. The first objective was to understand why traditional approaches for managing cyber security risks were not yielding desired results. Second, propose a new method for managing cyber security risks more effectively. The thesis investigated widely used approaches and standards, and puts forward a method based on the premise that traditional technology centric approaches have become ineffective on their own. This lack of efficacy can be attributed primarily to the fact that, Web 2.0 is a dynamic and a complex socio-technical system that is continuously evolving. This thesis proposes a new method for managing cyber security risks based on a model for accident or incident analysis, used in Systems Safety field. The model is called System-Theoretic Accident Model and Processes (STAMP). It is rooted in Systems Thinking and Systems Theory. Based on a case study specifically written for this thesis, the largest cyber-attack reported in 2007 on a major US based retailer, is analyzed using the STAMP model. The STAMP based analysis revealed insights both at systemic and detailed level, which otherwise would not be available, if traditional approaches were used for analysis. Further, STAMP generated specific recommendations for managing cyber security risks more effectively. by Hamid M. Salim. S.M. in Engineering and Management S.M. 156 pages eng Massachusetts Institute of Technology M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission. http://dspace.mit.edu/handle/1721.1/7582 Engineering Systems Division. Electrical Engineering and Computer Science. System Design and Management Program. Cyber safety : a systems thinking and systems theory approach to managing cyber security risks Systems thinking and systems theory approach to managing cyber security risks Thesis application/pdf false Publication unknown unknown <Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="4326dc29-6037-4f67-8bd2-f683d1cede19"> <Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type> <Language>eng</Language> <Title>Cyber safety : a systems thinking and systems theory approach to managing cyber security risks</Title> <Subtitle>Systems thinking and systems theory approach to managing cyber security risks</Subtitle> <PublishedIn> <Publication> </Publication> </PublishedIn> <PublicationDate>2014</PublicationDate> <Authors> <Author> <DisplayName>Salim, Hamid M</DisplayName> <Affiliation> <OrgUnit> </OrgUnit> </Affiliation> </Author> </Authors> <Editors> </Editors> <Publishers> <Publisher> <DisplayName>Massachusetts Institute of Technology</DisplayName> <OrgUnit /> </Publisher> </Publishers> <License>http://dspace.mit.edu/handle/1721.1/7582</License> <Keyword>Engineering Systems Division.</Keyword> <Keyword>Electrical Engineering and Computer Science.</Keyword> <Keyword>System Design and Management Program.</Keyword> <Abstract>If we are to manage cyber security risks more effectively in today&apos;s complex and dynamic Web 2.0 environment, then a new way of thinking is needed to complement traditional approaches. According to Symantec&apos;s 2014 Internet Security Threat Report, in 2012 more than ten million identities that included real names, dates of birth, and social security were exposed by a single breach. In 2013 there were eight breaches that each exposed over ten million identities. These breaches were recorded despite the fact that significant resources are expended, on managing cyber security risks each year by businesses and governments. The objective of this thesis was twofold. The first objective was to understand why traditional approaches for managing cyber security risks were not yielding desired results. Second, propose a new method for managing cyber security risks more effectively. The thesis investigated widely used approaches and standards, and puts forward a method based on the premise that traditional technology centric approaches have become ineffective on their own. This lack of efficacy can be attributed primarily to the fact that, Web 2.0 is a dynamic and a complex socio-technical system that is continuously evolving. This thesis proposes a new method for managing cyber security risks based on a model for accident or incident analysis, used in Systems Safety field. The model is called System-Theoretic Accident Model and Processes (STAMP). It is rooted in Systems Thinking and Systems Theory. Based on a case study specifically written for this thesis, the largest cyber-attack reported in 2007 on a major US based retailer, is analyzed using the STAMP model. The STAMP based analysis revealed insights both at systemic and detailed level, which otherwise would not be available, if traditional approaches were used for analysis. Further, STAMP generated specific recommendations for managing cyber security risks more effectively.</Abstract> <Access xmlns="http://purl.org/coar/access_right" > </Access> </Publication>