Engineering Secure Socio-Technical Systems

Socio-technical systems are pervasive, comprising human, organisational and technical components that interact with each other to achieve common objectives. Examples of socio-technical systems are smart cities, airports, and hospitals. Each of these systems manages a large number of assets, such as the data that is stored and shared and the infrastructure itself. Security issues in socio-technical systems might lead to severe consequences: a security issue in a hospital might compromise the health of people, or a security issue in an airport might threaten the lives of passengers and staff. My research work consists of creating methods that support the engineering of secure socio-technical systems to prevent, detect and mitigate security issues. Given the intrinsic heterogeneity of the components involved, a mere technical solution is frequently not enough, while methods that consider technical, social and organisational perspectives are considered more effective. In this presentation, I will provide an overview of such holistic methods that I have designed and validated. The methods allow the engineering of secure socio-technical systems, connecting and facilitating the design of aspects such as the objectives of actors, their procedural execution and implementation. On the technical side, I will present a method for the enforcement of security requirements using technologies such as blockchain. On the organisational and social side, I will present a method that strengthens what has been considered the weak link of the security chain, i.e., the people and their (un)secure behaviours.