Physical assets are increasingly connected to organisations’ networks, exposing organisations to ... more Physical assets are increasingly connected to organisations’ networks, exposing organisations to the risk of cyber threats that could have a physical impact. There are several instances where this has already happened, and industry reports show that the number of groups interested in targeting such systems, and the number of cyber incidents on physical systems, is increasing. A Building Management Systems (BMS) is one such connected system. A cyber-attack targeting a BMS could disrupt heating, ventilation or power, or could undermine physical security operations which increasingly rely on internet-enabled devices, such as CCTV cameras and access control. In addition, these systems could be used as a gateway into the organisation’s network if not properly secured. It is increasingly important to consider a BMS within the context of an organisation’s overall protective security posture. Inclusion of a BMS on an organisation’s network not only increases the attack surface but also places a greater load on security staff, potentially leading to vulnerabilities. Additionally, a BMS spans the boundaries of cyber and physical security, so cyber, personnel and physical security teams need to work together to identify, understand and mitigate vulnerabilities.This research argues that current guidance fails to address the challenges of integrating cyber, personnel and physical security to protect a BMS. Guidance focuses on securing the attack surface with technological solutions and a ‘defence in depth’ approach but overlooks the impact this will have on staff managing the system. Increased system complexity puts yet more load on staff, further reducing their capacity, which in itself could create further vulnerabilities.Furthermore, guidance does not adequately address how separate security teams should collaborate to ensure effective solutions are implemented. The formal collaboration between security teams through a converged security approach has, however, been advocated by industry practitioners and the benefits of such an approach have been highlighted. Despite this, there is little evidence for the approach, and little detail about the type or level of convergence required to achieve the specified benefits. Moreover, there is no indication of how organisations might overcome the challenges of adopting such an approach.This research seeks to explore the context in which a BMS is implemented to inform organisations of the broader system implications around converged security. Initial research explores how separate security teams within organisations collaborate or converge. This presentation will outline the preliminary findings and highlight areas where future research is needed.
The role of front-line staff in averting harm System failures within healthcare regularly contrib... more The role of front-line staff in averting harm System failures within healthcare regularly contribute to patient safety incidents and patient harm; however, front-line staff often identify such failures, errors and problems, and intervene to prevent harm from occurring. By intervening, front-line staff can prevent serious patient harm or even death, acting as Ôharm absorbersÕ, and the Ôlast line of defenceÕ between system failings and the patient (Reason 2004). Such incidents where patients are not harmed are often referred to as Ônear missesÕ, as there was still the potential for harm. In order to recognize situations that could lead to a patient-safety incident, staff require some level of Ôerror wisdomÕ to identify the system factors that contribute to patient-safety incidents (Reason 2004). Such prospective risk analysis skills, or foresight, can be learned through direct experience and by learning from the experience of other professionals. By sharing details of such incidents, professionals can also learn about different elements of the system that contribute to patient safety incidents without direct experience. Incidents classified as Ôno harmÕ make up the majority of incidents reported to the National Patient Safety Agency (NPSA). For example, of the 791 392 incidents reported between October 2006 and September 2007, 66% (521 073) resulted in Ôno harmÕ (NPSA 2007). It is likely that in a proportion of these incidents, harm was averted by a member of staff. Such incidents provide invaluable learning opportunities as a result of their
A user-centred design approach, using mixed methods will be adopted that will include interviews,... more A user-centred design approach, using mixed methods will be adopted that will include interviews, focus groups and questionnaires What are the potential research outputs? This research aims to develop a relevant, useful and usable intervention to facilitate effective collaboration, for example:
Physical assets are increasingly connected to organisations’ networks, exposing organisations to ... more Physical assets are increasingly connected to organisations’ networks, exposing organisations to the risk of cyber threats that could have a physical impact. There are several instances where this has already happened, and industry reports show that the number of groups interested in targeting such systems, and the number of cyber incidents on physical systems, is increasing. A Building Management Systems (BMS) is one such connected system. A cyber-attack targeting a BMS could disrupt heating, ventilation or power, or could undermine physical security operations which increasingly rely on internet-enabled devices, such as CCTV cameras and access control. In addition, these systems could be used as a gateway into the organisation’s network if not properly secured. It is increasingly important to consider a BMS within the context of an organisation’s overall protective security posture. Inclusion of a BMS on an organisation’s network not only increases the attack surface but also plac...
This research aims to develop a relevant, useful and usable intervention to facilitate effective ... more This research aims to develop a relevant, useful and usable intervention to facilitate effective collaboration, for example: ● Scenarios to provoke collaboration, or for tabletop or red team testing. ● Matrix of threat actors and capabilities to demonstrate differences between cyber and physical security perspectives. ● ‘How to’ guide on steps to converge physical and cyber security. Why is this research important?
The role of front-line staff in averting harm System failures within healthcare regularly contrib... more The role of front-line staff in averting harm System failures within healthcare regularly contribute to patient safety incidents and patient harm; however, front-line staff often identify such failures, errors and problems, and intervene to prevent harm from occurring. By intervening, front-line staff can prevent serious patient harm or even death, acting as Ôharm absorbersÕ, and the Ôlast line of defenceÕ between system failings and the patient (Reason 2004). Such incidents where patients are not harmed are often referred to as Ônear missesÕ, as there was still the potential for harm. In order to recognize situations that could lead to a patient-safety incident, staff require some level of Ôerror wisdomÕ to identify the system factors that contribute to patient-safety incidents (Reason 2004). Such prospective risk analysis skills, or foresight, can be learned through direct experience and by learning from the experience of other professionals. By sharing details of such incidents, professionals can also learn about different elements of the system that contribute to patient safety incidents without direct experience. Incidents classified as Ôno harmÕ make up the majority of incidents reported to the National Patient Safety Agency (NPSA). For example, of the 791 392 incidents reported between October 2006 and September 2007, 66% (521 073) resulted in Ôno harmÕ (NPSA 2007). It is likely that in a proportion of these incidents, harm was averted by a member of staff. Such incidents provide invaluable learning opportunities as a result of their
Incidents involving cyber-physical systems are increasing , , and are predicted to escalate furth... more Incidents involving cyber-physical systems are increasing , , and are predicted to escalate further in the coming years . Convergence involves the integration of security resources within an organisation; it has been advocated since the early 2000s as a way of helping understand and mitigate vulnerabilities in cyber-physical systems. There is, however, little empirical research exploring converged security, and no clear roadmap for organisations who want to adopt the approach , . My research examines the experiences of organisations who have taken a converged approach to security and uses this to develop an evidence-based roadmap for others to follow. <br><br>I have carried out three studies to understand the implementation of converged security from different perspectives. Firstly, a literature review and a series of pilot interviews with senior security staff helped to identify the scope of converged security and key factors that facilitate effective convergence. These...
Physical assets are increasingly connected to organisations’ networks, exposing organisations to ... more Physical assets are increasingly connected to organisations’ networks, exposing organisations to the risk of cyber threats that could have a physical impact. There are several instances where this has already happened, and industry reports show that the number of groups interested in targeting such systems, and the number of cyber incidents on physical systems, is increasing. A Building Management Systems (BMS) is one such connected system. A cyber-attack targeting a BMS could disrupt heating, ventilation or power, or could undermine physical security operations which increasingly rely on internet-enabled devices, such as CCTV cameras and access control. In addition, these systems could be used as a gateway into the organisation’s network if not properly secured. It is increasingly important to consider a BMS within the context of an organisation’s overall protective security posture. Inclusion of a BMS on an organisation’s network not only increases the attack surface but also places a greater load on security staff, potentially leading to vulnerabilities. Additionally, a BMS spans the boundaries of cyber and physical security, so cyber, personnel and physical security teams need to work together to identify, understand and mitigate vulnerabilities.This research argues that current guidance fails to address the challenges of integrating cyber, personnel and physical security to protect a BMS. Guidance focuses on securing the attack surface with technological solutions and a ‘defence in depth’ approach but overlooks the impact this will have on staff managing the system. Increased system complexity puts yet more load on staff, further reducing their capacity, which in itself could create further vulnerabilities.Furthermore, guidance does not adequately address how separate security teams should collaborate to ensure effective solutions are implemented. The formal collaboration between security teams through a converged security approach has, however, been advocated by industry practitioners and the benefits of such an approach have been highlighted. Despite this, there is little evidence for the approach, and little detail about the type or level of convergence required to achieve the specified benefits. Moreover, there is no indication of how organisations might overcome the challenges of adopting such an approach.This research seeks to explore the context in which a BMS is implemented to inform organisations of the broader system implications around converged security. Initial research explores how separate security teams within organisations collaborate or converge. This presentation will outline the preliminary findings and highlight areas where future research is needed.
The role of front-line staff in averting harm System failures within healthcare regularly contrib... more The role of front-line staff in averting harm System failures within healthcare regularly contribute to patient safety incidents and patient harm; however, front-line staff often identify such failures, errors and problems, and intervene to prevent harm from occurring. By intervening, front-line staff can prevent serious patient harm or even death, acting as Ôharm absorbersÕ, and the Ôlast line of defenceÕ between system failings and the patient (Reason 2004). Such incidents where patients are not harmed are often referred to as Ônear missesÕ, as there was still the potential for harm. In order to recognize situations that could lead to a patient-safety incident, staff require some level of Ôerror wisdomÕ to identify the system factors that contribute to patient-safety incidents (Reason 2004). Such prospective risk analysis skills, or foresight, can be learned through direct experience and by learning from the experience of other professionals. By sharing details of such incidents, professionals can also learn about different elements of the system that contribute to patient safety incidents without direct experience. Incidents classified as Ôno harmÕ make up the majority of incidents reported to the National Patient Safety Agency (NPSA). For example, of the 791 392 incidents reported between October 2006 and September 2007, 66% (521 073) resulted in Ôno harmÕ (NPSA 2007). It is likely that in a proportion of these incidents, harm was averted by a member of staff. Such incidents provide invaluable learning opportunities as a result of their
A user-centred design approach, using mixed methods will be adopted that will include interviews,... more A user-centred design approach, using mixed methods will be adopted that will include interviews, focus groups and questionnaires What are the potential research outputs? This research aims to develop a relevant, useful and usable intervention to facilitate effective collaboration, for example:
Physical assets are increasingly connected to organisations’ networks, exposing organisations to ... more Physical assets are increasingly connected to organisations’ networks, exposing organisations to the risk of cyber threats that could have a physical impact. There are several instances where this has already happened, and industry reports show that the number of groups interested in targeting such systems, and the number of cyber incidents on physical systems, is increasing. A Building Management Systems (BMS) is one such connected system. A cyber-attack targeting a BMS could disrupt heating, ventilation or power, or could undermine physical security operations which increasingly rely on internet-enabled devices, such as CCTV cameras and access control. In addition, these systems could be used as a gateway into the organisation’s network if not properly secured. It is increasingly important to consider a BMS within the context of an organisation’s overall protective security posture. Inclusion of a BMS on an organisation’s network not only increases the attack surface but also plac...
This research aims to develop a relevant, useful and usable intervention to facilitate effective ... more This research aims to develop a relevant, useful and usable intervention to facilitate effective collaboration, for example: ● Scenarios to provoke collaboration, or for tabletop or red team testing. ● Matrix of threat actors and capabilities to demonstrate differences between cyber and physical security perspectives. ● ‘How to’ guide on steps to converge physical and cyber security. Why is this research important?
The role of front-line staff in averting harm System failures within healthcare regularly contrib... more The role of front-line staff in averting harm System failures within healthcare regularly contribute to patient safety incidents and patient harm; however, front-line staff often identify such failures, errors and problems, and intervene to prevent harm from occurring. By intervening, front-line staff can prevent serious patient harm or even death, acting as Ôharm absorbersÕ, and the Ôlast line of defenceÕ between system failings and the patient (Reason 2004). Such incidents where patients are not harmed are often referred to as Ônear missesÕ, as there was still the potential for harm. In order to recognize situations that could lead to a patient-safety incident, staff require some level of Ôerror wisdomÕ to identify the system factors that contribute to patient-safety incidents (Reason 2004). Such prospective risk analysis skills, or foresight, can be learned through direct experience and by learning from the experience of other professionals. By sharing details of such incidents, professionals can also learn about different elements of the system that contribute to patient safety incidents without direct experience. Incidents classified as Ôno harmÕ make up the majority of incidents reported to the National Patient Safety Agency (NPSA). For example, of the 791 392 incidents reported between October 2006 and September 2007, 66% (521 073) resulted in Ôno harmÕ (NPSA 2007). It is likely that in a proportion of these incidents, harm was averted by a member of staff. Such incidents provide invaluable learning opportunities as a result of their
Incidents involving cyber-physical systems are increasing , , and are predicted to escalate furth... more Incidents involving cyber-physical systems are increasing , , and are predicted to escalate further in the coming years . Convergence involves the integration of security resources within an organisation; it has been advocated since the early 2000s as a way of helping understand and mitigate vulnerabilities in cyber-physical systems. There is, however, little empirical research exploring converged security, and no clear roadmap for organisations who want to adopt the approach , . My research examines the experiences of organisations who have taken a converged approach to security and uses this to develop an evidence-based roadmap for others to follow. <br><br>I have carried out three studies to understand the implementation of converged security from different perspectives. Firstly, a literature review and a series of pilot interviews with senior security staff helped to identify the scope of converged security and key factors that facilitate effective convergence. These...
Uploads
Papers by Emma Boakes