A Case Study in the Application of STPA-sec and CHASSIS for Socio-Technical Cyber Security Risk Management in Health Care from Developing Nations

Abstract

Healthcare organizations continue to face an increasing range of cyber threats. In developing nations, considered capabilities of healthcare systems including fragmented governance, limited resources and experience; it is important to identify methods that can be beneficial in the socio-technical analysis of breaches given that at the moment the level of detail and the socio-technical focus varies between incidents—some reports do not mention socio-technical issues at all—and without consistent methods we cannot be sure whether this was due to the fact socio-technical factors were not important or whether they were not just considered by the analyst. We address these problems by evaluating the application of two promising approaches STPA-sec (System Theoretic Process Analysis) for cyber security and a focused method for use case and misuse case scenarios, CHASSIS (Combined Harm Analysis for Safety and Security of Information System). STPA-sec has been able to capture ranges of socio-technical risks threatening cyber security of picture archiving and communication system (PACS) in this hospital by making rapid integration in a resource-constraint area. However, our results show that given a variety of socio-technical risks in this area—interaction of fragmented components, organizational vulnerabilities, it can be hard for only a high-level and abstract methodology; hence, it is needed to identify other forms of breaches to the analyzed system; for that reason, CHASSIS is used to support STPA-sec analysis; this provides to the local analyst another point of consideration in handling different socio-technical risks.