Adapting Group Model Building Methods to Improve Information Security Data

摘要

Cyber security data restrictions, e.g. due to fear of bad publicity, hinder systematic investigation of information security issues. We argue that group model building is a promising method to help mitigate such restrictions: 1) Models emerge from even incomplete and inaccurate data; 2) group model building helps develop a trustful relationship between data owners and modelers; 3) the iterative nature of group model building leads to gradually structurally richer and more useful models, thus boosting further client interest and trust. We describe our experiences using a case for the transition to eOperations in the oil and gas industry. We analyze the outcome of two group model building workshops, the follow-up meetings and interview. We show the trajectory for how we gain access to data, how we developed and improve a model, what insights the client learned, and more important, how we built up trust with the client during this process.