Sociotechnical Approaches to Cyber Security in Emerging Nations: A Case Study in Risk Management for Rwandan Health Care
No ratings
Presented at CyberScience2020 2020 by
Healthcare is increasingly dependent on digital systems. In emerging nations, it can be particularly hardfor hospital administrators to maximize the benefits of these advances and at the same time mitigate the potentialcyber security risks associated with healthcare information systems. This paper argues that limited resources, risingdemand and rapidly evolving organizational structures create a pressing need for holistic approaches to addresssociotechnical security challenges in healthcare. We do not underestimate the technological challenges of cybersecurity in these countries; equally technical solutions are unlikely to be effective unless supported by holistic riskassessment. We address these problems by the use of STAMP (Systems Theoretic Accident Model and Processes)for cyber security analysis, STPA-sec. Our results show that this open-ended analytical technique requires additionalmethodological structure in countries where there are significant shortages of trained analysts; to guide theapplication of STPA-sec and also to provide common reference when individual analysts must justify their findings.It is for this reason that we explicitly integrate the US National Institute of Science and Technology (NIST) controlsinto STPA-sec. This provided our stakeholders with a starting point for the application of socio-technical analysis;further studies are required to determine whether such support becomes superfluous as analysts become familiarwith socio-technical methods. Our arguments have been validated through extensive observation, interviews anddocument reviews with healthcare providers in Rwanda. In particular, we focus on an initiative to improve the cybersecurity of a hospital Picture Archiving and Communication System (PACS). It is our hope that the lessons learnedin one country might inform cyber security risk management for healthcare across other emerging nations who facelimited resources, significant public demand and an increasing range of threats.