Duncan Hart is starting a a Special Interest Group within SCiO for people who want to apply systems thinking and cybernetics to cybersecurity.
Most organisations still treat security as a set of controls, frameworks and compliance checks. That work matters, but it often misses the bigger point. Whether an organisation is secure depends on how the whole organisation is structured and how it behaves. That includes how it senses threats, how it handles variety, how it balances autonomy against cohesion, and whether its governance actually keeps up with a changing environment. Our field already has the tools to think about this. Ashby’s Law of Requisite Variety, the Viable System Model and second-order cybernetics all apply. Few people have used them on security in a serious way.
The group is open to anyone interested in that overlap:
– security practitioners curious about systemic approaches
– systems and cybernetics people who want a demanding real-world domain
– people in governance, risk, audit and oversight
– researchers and students
Some questions we might take on:
– What does a VSM diagnosis reveal about an organisation’s security function?
– Can requisite variety tell us anything useful about threat, detection and response?
– Why do controls that look sound on paper fail in practice?
– How should boards actually oversee cyber risk?
To begin with, I’m suggesting an informal online meeting to meet each other, compare interests, and agree how the group should run: how often we meet, what format, and what we might want to produce.
If you’d like to take part, please message me directly. Feel free to pass this on to anyone who’d be interested.
Duncan Hart - @email