Title:

Social systems theory perspective on information security risk modelling

Keynote speakers:

Prof. Petra Haferkorn at the Computer Science Department, Bonn-Rhein-Sieg University of Applied Science, Germany. Supervisor of the direction IT-Security Management Author of more than 100 publications. Research fields: Information Security Management IT Governance IT Risk Management IT audits of Companies, Public Authorities and other Organisations

Professor at the Department of Information Technology and Software Engineering, Doctor of Science on Project Management systems. Author of more than 110 publications. The areas of scientific activity are research on the convergence and integration of control systems in various applied fields. Co-supervisor of the projects: “Models and methods for assessing the convergence of specialist competence systems using AI technologies”; “Models and methods for protecting the system from attacks using AI technologies”.

Abstract:

This talk explores the limitations of conventional information security risk models through the lens of sociological systems theory. Emphasizing interdisciplinary integration, systemic complexity, inherent uncertainty, and the uncontrollability of living systems, the authors argue that effective risk modeling must be deliberately embedded within organizational processes to enable more nuanced and context-sensitive approaches. The study highlights the diverse roles of security experts and the critical function of context-specific communication across organizational and societal subsystems. It demonstrates that effective risk modeling depends on coordinated decision-making under conditions of unpredictability and double contingency. Furthermore, the talk underscores the necessity of making underlying assumptions explicit and engaging in continuous reflection on their implications. To address the complexity of risk communication, agile project management is proposed as an example. These insights contribute to the development of more adaptive and resilient information security systems in dynamic and evolving environments.