Rational management of the security status of large systems
Abstract
Systems are becoming increasingly interconnected, forming complex Systems of Systems (SoS) that are difficult to manage and secure. This paper addresses the challenges of governing the security status of such environments, particularly the need to preserve the richness of qualitative risk assessments while enabling scalable, standardised analysis. It proposes a graph-based approach that models risk scenarios quantitatively through the calculation of an ‘interest’ value, enabling prioritisation of countermeasures across large system perimeters. Combined with Boolean representations and event simulation, this framework provides a structured method for synthesising, monitoring and supporting decision-making in the management of large-scale system security. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.
The full article is available to subscribers to the journal.
Author's Biography
Thomas Devaux joined Thales in 2019 as Team Leader of cyber security consulting engineers to compile accreditation dossiers and to lead audits and penetration test campaigns. His current role is Accreditation Coordinator, with responsibility for European SoS programmes. His background is in military training in electronics engineering, specialising in radio communication. Thomas began his career in 1991 in the French Army as an expert on automated control and data acquisition and automated systems of data mining for an aeronautical system. In 2004, he embarked on security of information systems. He naturally evolved towards cyber security and assumed various responsibilities, culminating in French CISO of the Interim Combined Joint Expeditionary Force.
Cédric Bijard began his career in 2010 and quickly moved towards cyber security, specialising in offensive security. After a decade of experience in the defence and space sectors, he joined Thales in 2021 as security architect contributing to major European space programmes, with responsibilities spanning the establishment of security baselines, system security risk assessments and security architectures. His current role is Cyber Security Manager for a European systems of systems programme.
Dr Hugo Beguinet completed a doctorate in post-quantum cryptography in joint partnership with Thales SIX and Ecole Normale Supérieure (ENS) de Paris. He continued his career in cyber security and is currently Cybersecurity System Engineer on a European space programme, for which he designs prospect security services and ensures proper upflow of security requirements from industrials participating in the programme.
