Systems security problems and cultural meanings in control and automation systems: Empirical evidenc

Automation and control systems such as integrated enterprise information technologies and distributed telemedical system architectures require highly secure information processing environments to ensure that costly (and even fatal) errors do not occur. However, research into systems development methodologies shows significant gaps in the treatment of systems security. Many methodologies do not specifically include security and privacy considerations within their frame of reference. As a consequence, recent studies of information control and management systems have shown that, in a global context, many organisations are at a significant security risk. In this paper we examine five of the most common system engineering methodologies cited in the literature, and we examine to what extent each of these methodologies incorporates security and privacy as part of the systems development process. This paper also presents empirical evidence to support the proposition that, as regards system security, high technology engineering education is at odds with the core values of students of systems engineering. This has major implications for the development of secure systems in a globalised economic context. The evidence shows how students from a wide variety of cultural backgrounds come into degree programmes valuing security highly, but the education programmes do not address systems security in very much depth.