Assignment: Social Science Analysis

Your goal for this assignment is to choose a single social science theory from the ones we have discussed in class, choose a specific cybersecurity incident, and use that social science theory from this course to analyze the incident and understand what is happening and why it is happening. That’s it; generate a single new insight into a single cybersecurity incident by applying a social science theory from class, and then clearly explain that insight.

This is an individual assignment, though if you want to, you can work with a partner on it. If you work with a partner, I expect a higher quality assignment with more thorough analysis. If you work with a partner, both partners should turn in identical papers, and both papers should have both names on them.

Part 1: Describe the Social Science Theory

Throughout the semester so far, we have discussed a number of theories from the social sciences – economics, sociology, anthropology, psychology, and communications – that can help us understand cybersecurity incidents. Start by choosing one. Here is an (incomplete) list:

Choose one of these theories that you find interesting and think applies well to cybersecurity incidents. Re-read the class readings on the topic. Then, find one additional reference for this theory, and read it to learn more about this theory, what it says and how it is used.

Once you have done this, for Part 1 of your assignment, write up a summary of this concept. The summary should be written for an intelligent non-expert; assume your reader is not familiar with the theory but is otherwise quite intelligent and educated (i.e. your peers from class), and should explain as much of what is important about the theory as you can. In particular, you should cover:

  • When does this theory apply? (What are the preconditions: what has to be true about a situation for this theory to apply?)
  • What are the key insights from this theory? What does this theory allow you to see that you couldn’t see without it?
  • How might this theory be helpful in understanding a cyber situation?

Part 2: Describe the Cyber Incident

Next, choose a cybersecurity incident. Try to choose an incident for which the theory you chose for Part 1 might be useful in some way. You are welcome to choose an incident from Dr. Wolff’s book, one we have already discussed in class, or you can choose another real incident that we haven’t discussed (A list of recent incidents is here). You must read at least one reference that discusses the details of the incident. If using an incident from class, find at least one additional citation to provide more details about the incident.

For Part 2 of the assignment, write up a short summary of the incident. What happened? (What is the timeline of events?) To whom? Who did it? Who else from the ecosystem was involved? What do we still not know about the incident? Why does this matter?

The summary should be written for an intelligent non-expert; assume your reader is not familiar with the incident but is otherwise quite intelligent and educated (i.e. your peers from class), and should explain as much of what is important about the incident as you can.

As you write up your incident, I recommend you use the Actors and Motivations worksheet to help you keep track of the people involved and why they were doing what they did.

Part 3: Analysis

For Part 3 of your writeup, you should use the theory you chose in Part 1 to analyze and understand the cyber incident you described in Part 2. Part 3 should present some new and valuable claim or knowledge about the incident that wasn’t present in the original references, but that you can see by using the theory.

This part should 1) justify that the theory applies because the preconditions for the theory exist in the cyber incident; 2) describe how the theory applies and what parts of the cyber incident the theory can help us understand; 3) make a clear new claim (that isn’t in the existing references) that is justified by the theory; and 4) explain why learning that new thing is potentially interesting and valuable.

This analysis should be written for an intelligent non-expert; do not assume your reader is not familiar with the incident or the theory, but has finished reading Parts 1 and 2 of your paper, and is otherwise quite intelligent and educated (i.e. your peers from class). It should explain your thinking in how you apply the theory and why you think it is interesting.

Part 3 should not introduce new facts about the incident, or new aspects of the theory. Everything the reader needs to know about the theory should be in Part 1, and everything the reader needs to know about the incident should be in Part

  1. Part 3 should refer back to these details while explaining the analysis, but not introduce new details or new aspects of the theory.

So, in summary, this analysis should answer:

  • Where does the theory apply to the cyber incident. Clearly cite facts from the case (that were presented in part 2 above) to justifiy that the theory applies (preconditions, part 1)
  • How does it apply? To what aspects of the cyber incident is this interesting / helpful?
  • What do we learn? By using the theory, what new thing (claim) do we learn by using the theory? (it should be something not already explicitly stated in the original descriptions)
  • So what? Who cares? Why does it matter that we now know this?

Deliverable

Your goal is to write up a short paper that includes Parts 1-3 – a summary of a social science theory, a summary of a cybersecurity incident, and an analysis that applies that theory to that incident. Parts 1 and 2 should probably be about a page or two long (each). Part 3 can be longer, if you need more space. The whole document should be less than 10 pages in total.

Writing matters. Write clearly. This paper should be written for an intelligent non-expert; do not assume your reader is not familiar with the incident or the theory, and try to clearly explain everything that the reader needs to know. Feel free to use tables, timeline diagrams, images, or other visualizations to aid your explanation.

This assignment is intended to be an individual assignment; each person must choose their own theory and incident, and conduct their own analysis. However, if you like, you can work with a partner (a group of 2). If you work in a group of 2, the document should include both student’s names on it, and both students should submit identical documents on Canvas. Groups of 2 will be expected to have longer documents that include more details about the theory, more details about the incident, and a more thorough analysis.

Finally, be prepared to describe your analysis and conclusions in class. In class, I will ask about 5-10 people/groups to come up and present their conclusions to the class for discussion and feedback. Discussion and feedback is how you improve ideas. You idea doesn’t need to be perfect, but it helps to get up and talk about it so you can make it better.