Unscripted Practices for Uncertain Events: Organizational Problems in Cybersecurity Incident Management

Abstract

Scripts can help us understand the designer–user relationship, by offering analysis of designers’ intent in technological objects and examination of users’ behaviors through willingness (and unwillingness) to take on scripts. But how are we to understand these relationships in the context of cybersecurity, in the face of adversaries determined to gain unauthorized access to computer systems by actively subverting scripts? In effect, cybersecurity attacks involve re-scripting of computing systems to gain unauthorized access through unscripted features of these systems. Cybersecurity attacks are always uncertain events: attackers can never be certain when re-scripting will be successful, and defenders can never be certain when or where to expect an attack, as unscripted features are difficult to know until they are exploited. In this paper, I study practices of cybersecurity incident response to examine how cybersecurity engineers respond to the novel attacks they encounter daily. I show how these are fundamentally unscripted practices emerging in response to unstable scripts, structured through the uncertainties inherent in cybersecurity engineering practice. The improvised practices and changing networks of social relations which I trace demonstrate the limits of stable scripts and provide new tools for analyzing unstable scripts.

Scripts of Security: Between Contingency and Obduracy

“…In his analysis of the use and misuse of population registers in Italy for the purposes of monitoring, Gargiulo (2024) highlights an even stronger dissymmetry in "the primacy of de-inscription over subscription" for local authorities. The differentiation of users according to variations of alterity takes its starkest form in Mathew's (2024) argument that cybersecurity needs to account for users-as-attackers and users-as-defenders. Not only are the adversaries that Mathew analyzes uncertain, but they challenge practices of use and what it means to be a user of a technology or a system.…”

“…Contributions to this Special Issue may not solve this ambivalence, but they bring it to the fore. They showcase a continuum between explicit intentionality in subverting the script (Mathew 2024) to a lack of intentionality therein (Pelizza and Van Rossem 2023). At one end of the continuum, disruption is the ultimate goal.…”