Abstract for: Using Conceptual System Dynamics Simulation Models to Initiate Exploration of and Discussion about Incident Reporting Systems

Ongoing research collaboration between Tecnun, University of Agder, Gjøvik University College and mnemonic AS (a Managed Security Services provider), investigates how to improve the operation of information security incident reporting systems. A large part of the research effort is collaborative workshops and a significant issue is how to engage the participants in an objective discussion. We have successfully employed small System Dynamics computer simulation models for this purpose. These models leave out many details and make a number of assumptions that are often wrong. However, that is precisely why they work so well. When experts are confronted with a “wrong” model of a system they know very well, they seem to have an urge to immediately correct the modeler, thus initiating discussion. Used correctly, these small conceptual models can “kick start” a collaborative modeling workshop, engaging the participants and immediately extracting useful information. This paper presents one such model and our experiences with using it.