结构化混沌：通过UML类模型使小型企业网络安全风险与资产建模成为可能
Structuring the Chaos: Enabling Small Business Cyber-Security Risks & Assets Modelling with a UML Class Model
AI总结：
本文提出一种UML类模型，用于帮助小型企业系统化地管理网络安全风险与资产，通过简化术语和结构促进所有利益相关者的参与。
摘要：
小型企业日益采用IT技术，从而变得更加容易受到网络事件的影响。尽管小型企业意识到网络安全风险，但许多企业难以实施缓解措施。这些困难部分源于小型企业与大企业的基本特征差异，现代网络安全解决方案广泛应用于大型企业。小型企业特定的网络安全工具是必要的。目前可用的网络安全工具和标准假设技术专业知识和时间资源，这在小型企业中可能不实际。网络安全与其他小型企业所有者承担的角色（如清洁、销售等）竞争。需要一个显著且可大规模实施的小型企业模型，使用简化而非专业术语和呈现方式，以鼓励所有利益相关者的持续参与，不仅仅是技术人员。我们提出了一种新的UML类（小型IT数据（SITD））模型，以支持小型企业在首次涉足网络安全时通常混乱的信息收集阶段。SITD模型以UML格式设计，帮助小型企业实施技术解决方案。SITD模型结构通过使用通用类和结构保持相关性，这些结构随着技术环境的变化而演变。SITD模型通过突出业务战略任务与IT基础设施之间的关系，使安全决策与业务成比例。我们构建了一套设计原则以解决小型企业的网络安全需求。模型组件是根据这些需求设计的。然后通过检查一个真实小型企业的运营和IT信息案例研究，展示了SITD模型的使用，并通过NotPetya事件演示了SITD模型在说明泄露信息方面的能力。
英文摘要：
Small businesses are increasingly adopting IT, and consequently becoming more vulnerable to cyber-incidents. Whilst small businesses are aware of the cyber-security risks, many struggle with implementing mitigations. Some of these can be traced to fundamental differences in the characteristics of small business versus large enterprises where modern cyber-security solutions are widely deployed. Small business specific cyber-security tools are needed. Currently available cyber-security tools and standards assume technical expertise and time resources often not practical for small businesses. Cyber-security competes with other roles that small business owners take on, e.g. cleaning, sales etc. A small business model, salient and implementable at-scale, with simplified non-specialist terminologies and presentation is needed to encourage sustained participation of all stakeholders, not just technical ones. We propose a new UML class (Small IT Data (SITD)) model to support the often chaotic information-gathering phase of a small business' first foray into cyber-security. The SITD model is designed in the UML format to help small business implement technical solutions. The SITD model structure stays relevant by using generic classes and structures that evolve with technology and environmental changes. The SITD model keeps security decisions proportionate to the business by highlighting relationships between business strategy tasks and IT infrastructure. We construct a set of design principles to address small business cyber-security needs. Model components are designed in response to these needs. The uses of the SITD model are then demonstrated and design principles validated by examining a case study of a real small business operational and IT information. The SITD model's ability to illustrate breach information is also demonstrated using the NotPetya incident.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
