AI 中文总结
研究聚焦网络安全实践中组织复原力差异问题，开发STARC框架，通过扩展结构化理论，经对三个金融组织分析验证，解释了不同资源和外包组织复原力差异原因，还给出跨边界故障诊断词汇表及七个可测试命题。
AI 中文摘要
问题：网络安全实践在分析师、团队、组织、部门和监管机构之间同时运行，与对手共同演变，且日益融合人类和算法决策。现有应用于它的理论在单一组织层面运作，无法解释控制措施大致相似的组织为何复原力差异巨大。本文：我们开发了STARC（弹性网络安全的结构化理论适应）框架，用于从结构上定位网络安全实践的成败之处。它通过三个创新扩展了吉登斯的结构化理论，跨越五个结构-行动者三元组。证据基础：通过对三个金融组织（一家澳大利亚银行、一家印度尼西亚银行和一家马来西亚银行）的重新分析来说明STARC，涵盖从SOC分析师到高级管理人员的20次访谈，这些组织被选为不同的内包和外包配置。网络安全贡献：STARC提供了一个结构上的解释，说明资源和外包方式不同的组织为何在复原力上存在差异，并提供了一个词汇表，用于诊断跨级别、节奏以及人类-算法权威边界的事件响应故障，而单级框架对此视而不见。理论与成果：它将结构化理论扩展到对抗性、多层次和混合的人类-算法环境，并产生了七个将结构化与复原力联系起来的可测试命题，供未来测试。
英文摘要
The problem: Cybersecurity practice runs simultaneously across analysts, teams, organizations, sectors, and regulators, co-evolves with adversaries, and increasingly blends human and algorithmic decision-making. The theories applied to it operate at single organizational levels and cannot explain why organizations with broadly similar controls differ sharply in resilience. This paper: We develop STARC (Structuration Theory Adaptation for Resilient Cybersecurity), a framework for locating where cybersecurity practice succeeds or fails structurally. It extends Giddens' Structuration Theory with three innovations, Multi-Level Adversarial Agency, Threat-Adaptive Structuration, and Material-Agential Structural Properties, across five structure-agency triads. Evidence base: STARC is illustrated through re-analysis of three financial organizations, an Australian, an Indonesian, and a Malaysian bank, across 20 interviews from SOC analysts to senior executives, selected as diverse insourced and outsourced configurations rather than as a comparison of equivalents. Cybersecurity contribution: STARC offers a structural account of why differently resourced and outsourced organizations differ in resilience, and a vocabulary for diagnosing incident-response breakdown across levels, tempos, and the human-algorithm authority boundary that single-level frameworks leave invisible. Theory and outputs: It extends Structuration Theory to adversarial, multi-level, and hybrid human-algorithmic contexts, and yields seven testable propositions linking structuration to resilience, offered for future testing.
Comments22 pages, 2 figures, 2 tables
