Criminological Theory

(Section by Carlene Theory)

Broken Window Theory for Cybersecurity Vulnerability Assessment

The Broken Window theory by George Kelling and James Wilson, it a criminological theory that explains how situational factors can slowly, but persistently allow deviant behavior to creep into a community or an organization. The premise is that one unrepaired or broken window demonstrates that there is lax guardianship over that jurisdiction, so breaking more windows will result in no sanctions (Kelling & Wilson, 1982).

Kelling and Wilson further suggest two policing function to mitigating against the encroaching deviant activities. The first is fighting crime, which means the attackers need to be detected and apprehended according to existing legal standards. The second function is maintaining order. This would include ensuring that community members follow community standards.

The application of the broken window theory to cybersecurity would use an ethical hacker to perform vulnerability assessment on their organization. They detect and lock down any black hat hackers. Ultimately their goal in performing the vulnerability assessment is to warn the organization’s web users of online activities that will make their organization less secure (that is break more windows).

While this is a conservative theory that gives most of the responsibility to policing (these actors would be the white hat hackers), the enforces are not able to reach most users, so maintaining order may not reduce hacking. Keller and Wilson argue that greater resources should be placed on the detecting and apprehending. This would mean finding the hackers as soon as possible after an attack.