A Novel Socio-Technical Framework for Enhancing Cyber Crisis Management Capabilities

2.1 Cyber incidents response

An incident is defined as a disruption that causes an interruption or reduction in the quality of IT services [18]. Incident management is described as efforts to restore normal operational conditions for IT services as swiftly as possible while minimizing the impact on business processes and ensuring continuous service availability [16]. Cyber incident response is a critical component of cyber resilience, encompassing the immediate response and procedures associated with IT security events. Its objectives are to detect the occurrence of an incident, mitigate its consequences, and address the threat posed to the organization. Incident Response Management (IRMA) is a vital aspect of an Information Security Management System (ISMS), serving as a repository of information to streamline and expedite the mitigation of security incidents [19]. Generally, IRMA comprises a set of procedures for managing information security incidents with clearly defined stages. Despite variations in best practices, such as those outlined in NIST 800-6 [20] and ISO/IEC 27035 [21], the process can be categorized into the following stages: preparation, detection, and learning [19]. While Preparation and Detection focus on organizing and executing incident response, learning provides feedback to the system based on information gathered during the process.

To effectively manage incidents, a specialized team with the capacity and capability to handle cyber incidents, known as the Computer Security Incident Response Team (CSIRT), is essential [22]. CSIRTs work to mitigate and prevent the spread of computer security issues. They may consist of specialists including malware and forensics experts, as well as solicitors and public relations personnel who oversee all stages of incident response management. CSIRTs offer a variety of services based on their mission and objectives, which can be classified into three broad categories:

• Reactive services, which are triggered by an event or request and are a key component of CSIRT operations;
• Proactive services, which provide support and knowledge to help prevent and minimize future incidents;
• Security quality management services, which enhance existing services that are independent of incident handling and are typically conducted by other organizational areas such as IT, audit, or training [23].

2.2 Crisis management

Before delving into crisis management, it is crucial to establish a precise definition of a crisis. A crisis is characterized as an event, revelation, allegation, or set of circumstances that threatens an individual's or organization's integrity, reputation, or survival [24]. Although the likelihood of a crisis occurring may be low, its impact, if it does materialize, can be significantly detrimental to the organization. The causes of the crisis and the measures needed to address it may not be immediately apparent; however, resolution should be pursued as expeditiously as possible. Additionally, not all key stakeholders may immediately recognize the full impact of the crisis [25]. Effective crisis management requires preparation, including the development of a crisis management plan and readiness [26].

Crisis management involves being prepared to confront adversity and minimize its effects as effectively as possible, as well as simplifying the management process during periods of chaos [27]. It encompasses the strategic management of perceptions and coordination of efforts with stakeholders to proactively prevent, resolve, and leverage a crisis for organizational growth. This field examines the procedures involved in planning, control, analysis, and communication to limit damage and prepare for crises [26]. Generally, the literature on crisis management describes it as the process of making and implementing difficult decisions in challenging situations. It is about readiness to face adversity, minimizing impacts as effectively as possible, and streamlining the management process during chaotic circumstances [27].

2.3 Cyber defense

Cyber defense encompasses a range of operations designed to protect entities and respond swiftly to threats [28]. It refers to both strategic and operational measures aimed at safeguarding individuals from significant cyber threats, including attacks, incidents, campaigns, or operations conducted by external parties [29]. Cyber defense involves responding to threats and securing critical infrastructure and information for enterprises, government agencies, and other networks [30]. A comprehensive cyber defense strategy must recognize the roles of both public and private security actors, as these entities are pivotal in maintaining and ensuring the essential functions of society during crises [29].

Cyber defense can be categorized into three interconnected domains: "proactive," "active," and "reactive." "proactive" measures focus on enhancing the security of the cyber environment and ensuring the optimal performance of cyber infrastructure and mission functions. "active" measures aim to effectively mitigate or contain damage caused by hostile cyber operations. "reactive" measures are designed to restore efficacy or efficiency following a successful breach [28]. In essence, cyber defense involves detecting intruders, neutralizing their activities, and preventing further hacking attempts or attacks [29]. These efforts are directed towards preventing, detecting, and responding to threats or assaults promptly to protect infrastructure and information from compromise.

A defensive posture in cyber defense incorporates two strategies: deterrence to prevent attacks and resilience and security to manage attacks if prevention fails [29]. Effective implementation of these preventive and readiness strategies requires capabilities such as detection, attribution, and incident response [29]. These factors are crucial for cyber defense, with operational and intelligence capabilities playing significant roles in both prevention and preparedness strategies [29].

2.4 Cyber crisis

The European Union defines a cyber crisis as an anomalous and chaotic situation that threatens an organization's strategic goals, credibility, or survival, thus impacting its core functions [31]. A cyber crisis represents a severe threat to the core structure, principles, and norms within cyberspace, requiring critical decisions to be made under conditions of high pressure and uncertainty [26]. According to the Netherlands, a cyber crisis involves an IT-related issue affecting critical infrastructure that cannot be managed by standard crisis management organizations. Similarly, in Czechoslovakia, a "cyber crisis" can be declared if the security of information systems jeopardizes national interests [4].

A cyber crisis refers to crises occurring within the cyberspace domain. The US Patriot Act defines critical infrastructure as systems and assets, both physical and virtual, whose damage would impact national security, the economy, public safety, health, or a combination of these [32]. Based on these definitions, a cyber crisis is an event affecting national critical infrastructure that disrupts essential business processes, threatens national interests, and generates uncertainty, necessitating immediate technical and strategic decisions. A cyber crisis typically begins with a cyber incident that escalates to an unusual scale, causing significant damage to organizations and nations [27].

2.5 Socio-technical approach

Historically, incident response has predominantly focused on the technical aspects of issues [33]. However, humans are often considered the weakest link in the cybersecurity chain [10]. As research progresses, organizational incidents are increasingly recognized as resulting from the interactive complexity and socio-technical challenges that arise from unfamiliar or unsafe conditions and risky actions by individuals within organizations [34]. Incident response contributes to a broader perspective on information security management by conceptualizing information security as a socio-technical system [33].

A socio-technical system approach involves developing a system that integrates both human and technical elements [17]. This approach analyzes work systems through two concurrent investigations: one examining potential deviations that impede the conversion process and the other gathering necessary information to design and implement jobs that promote worker engagement and commitment [13]. Socio-technical systems encompass six perspectives (Figure 1): goals/metrics/visions/values, processes/procedures, people, culture, technology, and buildings/infrastructure [17].

1.png

Figure 1. Socio-technical system approach by Clegg et al. [17]

The hexagonal socio-technical framework presented above conceptualizes work as a complex system integrating both technical and socio elements. The technical components include technology, infrastructure, and processes, while the socio components encompass people, culture, and goals [17]. Goals refer to the objectives an organization aims to achieve or prioritize, particularly when addressing large-scale cyber incidents [35]. Processes or procedures denote the stages involved in managing cyber crises. People are the operators, staff, or stakeholders involved in responding to cyber incidents during a crisis. Infrastructure includes the physical and network facilities utilized, including those affected by cyber attacks. Culture pertains to the organizational habits or practices. Finally, technology encompasses the tools employed to manage cyber crises.

In developing the conceptual model of the cyber crisis capabilities framework, we conducted an identification of cyber crisis management processes in five advanced countries: Australia, the United States, Estonia, China, and the Netherlands. The benchmarking results allowed us to identify the core processes in cyber crisis management, which were subsequently translated into nodes for coding in Nvivo. The capabilities formulated in Nvivo were then quantitatively validated using the Delphi method across two rounds, resulting in a convergent cyber crisis management framework.

4.1 Benchmarking cyber crisis management with five advanced countries

At this stage, benchmarking analysis was conducted to formulate the proposed cyber crisis management steps. The comparison was made among five advanced countries recognized for their mature management of cyber crises and proven experience in handling such crises, thus serving as a reference for cyber crisis management. Table 2 below presents the results of the comparison among China, Australia, Estonia, the United States, and the Netherlands, along with the proposed framework.

Table 2. Results of the cyber crisis management benchmark and proposed framework

Prior to coding the capabilities using Nvivo from a socio-technical perspective, nodes were defined based on the mapping of capabilities for each core process proposed. This mapping was based on six socio-technical aspects: Goals, Technology, People, Infrastructure, Procedure, and Culture. This mapping can be seen in Table 3.

Table 3. Nodes identification

Subsequently, coding analysis will be conducted in Nvivo based on the identified nodes derived from the core processes.

4.2 Identification of capabilities through Nvivo analysis

At this stage, the results from the Systematic Literature Review (SLR) will be further analyzed using Nvivo software. Nvivo is a Computer-Assisted Qualitative Data Analysis Software (CAQDAS) tool that assists qualitative researchers in collecting, organizing, analyzing, visualizing, and reporting their data [40]. All results from the reference search were processed with the aid of Nvivo. The data processing stage involved in putting the reference collection data and coding it from a socio-technical perspective. The results of the coding process include word clouds, project maps, and mind maps. The data processing with NVivo 12 Plus is illustrated in Figure 3.

3.png

Figure 3. Nvivo 12 data processing

Additionally, the results of the Nvivo coding analysis are presented in the form of word clouds (Figure 4), project maps (Figure 5), and mind maps (Figure 6).

4.png

Figure 4. Word cloud

5.png

Figure 5. Project map results

6.png

Figure 6. Mind map of cyber crisis capability

The word frequency analysis, represented as a word cloud (Figure 4), shows that several terms frequently appear in the SLR results. With a minimum word length setting of five characters, high-frequency words include "cyber," "security," "cybersecurity," "incident," "analysis," "information," "management," "crisis," "attack," "response," "organizations," and "national" and "international." These prominent terms offer preliminary insights into the capabilities that are crucial for development.

Subsequently, a project map analysis was conducted on the SLR data. The project map provides a visual representation of the results from the coding of cyber crisis management capabilities, making the findings more accessible. The capability variables are identified from a socio-technical perspective, which includes people, processes, goals, technology, culture, and infrastructure. Figure 5 displays the results of the project map analysis.

The project map results indicate that all references contribute to the six socio-technical elements identified, with each variable comprising several sub-variables. The detailed mapping of variables and sub-variables derived from the coding process is presented in Figure 6.

From the Nvivo data processing of the SLR, 27 primary capabilities along with 31 supporting capability elements for managing cyber crises were identified. Among the 27 capabilities identified through the NVivo coding results, it is evident that the majority of cyber crisis response capabilities are reflected in the incident response nodes, cybersecurity expert nodes, and crisis communication nodes. Only two sources have indicated that ticketing is a component of cyber crisis management capability. According to most references and sources, incident response is pivotal in addressing cyber crises [16, 18, 30, 41-45]. Additionally, cybersecurity expertise plays a critical role during crises [26, 30, 41-43, 46, 47]. Conversely, socio-technical capabilities such as crisis communication are also essential for effectively managing cyber crises [39, 48-53].

4.3 Validation of identified capabilities

To validate the identified variables and capability indicators, we conducted an expert survey using the Delphi method. The Delphi technique involves soliciting expert opinions through iterative rounds to develop a consensus on multi-agency management [54]. The identified capabilities served as the basis for the expert survey, which was evaluated by 11 experts according to the following criteria in Table 4 below.

Table 4. Experts list

The expert survey used a Likert scale from 1 to 9, ranging from "Not Important at All" to "Extremely Important." The survey was conducted in two rounds to ensure valid results. The results from Round 1 are presented in Figure 7.

7.png

Figure 7. Round 1 results of Delphi method

Overall, the Round 1 analysis revealed 7 capability indicators that were divergent or not yet agreed upon and 53 indicators that were convergent or agreed upon. Additionally, experts provided feedback to consolidate indicators with similar meanings and suggested modifications to variables. Consequently, in Round 2, the number of capability indicators was reduced from 60 across 8 variables to 44 indicators across the same 8 variables. Detailed results from the Delphi method in Round 2, which achieved overall convergence, are shown in Table 5.

Table 5. Delphi method round 2 results

From the final results of the Round 2 expert survey, all 44 indicators were found to be convergent (Standard deviation < 1.5) and agreed upon as essential capabilities for managing cyber crises.

4.4 Proposed model of cyber crisis capability framework

Furthermore, we developed a new cyber crisis capabilities model, as illustrated in Figure 8. This model is divided into eight variables: security regulations and policies; clarity and compliance; technological reliability; human capital competence; resources and budget; organizational structure; stakeholder collaboration; and cultural integration. This model encompasses all aspects from a socio-technical perspective and represents a novel contribution to the field of cyber crisis management.

8.png

Figure 8. Octagon model of cyber crisis capability framework

To enhance practicality, we propose developing a cyber crisis management model in the form of a checklist, as detailed in Table 6.

Table 6. Cyber crisis management capabilities checklist

The proposed model can be visualized as an interconnected framework where each variable or criterion influences and supports the others, ensuring a comprehensive approach to cyber crisis management. The explanation of each component is as follows:

1. Security Regulations and Policies;

Serve as the foundation, ensuring that all efforts are formalized and aligned with the strategic goals of the organization [55].

2. Clarity and Compliance;

Control the rules and standards used as references. Ensure proper implementation of all regulatory components and best practices to support cybersecurity [47].

3. Technological Reliability;

Ensure the availability of tools and platforms necessary for detecting, analyzing, and responding to cyber threats, with up-to-date and active technology [56].

4. Human Capital Competence;

Ensure the organization has personnel trained in managing and responding to cyber crises [57].

5. Resource and Budget;

Ensure adequate resources and budgets for cyber crisis management, covering both quantity and quality [58, 59].

6. Organizations;

A formal approach to cyber crisis management involves establishing a point of contact [54, 60], which typically includes a cyber crisis team with clearly defined roles and responsibilities.

7. Stakeholder Collaboration, and

Efforts to manage cyber crises require collaboration not only within the country but also internationally [60]. Cooperation between Computer Security Incident Response Teams (CSIRTs) at domestic, bilateral, regional, and multilateral levels plays a crucial role, particularly in sharing information, lessons learned, and providing technical assistance [23]. Engaging with the private sector and the cybersecurity community is also vital and can facilitate the resolution of cyber crises [61].

8. Cultural Integration

Promote a culture of security awareness and continuous improvement [62].

This model fulfils the novelty aspect by integrating all required components holistically. It combines strategic objectives with operational and tactical elements, ensuring that every level of the organization is prepared to address cyber crises. By emphasizing the importance of training, updating policies, and advancing technologies in response to emerging threats, the model supports continuous improvement. Additionally, its focus on collaboration and cooperation among stakeholders highlights the significance of unity in managing crises, supported by the ongoing development of cybersecurity awareness. Consequently, this model serves as a comprehensive framework for organizations seeking to enhance their cyber crisis management capabilities.