Abstract:Protection against a growing number of increasingly sophisticated and complex cyberattacks requires the real-time acquisition of up-to-date information on identified threats and their potential impact on an enterprise's operation. However, the complexity and variety of IT/OT infrastructure interdependencies and the business processes and services it supports significantly complicate this task. Hence, we propose a novel solution here that provides security awareness of critical infrastructure entities. Appropriate measures and methods for comprehensively managing cyberspace security and resilience in an enterprise are provided, and these take into account the aspects of confidentiality, availability, and integrity of the essential services offered across the underlying business processes and IT infrastructure. The abstraction of these entities as business objects is proposed to uniformly address them and their interdependencies. In this paper, the concept of modeling the cyberspace of interdependent services, business processes, and systems and the procedures for assessing and predicting their attributes and dynamic states are depicted. The enterprise can build a model of its operation with the proposed formalism, which takes it to the first level of security awareness. Through dedicated simulation procedures, the enterprise can anticipate the evolution of actual or hypothetical threats and related risks, which is the second level of awareness. Finally, simulation-driven analyses can serve in guiding operations toward improvement with respect to resilience and threat protection, bringing the enterprise to the third level of awareness. The solution is also applied in the case study of an essential service provider.

Integrated Solution Modeling Software: A New Paradigm on Information Security Review

Integrated Solution Modeling Software: A New Paradigm on Information Security Review and Assessment

I-SolFramework: An Integrated Solution Framework Six Layers Assessment on Multimedia Information Security Architecture Policy Compliance

A Novel Method on ISO 27001 Reviews: ISMS Compliance Readiness Level Measurement

Research on Information Security Model and Security System Design

A process framework for information security management

System Security Assurance: A Systematic Literature Review

A Framework of Information Security Integrated with Human Factors

Building a Viable Information Security Management System

An Information Security Performance Measurement Tool for Senior Managers: Balanced Scorecard Integration for Security Governance and Control Frameworks

A situation awareness model for information security risk management

Holistic Information Security Management and Compliance Framework

The Evolution of Information Security Strategies: A Comprehensive Investigation of INFOSEC Risk Assessment in the Contemporary Information Era

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management

Software, Attacker and Asset-centric Approach for Improving Security in System Development Process

Security Design Based on Social Modeling

Information security management and modelling

An integrated system theory of information security management

Using Process Models to understand Security Standards

Information Security Awareness Within Business Environment: An IT Review