Digital transformation of public security - developing tripleloop- learning artifacts to meet emerged information security incident response resilience and readiness challenges in public emergency organizations

Abstract

Studies have found that resilience and response capabilities in a cyber-attack are unfamiliar to organizations, and it is also found that not only the IT-personnel, but also the crisis management group and teams need socio-technical resilience and readiness to handle such attacks. To overcome this resilience and readiness gap in the society and shortage of trained personnel to handle information security incidents, this project was established to suggest effective and efficient methods and tools and artifacts to train and work with information- and cyber security incident management in all organizations in general and particularly in public emergency organizations. The Design Science Research in Information Security as a pragmatism philosophical perspective was chosen for this project to develop learning artifacts to close the resilience and readiness gap in public emergency organizations. The research was approached with a naive inductive approach, and the strategy has been to meet the challenges with multiple mixed methods, and several public emergency organizations have been invited to take part in the research. Mostly, the studies have been cross-sectional, but the student-exercise have been executed over a 3-year period (longitude). The collection of data was initially done explanatory and descriptive, but exploratory data collection was collected to discuss and validate the findings. To analyze the data, socio-technical root-cause-analysis, categorical analysis from descriptive data/results questionnaires and expected/not expected or yes/no questions (dichotomous descriptive data), and qualitative effect analysis from the variety of actions, were used. In this thesis summary, several key concepts from the research project that have been developed and published in conference proceedings and journals are presented, together with analyzes of data from case-studies, training and exercises executed in the period of the research. Two publications and one report (appendix) present the current level of resilience and readiness in public emergency organizations, five of the publications and the appendix presents learning knowledge and learning frameworks, and four of the publications presents frameworks to learn from exercises. The major findings of this project are that a preparation for exercises framework and how to build EXCON teams for full-scaled information- and cyber security exercises has received very little attentions in the research community, and also in regard to societal training for readiness and resilience experiencing a cyber-attack. It was also established that 1) triple-loop-learning and 2) scoping development of serious games for information- and information- and cyber security incident response, are both relevant and new approaches to information security management exercises. Fine-tuned coordinated learning activities to meet the timeline of a scenario, and triple-loop-learning activities for use in the exercises are of great importance, and a user-centric-approach is of importance to be able to implement the activities at the right level in the organization and to close the gap one step at the time. Finally, socio-technical learning activities have shown that 1) targeted exercise goals developed in the scenarios are met during the exercises, 2) socio-technical step-by-step improvement can be developed based on the level of escalation maturity, and 3) organizations can learn from training and exercises.