<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Tania Wallis</style></author><author><style face="normal" font="default" size="100%">Chris Johnson</style></author><author><style face="normal" font="default" size="100%">Mohamed Khamis</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Interorganizational Cooperation in Supply Chain Cybersecurity: A Cross-Industry Study  of the Effectiveness of the UK Implementation of the NIS Directive</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">essential services</style></keyword><keyword><style  face="normal" font="default" size="100%">interorganizational cooperation</style></keyword><keyword><style  face="normal" font="default" size="100%">operational technology</style></keyword><keyword><style  face="normal" font="default" size="100%">supply chain</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2021</style></year></dates><volume><style face="normal" font="default" size="100%">48</style></volume><pages><style face="normal" font="default" size="100%">36-68</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The transposition of the EU Directive on Network and Information Security (NIS) by EU Member States involved assigning a set of responsibilities to operators, regulators and policy makers within a national cybersecurity strategy, in order to improve cybersecurity levels across critical infrastructures. This research investigates the perspectives and experiences of organisations affected by the NIS Directive focussing on three different sectors (Energy, Water &amp;amp; Aviation). The authors evaluate the response of different actors to NIS interventions and their challenges in meeting their assigned responsibilities, in particular their ability to oversee supply chain cybersecurity. It proposes further support for partnerships and cooperation across organisations to increase the effectiveness of NIS implementation. Based on results from semi-structured interviews and observations of industry working groups, an approach to supply chain oversight to achieve a balance between control and cooperation is recommended, to improve cybersecurity within industry sectors and across critical national infrastructures. Although our initial focus has been on working mainly with UK stakeholders, we argue that our recommendations have a more general application beyond those countries directly affected by the Directive.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><section><style face="normal" font="default" size="100%">36</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Hermann Kaponig</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Austria’s National Cyber Security and Defense Policy: Challenges and the Way Forward</style></title><secondary-title><style face="normal" font="default" size="100%">Connections: The Quarterly Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber defense</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity platform</style></keyword><keyword><style  face="normal" font="default" size="100%">interagency cooperation</style></keyword><keyword><style  face="normal" font="default" size="100%">whole-of-government</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year></dates><volume><style face="normal" font="default" size="100%">19</style></volume><pages><style face="normal" font="default" size="100%">21-37</style></pages><abstract><style face="normal" font="default" size="100%">The article presents Austria’s cybersecurity policy, set in a whole-of-government context. It is comprehensive, integrated, proactive, and based on solidarity and cooperation within and beyond the European Union. Transparent governance, the cooperation between public agencies, businesses, research institutes, and the citizens, investments in awareness, research and development are expected to protect effectively vital information and critical infrastructures. The Ministry of Defense and the Austrian Armed Forces contribute to the national policy primarily through the Joint Forces Command, the Communication and Information Systems &amp; Cyber Defense Command, and the two intelligence services.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Philipp Fluri</style></author><author><style face="normal" font="default" size="100%">Todor Tagarev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">The Concept of Resilience: Security Implications and Implementation Challenges</style></title><secondary-title><style face="normal" font="default" size="100%">Connections: The Quarterly Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">concept</style></keyword><keyword><style  face="normal" font="default" size="100%">crisis management</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">disaster risk</style></keyword><keyword><style  face="normal" font="default" size="100%">European Union</style></keyword><keyword><style  face="normal" font="default" size="100%">Hybrid threats</style></keyword><keyword><style  face="normal" font="default" size="100%">institutions</style></keyword><keyword><style  face="normal" font="default" size="100%">maturity</style></keyword><keyword><style  face="normal" font="default" size="100%">NATO</style></keyword><keyword><style  face="normal" font="default" size="100%">peacebuilding</style></keyword><keyword><style  face="normal" font="default" size="100%">police force</style></keyword><keyword><style  face="normal" font="default" size="100%">postconflict reconstruction</style></keyword><keyword><style  face="normal" font="default" size="100%">resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">Sendai Framework</style></keyword><keyword><style  face="normal" font="default" size="100%">stabilization</style></keyword><keyword><style  face="normal" font="default" size="100%">theory</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year><pub-dates><date><style  face="normal" font="default" size="100%">Summer 2020</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">19</style></volume><pages><style face="normal" font="default" size="100%">5-12</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Aiming for a more effective and efficient response to diverse and multidimensional threats, an increasing number of defense and security organizations, the United Nations, NATO, and the EU embrace the concept of resilience in their security strategies and policies. This article provides a brief overview of the concept, a sample of definitions used in policy documents, and the types of problems they seek to resolve. Then we introduce the reader to the 15 articles published in the Summer and Fall 2020 issues of Connections that present the evolution of the concept of resilience and its implementation by and within political, defense, and law enforcement organizations, as well as its anticipated contribution to cybersecurity, disaster preparedness, peacebuilding, post-conflict restoration and countering hybrid threats.</style></abstract><issue><style face="normal" font="default" size="100%">3</style></issue><section><style face="normal" font="default" size="100%">5</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Ludwig Leinhos</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Cyber Defence in Germany: Challenges and the Way Forward for the Bundeswehr</style></title><secondary-title><style face="normal" font="default" size="100%">Connections: The Quarterly Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber domain</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber operations</style></keyword><keyword><style  face="normal" font="default" size="100%">Hybrid threat</style></keyword><keyword><style  face="normal" font="default" size="100%">joint fusion centre</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year></dates><volume><style face="normal" font="default" size="100%">19</style></volume><pages><style face="normal" font="default" size="100%">9-19</style></pages><abstract><style face="normal" font="default" size="100%">Current conflicts are increasingly carried out in hybrid forms, including attacks on technical networks and campaigns aimed at influencing public opinion. The Bundeswehr has responded to this development by pooling its capabilities in this field and combining them in the new Cyber and Information Domain Service. On par with the classic service branches— Army, Air Force, and Navy—this service, with its approximately 14,500 members, makes an important contribution to the whole-of-government security provision.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Todor Tagarev</style></author><author><style face="normal" font="default" size="100%">Salvatore Marco Pappalardo</style></author><author><style face="normal" font="default" size="100%">Nikolai Stoianov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">A Logical Model for Multi-Sector Cyber Risk Management</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber risk assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">E-MAF</style></keyword><keyword><style  face="normal" font="default" size="100%">ECHO project</style></keyword><keyword><style  face="normal" font="default" size="100%">essential services</style></keyword><keyword><style  face="normal" font="default" size="100%">interdependencies</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2020</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">47</style></volume><pages><style face="normal" font="default" size="100%">13-26</style></pages><abstract><style face="normal" font="default" size="100%">&lt;p&gt;The increasing reliance on digital infrastructures makes whole sectors of the economy and public services vulnerable to attacks through cyberspace. Some progress has been made in understanding vulnerabilities and ways of reducing cyber risk at the sub-sectoral level. While the sectoral level remains a significant challenge, this study goes beyond, also addressing cyber risk resulting from the cross- and multi-sectoral interdependencies in a consistent logical model. The paper presents the scope of this logical model, outlines the problem of risk assessment, structured around the triplet &amp;ldquo;Threats &amp;ndash; Vulnerabilities &amp;ndash; Impact,&amp;rdquo; and the structuring of risk mitigation around types of risk reduction measures, the objective of decision-making on risk treatment, and the modalities of application. We provide examples of the implementation of the logical model, underlying the ECHO Multi-sector Assessment Framework, and conclude by emphasising the advantages the logical model and the framework provide.&lt;/p&gt;</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue><section><style face="normal" font="default" size="100%">13</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Sanjay Goel</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">National Cyber Security Strategy  and the Emergence of Strong Digital Borders</style></title><secondary-title><style face="normal" font="default" size="100%">Connections: The Quarterly Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber conflict</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber threats</style></keyword><keyword><style  face="normal" font="default" size="100%">interna­tional law</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2020</style></year></dates><volume><style face="normal" font="default" size="100%">19</style></volume><pages><style face="normal" font="default" size="100%">73-86</style></pages><abstract><style face="normal" font="default" size="100%">The growth of the Internet and innovation that thrived with it was facilitated by an environment relatively free of controls. Regrettably, however, with its deep integration into the societal framework, the Internet has become a potent tool for influencing geopolitical conflicts, including interference in internal affairs of other nations, undermining national security, destabilizing financial infrastructure, and attacks on critical infrastructure. While countries are harvesting the social and economic benefits of the Internet, they are frightened of the threats it poses to national security. In response to these threats, countries are starting to tighten their internet borders and developing their cyber weaponry both as a deterrent to, and leverage during conflicts. A potential downside of such state-by-state regulation is inhibition of the rapid innovation that the Internet has traditionally fostered and the curtailing of freedom of speech that has led to the social integration in the society. On the other hand, innovation and freedom cannot thrive in a chaotic environment with rampant crime and a lack of rules, norms, and ethics. With this in mind, national policymakers face the challenge of striking a balance between regulation and potential chaos on the Internet while at the same time promoting freedom. In efforts to strike such a balance of national interests, borders in cyberspace have an important role to play along with international efforts to build trust in cyberspace and to slow down the fragmentation of the Internet. This article discusses how cyber conflicts are escalating, how mutual distrust is growing, and how nation-states are adapting to the constantly changing cyber domain.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Jouni Pöyhönen</style></author><author><style face="normal" font="default" size="100%">Viivi Nuojua</style></author><author><style face="normal" font="default" size="100%">Martti Lehto</style></author><author><style face="normal" font="default" size="100%">Jyri Rajamäki</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Cyber Situational Awareness and Information Sharing in Critical Infrastructure Organizations</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">information sharing</style></keyword><keyword><style  face="normal" font="default" size="100%">Situational awareness</style></keyword><keyword><style  face="normal" font="default" size="100%">vital societal functions</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2019</style></year></dates><volume><style face="normal" font="default" size="100%">43</style></volume><pages><style face="normal" font="default" size="100%">236-256</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Cybersecurity-related capabilities play an ever-growing role in national security, as well as securing the functions vital to society. The national cyber capability includes the resilience of companies running critical infrastructures, their cyber situational awareness (SA) and the sharing of cybersecurity information required for cyber SA. As critical infrastructures become more complex and interdependent, ramifications of incidents multiply. The EU Network and Information Security Directive calls for cybersecurity collaboration between EU member states regarding critical infrastructures and places the most crucial service providers and digital service providers under security-related obligations. Developing better SA requires information sharing between the different interest groups and enhances the preparation for and management of incidents. The arrangement is based on drawing correct situation-specific conclusions and, when needed, on sharing critical knowledge in the cyber networks. The target state is achieved with an efficient process that includes a three-level—strategic, operational and technical/tactical—operating model to support decision-making by utilizing national and international strengths. In the dynamic cyber environment strategic agility and speed are needed to prepare for incidents. </style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue><section><style face="normal" font="default" size="100%">236</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Arnold C. Dupuy</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Cyber-Energy Infrastructure Vulnerabilities in the Hybrid Warfare Environment: Some DoD Mitigation Efforts</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cyber-energy nexus</style></keyword><keyword><style  face="normal" font="default" size="100%">hybrid warfare</style></keyword><keyword><style  face="normal" font="default" size="100%">Interagency</style></keyword><keyword><style  face="normal" font="default" size="100%">international cooperation</style></keyword><keyword><style  face="normal" font="default" size="100%">joint mission assurance assessments</style></keyword><keyword><style  face="normal" font="default" size="100%">non-linear warfare</style></keyword><keyword><style  face="normal" font="default" size="100%">operational energy context</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2018</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2018</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">39</style></volume><pages><style face="normal" font="default" size="100%">163-174</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The energy sector has long been recognized as critical infrastructure, particularly vulnerable to external penetration and manipulation by hostile elements. The cyber-energy nexus was chosen as the case study for this article. It highlights the growing vulnerabilities of the energy infrastructure to cyber threats and aims to move forward dialogue, mainly from the perspective of the US Department of Defense (DoD), on protecting DoD energy infrastructure from a variety of hybrid tools.
</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Oksana Medvedchuk</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Self-regulation as a Risk Mitigation Tool in the Design and Construction of Critical Infrastructures</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">construction</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">exploitation</style></keyword><keyword><style  face="normal" font="default" size="100%">risk management</style></keyword><keyword><style  face="normal" font="default" size="100%">security</style></keyword><keyword><style  face="normal" font="default" size="100%">self-regulation</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2018</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2018</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">40</style></volume><pages><style face="normal" font="default" size="100%">129-133</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;Critical infrastructures are of strategic significance for the functioning of the economy, the security of a state, society and the population. Their breakdown or destruction has a considerable impact on the national security and defence, the natural environment, leads to material and financial losses and possibly casualties. Therefore, ensuring quality and reliability of such infrastructure is a priority of the state policy. The state policy in this regard is implemented through state regulation mechanisms aiming to protect life, health, property, and the environment, as well as by establishing ways of organizing or conducting activities, licensing rules, place and time of activities, volume of production or provision of services, etc. Control and supervisory functions are also important elements of the state regulation. In the Ukrainian experience, traditional mechanisms of state regulation do not ensure a relevant culture in construction. Thus, it is necessary to study and implement best international practices of avoiding risks in construction, in particular by self-regulation. This paper reviews approaches to self-regulation and the extent to which such practices contribute to risk mitigation in the design and construction of critical infrastructure assets, as currently implemented in Ukraine.&lt;/p&gt;</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue><section><style face="normal" font="default" size="100%">129</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Inna Skarga-Bandurova</style></author><author><style face="normal" font="default" size="100%">Alexandr Ryazantsev</style></author><author><style face="normal" font="default" size="100%">Katerina Kiryushatova</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">An Experience Report on Education and Training Programme in Cybersecurity of Critical Infrastructures</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">curriculum</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">enterprise</style></keyword><keyword><style  face="normal" font="default" size="100%">industrial control system</style></keyword><keyword><style  face="normal" font="default" size="100%">resilience</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk Analysis</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2016</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2016</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">35</style></volume><pages><style face="normal" font="default" size="100%">123-132</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The paper presents the results of designing and implementing an educational programme in risk analysis of security and resilience of critical infrastructures. The main goal of the programme is to create a knowledge base for multidisciplinary research on critical infrastructure risk management and develop a security curriculum for suitable and recognized industry and academic experts. It is expected that this programme will allow training of highly-qualified specialists and arm them with up-to-date tools and techniques enabling security risk assessment, risk management, and response to new challenges of cyber society.</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue><section><style face="normal" font="default" size="100%">123</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Iztok Prezelj</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Comprehensive Security and Some Implemental Limits</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Asymmetric Threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Comprehensive security</style></keyword><keyword><style  face="normal" font="default" size="100%">Counter-terrorism</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">cross-sectoral approach</style></keyword><keyword><style  face="normal" font="default" size="100%">inter-organisational cooperation</style></keyword><keyword><style  face="normal" font="default" size="100%">multidimensional security</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk Assessment</style></keyword><keyword><style  face="normal" font="default" size="100%">threat assessment</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2015</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2015</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">33</style></volume><pages><style face="normal" font="default" size="100%">13-34</style></pages><abstract><style face="normal" font="default" size="100%">The changing security environment has led to the development of com¬prehensive security approaches, strategies and policies. The ‘Holistic approach’ has become an academic and practical mantra. This paper argues, however, that comprehensive security approaches face serious obstacles to their practical implementation. The critical evaluation of several examples confirms that the implementation phase is a weakness of comprehensive approaches and that a truly comprehensive and holistic approach seems to be beyond the implemental capacities of our security systems. Multi-sectoral and multi-level comprehensive approaches become less comprehensive when implemented in practice or even cannot be implemented due to existing narrow perceptions of security or narrow and short-term interests. The trans-sectoral second-, third- and fourth-order effects of proposed security measures are hardly considered or not considered at all. There is no consensus on what exactly comprehensive means, while prioritisation of some areas in the national security policy leads to de-prioritisation of other areas and new vulnerabilities, inter-organisational and cross-sectoral cooperation faces serious limits, threat, risk and vulnerability assessments are not really comprehensive, etc. This paper finishes with recommendations on what to do about these serious limits on the implementation of comprehensive security.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Velichka Milina</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Cybersecurity: A National Strategic Issue</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Cybersecurity</style></keyword><keyword><style  face="normal" font="default" size="100%">cybersecurity strategy</style></keyword><keyword><style  face="normal" font="default" size="100%">cyberspace</style></keyword><keyword><style  face="normal" font="default" size="100%">IT4Sec reports</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerability</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2013</style></year><pub-dates><date><style  face="normal" font="default" size="100%">June 2013</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">108</style></number><publisher><style face="normal" font="default" size="100%">Institute of Information and Communication Technologies</style></publisher><pub-location><style face="normal" font="default" size="100%">Sofia</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The modern information and communication age brought a complex of interdependencies among infrastructures that are essential for society and led to an exponential growth of vulnerabilities and risks. Hence, security of cyberspace turned into one of the most important challenges of Twenty first century, while cybersecurity is already seen as a cross-cutting, strategic national issue that impacts all societal levels. National cybersecurity strategies are expected to provide answers to the novel challenges and to guarantee security of cyberspace. This report provides analysis available national cyber strategies that allows identification of good practices and remaining gaps. For Member States of the European Union it is important to synchronize their national strategies with the EU strategy for cybersecurity.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Ricard Munné</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Future Security Trends and Their Impact from an Industry Point of View</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">comprehen¬sive approach</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">EU framework</style></keyword><keyword><style  face="normal" font="default" size="100%">foresight</style></keyword><keyword><style  face="normal" font="default" size="100%">global actor</style></keyword><keyword><style  face="normal" font="default" size="100%">impact</style></keyword><keyword><style  face="normal" font="default" size="100%">industry</style></keyword><keyword><style  face="normal" font="default" size="100%">Natural Disasters</style></keyword><keyword><style  face="normal" font="default" size="100%">security</style></keyword><keyword><style  face="normal" font="default" size="100%">supply chain</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2013</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2013</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">29</style></volume><pages><style face="normal" font="default" size="100%">147-160</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Impacts from future security trends on industry have been derived from the work performed in the scenario foresight for alternative futures, and for embedded scenarios of security research in the FOCUS project. For each FOCUS theme,  and for each scenario found in project reports, changes from the current situation have been analyzed and their impacts for different industries and activity sectors have been assessed. Trends have been grouped by industry/activity in each theme and those with significant ground in each scenario have been selected. According to scenario analysis, public services, ICT and technology, and critical infrastructure sectors are those which are more impacted by detected security trends from the scenarios analyzed. Specifically ICT has some cross cutting trends impacting in more than one theme, like information integration; intelligent knowledge based monitoring of new social media and other open information sources, information management and common situational pictures. Natural disasters, global environmental change and comprehensive approach are the most impacted FOCUS themes by future industry security trends. The analysis presented here may be useful for the assessment in the development of new research tracks or new products in the industry.</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue><section><style face="normal" font="default" size="100%">147</style></section></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Eugene Brezhnev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">An Approach for Assessing Risk of Common Cause Failures in Critical Infrastructures</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">common cause failures</style></keyword><keyword><style  face="normal" font="default" size="100%">coupling factors</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">multiple failures</style></keyword><keyword><style  face="normal" font="default" size="100%">safety</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2012</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2012</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">16</style></number><volume><style face="normal" font="default" size="100%">28</style></volume><pages><style face="normal" font="default" size="100%">199-210</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">This paper presents the technique for the critical infrastructure (CI) risk assessment based on Failure Modes, Effects and Criticality Analysis (FMECA), modified for multiple failures’ criticality assessment. The multiple failures (MFs) are significant contributors to risk in critical infrastructure. In spite of the low frequency of multiple failures’ occurrence, the severity of their consequences could lead directly to the CI’s accident and malfunctions. The influences of multiple failures should be taken into consideration as early as possible at the design stage. The paper presents classification of MFs, their root causes and coupling factors that stipulate the common susceptibility of systems to shared cause. The common cause failures (CCFs) are a subset of the dependant multiple failures. The qualitative procedure developed in the paper considers the consequences’ severity of CCFs on different I&amp;C system levels. The total severity of CCFs is presented as a sum of severities for each level. The results of FMECA for single independent failures are taken as initial data to perform FMECA for MFs</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Vladimir Sklyar</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Cyber Security of Safety-Critical Infrastructures: A Case Study for Nuclear Facilities</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">complexity</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">information security standards</style></keyword><keyword><style  face="normal" font="default" size="100%">NPP</style></keyword><keyword><style  face="normal" font="default" size="100%">nuclear power plant</style></keyword><keyword><style  face="normal" font="default" size="100%">Stuxnet.</style></keyword><keyword><style  face="normal" font="default" size="100%">vulnerability</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2012</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2012</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">8</style></number><volume><style face="normal" font="default" size="100%">28</style></volume><pages><style face="normal" font="default" size="100%">98-107</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Computers have become crucial to the operations of government and business. Critical infrastructure protection policy has evolved since the mid-1990’s. Since 11 September 2001, the critical link between cyberspace and physical space has been increasingly recognized. Presently, critical infrastructure sectors face various cyber threats. In particular, the electrical power infrastructure is the most critical infrastructure upon which other infrastructures depend. Cyber attacks on energy production and distribution systems could endanger public health and safety, damage the environment, and have serious financial implications, such as loss of production, generation, or distribution of public utilities; compromise proprietary information; or bring liability issues.  Government and private sector computer security is affected by various laws, but not all laws reflect newly emerging challenges. At the same, time poor systems management can be costly and disruptive. This paper presents an approach allowing to implement, manage and maintain cyber security program for Instrumentation and Control (I&amp;C) systems of Nuclear Power plants (NPP). It is based on existing standards’ requirements consideration of issues specific to the security of Field Programmable Gates Arrays (FPGA).</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Iosif Androulidakis</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">PRETTY (Private Telephony Security) - Securing the Private Telephony Infrastructure</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">PBX</style></keyword><keyword><style  face="normal" font="default" size="100%">PBX security</style></keyword><keyword><style  face="normal" font="default" size="100%">PSTN</style></keyword><keyword><style  face="normal" font="default" size="100%">Telephony</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2012</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2012</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">7</style></number><volume><style face="normal" font="default" size="100%">28</style></volume><pages><style face="normal" font="default" size="100%">89-97</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Private Branch Exchanges (PBXs) are privately owned equipment that serve the communication needs of a private or public entity making connections among internal telephones and linking them to other users in the Public Switched Telephone Network (PSTN) or other communication networks. Even if the core public network is operating normally, unintentional or targeted damages and attacks in PBXs can cause significant instability and problems. Furthermore, interception of calls is a very sensitive issue that affects all of us. In that sense, it is not an exaggeration to state that PBXs are part of a nation’s critical infrastructure. Much has been said and done regarding data communication security but PBXs have been left unprotected, forgotten and waiting to be attacked. This contribution outlines a targeted, centralized project in order to both educate the users and secure their telephony systems. It compromises of educational, policy, auditing, technical, documentation, hardware and software solutions and actions that could be implemented under a joint project.</style></abstract><issue><style face="normal" font="default" size="100%">1</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Todor Tagarev</style></author><author><style face="normal" font="default" size="100%">Venelin Georgiev</style></author><author><style face="normal" font="default" size="100%">Valeri Ratchev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">A Taxonomy of Essential Services</style></title><secondary-title><style face="normal" font="default" size="100%">Radioelectronic and Computer Systems</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Comprehensive approach</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Planning</style></keyword><keyword><style  face="normal" font="default" size="100%">risk management</style></keyword><keyword><style  face="normal" font="default" size="100%">security policy</style></keyword><keyword><style  face="normal" font="default" size="100%">threats</style></keyword><keyword><style  face="normal" font="default" size="100%">Uncertainty</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2012</style></year><pub-dates><date><style  face="normal" font="default" size="100%">May 2012</style></date></pub-dates></dates><publisher><style face="normal" font="default" size="100%">Radioelectronic and Computer Systems 6(58)</style></publisher><pub-location><style face="normal" font="default" size="100%">Sevastopol, Ukraine</style></pub-location><pages><style face="normal" font="default" size="100%">191-196</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Communities, countries and alliances cannot be efficient in preparing to meet diverse threats to their security within traditional organizational stovepipes. The boundaries between ‘internal’ and ‘external’ threats are getting fuzzier, and the vulnerabilities of governments, businesses and communities feed on each other, while the comprehensive approach is gaining traction in ever more security fields. The implementation of the comprehensive approach poses a number of methodological challenges. While it clearly requires coordination of various capabilities of a multitude of actors, it is less apparent which is the suitable organising concept. This paper takes as a starting point the concept of ‘essential services’ and suggests a taxonomy, that would allow to treat threats, vulnerabilities and risk in a common comprehensive framework. The taxonomy has been developed with a specific purpose in mind, and thus refers to European Essential Services (EES). We nevertheless reason that it can be replicated to support decision making at other levels, e.g. in national security policy making and planning. </style></abstract><issue><style face="normal" font="default" size="100%">58</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Yvan Gauthier</style></author><author><style face="normal" font="default" size="100%">Jay Adamsson</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Decision Support Tools for Domestic Security Operations</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">CBRNE</style></keyword><keyword><style  face="normal" font="default" size="100%">civil assistance</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Decision Support</style></keyword><keyword><style  face="normal" font="default" size="100%">domestic operations</style></keyword><keyword><style  face="normal" font="default" size="100%">major security events</style></keyword><keyword><style  face="normal" font="default" size="100%">Modelling</style></keyword><keyword><style  face="normal" font="default" size="100%">Natural Disasters</style></keyword><keyword><style  face="normal" font="default" size="100%">pandemics</style></keyword><keyword><style  face="normal" font="default" size="100%">simulation</style></keyword><keyword><style  face="normal" font="default" size="100%">wiki.</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2011</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2011</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">27</style></volume><pages><style face="normal" font="default" size="100%">123-137</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">This paper documents the production of a compendium of modelling and simulation (M&amp;S) tools useful for decision support to organizations engaged in domestic defence and security operations. The compendium was created on GCPEDIA, a wiki application accessible to all federal government departments and agencies in Canada. It includes tools for predicting the consequences of natural and man-made disasters, planning major event security, assessing infrastructure criticality, planning surveillance missions, and analyzing other issues relevant to domestic operations. Given the wide accessibility of the compendium within the Government of Canada, a large community of practice can use, update, and expand on the information collected</style></abstract><issue><style face="normal" font="default" size="100%">2</style></issue></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Angel Chakarov</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Welcoming Address</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Civil protection</style></keyword><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">prevention</style></keyword><keyword><style  face="normal" font="default" size="100%">scientific support</style></keyword><keyword><style  face="normal" font="default" size="100%">welcoming address</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2009</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2009</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">24</style></volume><pages><style face="normal" font="default" size="100%">9-10</style></pages><language><style face="normal" font="default" size="100%">eng</style></language></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Klaus Niemeyer</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Simulation of Critical Infrastructure</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security : An International Journal</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Gamma Methodology</style></keyword><keyword><style  face="normal" font="default" size="100%">Modelling and Simulation</style></keyword><keyword><style  face="normal" font="default" size="100%">Powersim</style></keyword><keyword><style  face="normal" font="default" size="100%">System Dynamics</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2005</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2005</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">17</style></volume><pages><style face="normal" font="default" size="100%">120-143</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The paper presents a set of model prototypes developed to simulate the most critical areas of a highly-developed region in social, economic, technical and informational terms. The models were developed inspired by the fact that the highly integrated information infrastructure creates risks of failure and intrusions with a possible consequence of total loss of vital resources, such as energy or traffic. The models are seen on three levels of abstraction and are programmed and executed with tools from System Dynamics. On the highest level of abstraction, the modelled region is described and calculated using system attributes and variables like pro¬ductivity, social pressure, satisfaction, etc. Different layers of social, informational and physical realities are defined. On the medium level of abstraction, critical areas of an advanced society are identified and calculated using variables that represent an entity in the reality and that, in general, have an empirical context. Identified critical areas for the first experiments with the model were the sectors of energy, communications, traffic, security, government, and defence. Applying a methodol¬ogy to identify value drivers and to visualise the interrelations of components in complex systems helped in developing the model inputs and descriptive factors. This approach was used together with a group of experts in each area. On a low level of abstraction, a model prototype was developed using variables that in gen¬eral can be measured and quantified based on real-life empirical sources. The latter approach is very complex and resource-intensive and requires detailed insight and knowledge. The first application of the models was related to an exercise that demonstrates the risks of software attacks in information networks and the possible consequences for other sensitive areas. Sensitivity analyses with the models showed that the threat of intrusion into the information networks with the consequence of loss of vital resources is likely to be overestimated in comparison to the threat of a direct attack on the relevant vital sectors.</style></abstract></record><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Klaus Niemeyer</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Simulation of Critical Infrastructures</style></title><secondary-title><style face="normal" font="default" size="100%">Information &amp; Security: An International Journal </style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">Critical Infrastructure</style></keyword><keyword><style  face="normal" font="default" size="100%">Gamma Methodology</style></keyword><keyword><style  face="normal" font="default" size="100%">Modelling and Simulation</style></keyword><keyword><style  face="normal" font="default" size="100%">Powersim</style></keyword><keyword><style  face="normal" font="default" size="100%">System Dynamics</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2005</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2005</style></date></pub-dates></dates><volume><style face="normal" font="default" size="100%">17</style></volume><pages><style face="normal" font="default" size="100%">120–143</style></pages><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The paper presents a set of model prototypes developed to simulate the most critical areas of a highly-developed region in social, economic, technical and informational terms. The models were developed inspired by the fact that the highly integrated information infrastructure creates risks of failure and intrusions with a possible consequence of total loss of vital resources, such as energy or traffic. The models are seen on three levels of abstraction and are programmed and executed with tools from System Dynamics. On the highest level of abstraction, the modelled region is described and calculated using system attributes and variables like productivity, social pressure, satisfaction, etc. Different layers of social, informational and physical realities are defined. On the medium level of abstraction, critical areas of an advanced society are identified and calculated using variables that represent an entity in the reality and that, in general, have an empirical context. Identified critical areas for the first experiments with the model were the sectors of energy, communications, traffic, security, government, and defence. Applying a methodology to identify value drivers and to visualise the interrelations of components in complex systems helped in developing the model inputs and descriptive factors. This approach was used together with a group of experts in each area. On a low level of abstraction, a model prototype was developed using variables that in general can be measured and quantified based on real-life empirical sources. The latter approach is very complex and resource-intensive and requires detailed insight and knowledge. The first application of the models was related to an exercise that demonstrates the risks of software attacks in information networks and the possible consequences for other sensitive areas. Sensitivity analyses with the models showed that the threat of intrusion into the information networks with the consequence of loss of vital resources is likely to be overestimated in comparison to the threat of a direct attack on the relevant vital sectors.</style></abstract></record></records></xml>