Computers & Industrial Engineering 149 (2020) 106829

Contents lists available at ScienceDirect

Computers & Industrial Engineering

journal homepage: www.elsevier.com/locate/caie

Understanding the management of cyber resilient systems

Alessandro Annarelli , Fabio Nonino , Giulia Palombi *
Department of Computer, Control and Management Engineering, Sapienza University of Rome, Rome, Italy

A R T I C L E I N F O A B S T R A C T

Keywords: The digital age characterizes the 21-century by the widespread and conscious use of Information Technology,
Resilience originating the need for organizations to protect one of the most critical and valuable resources: information.
Cyber security Cyber security was born to protect information systems from cyber-attacks. Organizational resilience refers to the
Cyber resilient systems
ability of a system to adapt to a change: a very contemporary concept that is finding more and more importance
Cyber resilience framework
Multiple case study
in our continuously changing society, assuming also a greater relevance in the cyber context. Therefore, the
ability of organizations to react to cyber-attacks and to evolve to a new robustness after successful outbreaks
recalls the concept of resilience and brings to the evolution of this concept into that of cyber resilience. In order
to offer a deep insight on the management of cyber resilient systems and to propose a Managerial Cyber
Resilience Framework, clarifying the role of context in the correct selection and implementation of different tools
and practices, we conducted an exploratory multiple case study analysis in six companies operating in three
different industries: consultancy, public administration and banking. The results provide interesting managerial
actions to undertake for the management of cyber resilient systems also in consideration of specific contextual
factors.

1. Introduction operations in both expected conditions and unexpected conditions

(Wieland & Wallenburg, 2013).
Nowadays, according to complexity and level of digitalization of its Several methods confuse or do not discriminate resilience, i.e. the
business and to value offered to social and economic context, every ability to resist and recover quickly from unknown and known threats,
organization has an IT system and the necessity of cyber security tools with the risk, i.e. the product between the probability of an adverse
for protecting information and digitalized processes from fraud attempts event and the extent of the resulting damage (Kaplan & Garrick, 1981;
and acts of vandalism (Von Solms & Van Niekerk, 2013). Cyber-attacks Soni, Jain, & Kumar, 2014). Nevertheless, often, organizations do not
consist of any action taken by individuals or organizations to undermine recognize the threat until it occurs; therefore, the complexity of cyber
the functions of information systems, infrastructures or computer systems and cyber threats requires the integration of the risk manage­
network or personal electronic devices trough crimes (Kawanaka, Mat­ ment process and the resilience management process.
sumaru, & Rokugawa, 2014). These actions are, for example, hacking, Taking the theoretical background on previous researches on cyber
bombing, cutting, infecting. They are a real and significant danger for resilience management models as a starting point, this study aims to
many countries, their citizens, businesses and the economy in general contribute explaining how to manage cyber resilient systems taking into
and can be fronted by the implementation of a so-called cyber resilient account the business context. More concretely, to comprehend how
system (Wang & Lu, 2013). companies should correctly align the managerial actions and practices in
The ability to react to these attacks and to design and implement a a set of logical steps for enhancing cyber security resilience. Gathering
more robust organization recalls the concept of resilience, known in the data using a structured exploratory study based on six exemplary
physics as the assumption of sustaining crashes without breaking. In case studies, we aimed at giving some clarifications on how can com­
management sciences, resilience is defined as the ability of an organi­ panies effectively introduce and implement cyber resilient system and
zation to adapt to unexpected disruptive changes or the intrinsic ca­ how different contexts influence companies’ the management of cyber
pacity of a system to modify its functioning before, during and after a resilient systems in a Managerial Cyber Resilience Framework.
disruptive change or a trouble, for being able to continue the necessary The paper is organized as follows. The second section contains the

* Corresponding author.
E-mail addresses: [email protected] (A. Annarelli), [email protected] (F. Nonino), [email protected] (G. Palombi).

https://doi.org/10.1016/j.cie.2020.106829
Received 28 January 2020; Received in revised form 1 September 2020; Accepted 3 September 2020
Available online 8 September 2020
0360-8352/© 2020 Elsevier Ltd. All rights reserved.
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 1
Main works on the management of cyber resilient systems.
Author (year) Objectives Main findings Contextual
Factors

Katsumata et al. To propose a proactive approach that builds protective and Cyber Security Risk Management (CSRM): a systematic approach for • Industry
(2010) resilient mechanisms to provide greater assurance to the assessing system security risk • Infrastructure
organizational information system
Steen and Aven To understand how risk can be assessed and treated to enhance The basic ideas of resilience engineering can be supported by the (A, –
(2011) resilience engineering C, U) risk perspective
Bodeau and To investigate how to evolve architectures, cyber resources, Cyber Resiliency Engineering Framework –
Graubart (2011) and operational processes to provide cost-effective cyber
resiliency
Burstein et al. (2012) To diagnose an attack, to quickly switch to calculated backup Strategic and tactical resiliency against threats to ubiquitous systems • Infrastructure
actions and predict downstream events by the attackers to make model (STRATUS)
the functions resilient to those attacks
Linkov, Eisenberg, To provide recommendations for resilience metrics Resilient Matrix Framework –
Bates, et al. (2013)
Linkov, Eisenberg, To provide the metrics recommended by Linkov, Eisenberg, Resilient Metrics –
Plourde et al. Bates, et al. (2013)
(2013)
Collier et al. (2014) To show how risk-based standards can move beyond risk A risk-based cyber security framework • Infrastructure
assessment to create systems that are more resilient to dynamic
threats
DiMase et al. (2015) To provide an holistic analysis of the health status of the cyber- Cyber Physical Systems Security Framework (CPSS) • Infrastructure
physical security
Boyes (2015) To detail the cyber security attributes that affect cyber Three main clusters affecting cyber resilience are identified • Infrastructure
resilience
Davis (2015) Building cyber-resilience into supply chains He identifies factors affecting the ability of an acquirer to protect its –
information using a simplified supply chain model
Jensen (2015) Cyber-resilience for the efficient functioning of the maritime Three principal tools are recommended: • Industry
industry 1) informational campaigns • Infrastructure
2) pressure from customers
3) “cyber premiums” on insurance policies
Sharkov (2016) To design a roadmap for the cyber-security national strategy The implementation of the so-called “CIA triad” and the • Industry
measurement of knowledge of risks and threats: “Known”, • Ownership
“Unknown knowns” and “Unknown unknowns”
Tran et al. (2016) To combat a zero-day malware attacks Cyber Resilience Recovery Model (CRRM) –
Gisladottir et al. To demonstrate the effects of under- and overregulation on Development of a model of corporate cyber network under attack, • Infrastructure
(2017) organizations’ resilience in front of insiders’ threats embedding cyber security human factors and organizations’ • Ownership
regulatory context.
Rohmeyer et al. To test Capability Effectiveness for Architectural Resiliency in Complete cyber resilience tests, based on the principles of cyber war- • Infrastructure
(2017) Financial Systems gaming to involve all corporate domains, have the potential to • Industry
increase knowledge, improve resilience and make its improvement
measurable
Koelemeijer (2018) To enhance the cyber resilience of critical infrastructures The study provides a basis for the correction functioning of adaptive • Infrastructure
through an evaluation methodology based on assurance cases systems by automatically generating and reviewing assurance cases
Carayannis et al. To outline the anatomy an ambidextrous approach to cyber Multistage approach under a 7Ps stage gate model. • Industry
(2019) security • Society
• Ownership
Caron (2019) To highlight the potential of cyber-testing techniques in Cyber-testing techniques are providing insight in the effectiveness of • Infrastructure
assessing the effectiveness of cyber-security controls and the actual implementation of cyber-security control and concise
obtaining audit evidence input for cyber-risk management and improvement
recommendations
Ganin et al. (2020) To develop a method to evaluate the resilience effects of Resilience and efficiency are not necessarily correlated. By balancing • Industry
Intelligent Transportation Systems on a metropolitan area resilience and smartness within systems, transportation systems can • Infrastructure
increase the likelihood that systems maintain functionality without
compromising significant efficiency, especially during disruptions

theoretical background about the concepts of cyber resilience and the 2. Theoretical background and research questions
main models for the cyber resilience based on risk and resilience;
further, we formalize the emerging research gap about missing link 2.1. Cyber resilience
among contextual factors and cyber resilient systems’ implementation
and we define the research question. The third section (methods) de­ In the interconnected digital world, cyber resilience is a condition for
scribes the research methodology, a multiple case studies analysis, and continuous existence and competitive advantage, so the trend is towards
the research protocol. The fourth section (results) contains the adopting resilient strategies and operations to ensure success when
descriptive analysis of the cases and the last one (discussion and operating in a hyper-connected system. Attention paid by companies to
conclusion) discuss our results and report a Managerial Cyber Resilience resilience is not only vital for the sustainability and growth of their
Framework, summarizing contributions and research limitations, business models but also a source of competitive advantage. In order to
together with possible future research directions. survive and guarantee longevity, companies must be constantly
evolving, being able to adapt quickly, reacting to the ever-changing
environment and, above all, they should have the ability to recover
quickly from unforeseen events. Resilience of cyber-systems or cyber-
physical systems is essential to maintain trust and privacy by

2
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

mitigating security risks, protecting customers and providing them with wellbeing of people, whose disruption or destruction would have a
better and safer services (Knowles, Prince, Hutchison, Disso, & Jones, significant impact (Linkov & Trump, 2020).
2015). The industry, i.e. the sector in which the organization is embedded,
Two features belong to a resilient system: (1) robustness against the received great importance in determining managerial actions to un­
predictable attacks and (2) ability to come back to a safe state if an dertake. One of the main contextual factors (function of the industry) is
attack has been successful, without regressing (Rogers, Apeh, & to be customer-oriented or consumer-oriented: in the first case, mana­
Richardson, 2016). This is the ability of the system to adapt, to reduce gerial actions are meant also to ensure cyber security of client companies
the probability of having to deal with sudden disturbances and having to (mostly common in business-to-business markets), while in the second
resist their spread, maintaining control over structures and functions, case activities and actions are aimed at securing only the company and
and being ready to recover and respond with immediate and effective its private clients (business-to-consumers markets). Therefore, the set of
reactive plans to overwhelm the disturbance and restore to a robust state required managerial actions to ensure cyber security varies in the two
of operations. cases, and also according to specific criticalities of business models and
Roege et al. (2017) propose a distinction between safety and resil­ types of clients (Kott and Linkov, 2019).
ience: the first one focusses on the protection of systems from threats or The last contextual factor is the ownership: public and private or­
events, while the second one is the ability to prepare and adapt to ganizations could undertake different managerial actions. The main
changing conditions, to resist and to recover quickly from interruptions. differences between public and private organizations’ investment
In detail, resilience includes the ability to resist and recover from strategy are drivers (regulations for the public organizations and client/
intentional attacks, accidents, threats and natural disasters. Cyber supplier demands for the private ones) and the information resources
resilience requires the integration of the risk management process and (mainly standards for public organizations and stakeholder re­
the resilience management process (Collier et al., 2014). Risk manage­ quirements for the private ones) (Rowe & Gallaher, 2006).
ment selects and prioritizes potential measures to prevent or mitigate Risk management can be a good starting point to create a resilient
impacts, whereas resilience seeks to improve the system’s inherent cyber system considering disruptive risks. Disruptive risks, as well as
ability to respond to inevitable changes, both long and short, thus recovery and reaction strategies, can be categorized by the type of action
adopting a time perspective. “Improving a system’s resilience offers and the way of thinking they imply (Ribeiro & Barbosa-Povoa, 2018).
significant advantages in managing risk; improving the resilience of a Reducing the probability of facing sudden disturbances, resist the spread
system constitutes an integral part of the risk management process” of disturbances by maintaining control over structures and functions,
(Haimes, 2009: 500). “Successful implementation of these mechanisms and recover and respond by immediate and effective reactive plans to
will depend on the integration of risk- and resilience-based management transcend the disturbance and restore to a robust state of operations
in an adaptive framework” (Collier et al., 2014: 70). Indeed, a vision (Kamalahmadi & Parast, 2016).
based on risk management focuses on prevention or protection against Katsumata, Hemenway, and Gavins (2010) propose a proactive
intrusions (avoiding risk) or on mitigating the negative consequences of approach that builds protective and resilient mechanisms to provide
an event. Differently, an approach based on resilience is concerned with greater assurance to the organizational information system. This
ensuring the continuity of functions and critical services and continu­ approach is called Cyber Security Risk Management (CSRM). CSRM
ously improving the overall context. Linkov and Trump (2019) suggest starts with the NIST methodology, which includes three processes: risk
that the two approaches have to be considered as complementary, as the assessment, risk mitigation and monitoring/control, extending to a four-
benefits deriving from one can directly affect the working of the other. step process that includes an initial phase of risk management planning.
The evaluation process establishes the risk baseline; the mitigation
2.2. Management of cyber resilient systems process uses a cost-benefit analysis to evaluate potential additional
countermeasures that reduce risk; the CSRM risk monitoring and control
An organizational system, inherently complex and multi-faceted, in process provides a method of “monitoring of identified risks, monitoring
order to be considered resilient must maintain operations under attack of residual risks, identification of new risks, execution of risk mitigation
or failure, while being able to reconfigure and/or recover its attributes, plans and assessment of their effectiveness”. It also includes feedback
and eventually restore the original state (Bishop, Carvalho, Ford, & cycles to allow a continuous process of risk assessment, mitigation and
Mayron, 2011). A resilient system can be described and summarized by monitoring.
mean of four key attributes, namely capacity, flexibility, tolerance and Steen and Aven (2011) in order to enhance resilience engineering,
cohesion (Kott and Linkov, 2019; SEBoK, 2017). suggest the use of a risk perspective different from the most popular one.
Despite research on cyber systems witnessed an important develop­ In this case, probability is replaced by uncertainty. The (A; C; U) risk
ment throughout the years, aspects related to security (and therefore perspective in fact takes in consideration event A, consequence C and
resilience) of cyber systems still represent an open issue, gaining also uncertainty U. Collier et al. (2013) in their risk-based cyber security
more importance in relationships with the rising developments of cloud- framework show how risk-based standards can move beyond risk
based systems (Mourtzis & Vlachou, 2016). For example, there are assessment to create systems that are more resilient to dynamic threats.
studies focused on the context of manufacturing SME providing cloud- According to Jensen (2015), cyber-resilience for the efficient func­
based approaches for process planning (Mourtzis, Vlachou, Xantho­ tioning of the maritime industry should improve the risk management
poulos, Givehchi, & Wang, 2016) and for the monitoring of approach implemented by the introduction of the following guidelines:
manufacturing equipment (Tapoglou et al., 2015), and an internet of 1) informational campaigns directed at the maritime companies in terms
things-based monitoring system for shop-floor control (Mourtzis, Milas, of the cyber-risks they face; 2) pressure from customers who are made
& Vlachou, 2018). increasingly aware of the risk to their cargo in cases where maritime
Several authors have proposed over the years methods for creating companies lack cyber-defenses; and finally 3) “cyber premiums” on in­
resilient systems for cyber security. Table 1 summarizes the main works surance policies that reflect the degree to which maritime companies
on the management of cyber resilient systems to highlight actions adhere to the voluntary guidelines.
needed and contextual factors. Fundamentally, possible strategies for resilience can be divided into
From the analysis of papers reported in the table, three contextual two categories, proactive or reactive, (Hohenstein, Feisel, Hartmann, &
factors recur: infrastructure, industry and ownership. Giunipero, 2015) even if a third one is more focused on the anticipation
The infrastructure can be critical or non-critical. Critical infrastruc­ and awareness of events (Kott, Wang, Erbacher, 2015). On one hand
ture represents an asset, a system or a part that is essential for main­ resilience is the simple ability to rebound from adverse situations and to
taining vital functions, health, safety, security, economic or social resume activities quickly and, on the other hand, is the development of

3
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

new skills, including the ability to keep pace and create new opportu­ controlling access and system operations (confidentiality and posses­
nities to deals with unexpected challenges (Abdullah, Noor, & Ibrahim, sion) and continuity of operations safety personnel & assets (availabil­
2013). Furthermore, organizations can be modelled and represented as ity/reliability, safety and resilience).
networks, and their structural characteristics can have a non-negligible Davis (2015) identifies factors affecting the ability of an acquirer to
impact on resilience attributes (Gisladottir, Ganin, Keisler, Kepner, & protect its information using a simplified supply chain model. These
Linkov, 2017). factors are (1) state cyber security requirements to suppliers using a
Tierney and Bruneau (2007) establish four key attributes of resilient common framework and language, (2) integrate cyber security into the
systems: (1) robustness (resisting disruptive forces), (2) redundancy acquirer procurement process (3) devote resource to investigate the
(meeting the functional requirements with replaceable system ele­ makeup of the supply chain (i.e. which supplier organizations make up
ments), (3) resourcefulness (effectively exploiting resources to diagnose the supply chain), (4) understand how a supplier meets the acquirer’s
and solve problems) and (4) speed (recover quickly from an requirements when not using a common, shared, framework, and lan­
interruption). guage, (5) identify acquirer information shared between the acquirer
Bodeau and Graubart (2011) propose the Cyber Resiliency Engi­ and its direct suppliers, and acquirer information shared between direct
neering Framework: this framework aims at providing an analysis ori­ and indirect suppliers.
ented toward cost-effective cyber resiliency by investigating the Sharkov (2016) shows the approach implemented in Bulgaria to
evolution of architectures, cyber resources, and operational processes. design a roadmap for the cyber-security national strategy. The national
Burstein et al. (2012) propose a model called STRATUS: strategic and strategy for Bulgarian cyber-security focus on two main aspects: the
tactical resiliency against threats to ubiquitous systems. This model uses implementation of the So-called “CIA triad” i.e. a triad for information
an overload of computational resources to diagnose an attack, to quickly security made by confidentiality, integrity and availability and the
switch to calculated backup actions and predict downstream events by measurement of knowledge of risks and threats. Those two aspects allow
the attackers to make the functions resilient to those attacks. It uses an the structuring of objectives and measures at three nested levels: infor­
ontological model containing missions, components, vulnerability, mation security, IT security and IT resilience. Threats, objectives and
reliability levels for hardware and software resources provided with measures are outlined in three categories: “Known”, “Unknown knowns”
attack tests, schemes of the attack plan for multi-stage attacks, host and and “Unknown unknowns”.
cluster organization to think about how physical or network proximity Tran, Campos-Nanez, Fomin, and Wasek (2016) designed the Cyber
can contribute to the possibility of vulnerability. Resilience Recovery Model (CRRM) to combat a zero-day malware at­
The US National Academy of Sciences defined the four attributes of tacks. The model provides insights into the strengths and weaknesses of
resilience, i.e. plan/prepare, absorb, recover and adapt. Furthermore, current recovery processes and presents possible solutions for address­
the NAS incorporated these in the definition provided for resilience, ing changing cyber security threats.
labelled as “the ability to prepare and plan for, absorb, recover from, and Best practices as awareness trainings or the isolation of a machine
more successfully adapt to adverse events” (National Academies (US), infected with zero-day malware using the full containment method
2012: p. 16). formatting and re-imaging a machine infected with zero-day malware
Linkov, Eisenberg, Bates, et al. (2013) reconsidered the above at­ are indicated.
tributes (National Academies (US), 2012) to design the resilient matrix Rohmeyer, Ben-Zvi, Lombardi, and Maltz (2017) believe that com­
framework. In this matrix, the column indexes are the four attributes, plete cyber resilience tests, based on the principles of cyber war-gaming
turned into a four-stage life-cycle model, i.e. plan/prepare, absorb, to involve all corporate domains, have the potential to increase knowl­
recover and adapt, while the rows represent the four domains taken edge, improve resilience and make its improvement measurable. Coor­
from Network-Centric Operations doctrine (Alberts & Hayes, 2003) i.e. dinated game events, discussion-based seminars and conferences, and
physical, information, cognitive and social. Cells in this matrix contain special forums to support collaborative analysis of real-world events and
recommendations for determining resilience metrics. Linkov, Eisenberg, emerging threats are also recommended.
Plourde et al. (2013) provided these metrics. Carayannis, Grigoroudis, Rehman, and Samarakoon (2019) outline
Ferdinand (2015) studied how to build and to maintain a state of the anatomy an ambidextrous approach to cyber security adopting a
cyber resilience in organizations. The focus is on the organizational balanced scorecard, multistage approach under a 7Ps stage gate model
learning of the environment both internally and externally and the (Patient, Persistent, Persevering, Proactive, Predictive, Preventive, and
ability to exploit opportunities and manage threats in four moments: Preemptive). Such an approach “emphasizes the need to enable a com­
monitoring, analysis, decision-making and change. A structure with plex, nonlinear, adaptive process of dynamic intangible organizational
dynamic capabilities must present both reactive capacities, necessary to assets, resources, and capabilities across a performance frontier” (p. 1)
respond to market changes, and proactive capacities that allow fore­ in order to enhance cyber resilience.
seeing and creating market changes. The combined use of dynamic ca­ Caron (2019) highlights the potential of cyber-testing techniques in
pabilities, i.e. (1) ordinary defensive capabilities, (2) dynamic resilience assessing the effectiveness of cyber-security controls and obtaining audit
capabilities and (3) extraordinary capabilities, leads to increasing levels evidence.
of maturity in the area of computer (cyber) resilience. Recently, Ganin et al. (2020) investigated the interconnections of
DiMase, Collier, Heffner, and Linkov (2015) propose the cyber resilience with other systemic attributes, e.g. security and efficiency, in
physical systems security framework (CPSS). According to this frame­ the context of urban areas/smart cities and transportation, with
work, the following ten areas of concern enable an holistic analysis of particular interest toward Intelligent Transportation Systems. Scenario
the health status of the cyber-physical security: (1) Electronic and analyses led authors to conclude that there are complex in­
physical security, (2) Information assurance (IA) and data security, (3) terconnections and tradeoffs between smartness and resilience, as some
Asset management and access control, (4) Life cycle and diminishing systems may benefit more from smart development and less from resil­
manufacturing sources and material shortages (DMSMS), (5) Anti- ience, or the opposite, depending on several characteristics, as for
counterfeit and supply chain risk management (SCRM), (6) Software instance dimensions and the presence of critical infrastructures.
assurance and application security, (7) Forensics, prognostics, and re­
covery plans, (8) Track and trace, (9) Anti-malicious and anti-tamper, 3. Research gap and research question
(10) Information sharing and reporting.
Boyes (2015) details the cyber security attributes that affect cyber As evidenced from the analysis of literature, a non-negligible number
resilience. They are divided in three main clusters: information quality of contributions highlighted the impact and relevance of some contex­
& validity system configuration (integrity, utility and authenticity); tual factors (i.e. infrastructure, ownership, industry) in determining the

4
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 2
Sample description.
Case 1 Case 2 Case 3 Case 4 Case 5 Case 6

Country U.K. EU Country Italy Italy Italy Italy

Industry Consultancy Military (Public Banking Consultancy Public administration Banking
administration)
Years of activity 10 years 1 year 8 years 4 years 15 years 30 years
Number of employees 200.000 300 89.000 950 40 500
(approx.)
Number of employees More than 100 More than 200 150 3 3 5
involved in Cyber Security
Key informant Cyber Security Brigade General Cyber Senior Cybersecurity Self Employed consultant Business continuity &
Manager Analyst Partner for cybersecurity disaster recovery manager

management of cyber resilient systems, together with corresponding were taken, how they were implemented, and with what result
actions to be undertaken. (Schramm, 1971).
Despite many frameworks, methodologies, metrics and best practices Cyber security can be considered as a relatively new topic, the
developed in literature acknowledged the importance of contextualiza­ existing theoretical background can be considered as a solid base upon
tion, few contributions investigated the relationship between context which build and organize the research and the exploratory approach is
and actions. coherent with the aim of identifying and describing key variables and
The awareness that each context provides his peculiar cyber work­ linkages between them (Huberman and Miles, 2002). Given the above
place (with his opportunities and criticalities) and the limited studies considerations, for this research, there was need of exploratory efforts
focused on this, justify our research that aims to provide insights on the and case studies have been designed for this purpose.
implementation of managerial actions, as a function of the context, for a To cover the multi-faceted reality of cyber security, data collection
cyber resilient system. strategy was defined so as to gather evidences from multiple sources for
The present work aims at widening the knowledge basis on the each case: direct and on-site observations, semi-structured interviews
management of cyber resilient systems, together with corresponding with key informants, collection of materials from secondary sources (i.e.
actions deriving from contextual needs, organized into a Managerial archival documents and reports). Multiple data sources allowed us to
Cyber Resilience Framework. triangulate evidences and ensure validity of the study (as detailed in
For this reason, our investigation attempted to answer the following Table 3). The overall process of data collection required about 3–4
research question: months.
The research protocol has been designed in order to ensure a high
• How do different contexts determine the management of cyber quality of research and methodological rigor. In order to reduce possible
resilient systems? biases, and to maximize validity and reliability, objective of the research
was to diversify data collection methods and sources (Eisenhardt, 1989;
In fact, there is a need for a wider analysis of cyber resilient systems Patton, 2002).
that takes in consideration context features. The study involved six exemplary and different cases, operating in
Furthermore, according to what emerged from the analysis of pre­ different industries and involving different types of organizations. In this
vious works in the field, there is a research gap concerning the inter­ way, it has been possible to study different realities inside the same
relationship between different contexts and managerial actions to be phenomenon. The chosen approach has been that of theoretical sam­
undertaken in those contexts in order to ensure resilience to cyber pling (Eisenhardt & Graebner, 2007), which brought us to the identifi­
threats. As a matter of facts, throughout the years many works focused cation of the first three cases (Case 1–3). Following, we adopted an
on the concepts of resilience and cyber resilience and the underlying approach of literal replication to select other three cases (Case 4–6),
processes (e.g. Haimes, 2009; Collier et al., 2014; Rogers et al., 2016), with the aim of predicting similar results while maintaining the same
while many other contributions dealt with the management of cyber- conditions/contextual factors (Yin, 1984). We selected six cases to
resilient systems (e.g. Rowe & Gallaher, 2006; Katsumata et al., 2010; maximize the degree of information that could be extracted, privileging
Linkov, Eisenberg, Bates, et al., 2013; Linkov, Eisenberg, Plourde et al., an all-encompassing view on the overall (cyber) risk management
2013; Kott and Linkov, 2019), but there are still missing evidences that process.
clearly link the adoption of specific managerial actions in relation to Given this aim, we selected six key informants for cybersecurity: two
specific contexts, to ensure cyber security and resilience. of them operate in international consultancy companies (labelled as
Case 1 and Case 4), two in public service organizations (Case 2 and Case
4. Research method 5) and two are embedded in the context of banking and finance (Case 3
and Case 6) (Table 2).
To answer the research questions, we adopted the case study meth­ For each of the involved firms, we carried on a semi-structured
odology with an exploratory purpose to take into account the complex interview with a high-level manager working in the field of IT and
interrelation of variables characterizing the phenomenon of cyber se­ dealing with cyber security issues. The first part of the interview pro­
curity and its interrelationships with resilience. The case study is the tocol has been focused on classifying firms and gathering more general
preferred method to investigate an empirical topic by following a set of data about the approach in building a cyber security system. The
pre-specified rules and procedures; it allows a holistic and contextual­ following part of the interview protocol has been structured in two
ized analysis, properly suited for exploratory research purposes, because major sections and six sub-sections to investigate:
it allows the identification of crucial variables while exploring a given
phenomenon. In particular, this research employed a multiple case study 1. Cyber resilience context
design, because it allows both an in-depth examination of each case and 1.2 Organizational structure for cyber security (Carayannis et al.,
the identification of contingent variables that distinguish each case from 2019; Ferdinand, 2015)
the other (Eisenhardt, 1989; Yin, 1984). Moreover, the essence of a case 2.2 Investments in cyber security
study is trying to illuminate a decision or a set of decisions: why they

5
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 3 internal projects and with teams that are not very large, formed by about
Validity and reliability of case studies. 20 people.
Characteristics Criteria People represent the weakest element in security systems chains, and
therefore there is a great need for investment in training and social
Construct • Data triangulation: use of primary data (retrieved through
validity interviews) and secondary data (from archival evidence) engineering activities, which, in the field of information security, is the
• Review of transcriptions by co-authors and key informants study of individual behaviors aimed at stealing useful information. In
• Explanation of data analysis procedures order to strengthen procedures and policies the company invested in
Internal validity • Research framework derived from literature writing rules and identifying protocols to be followed. Finally, the major
External validity • Cross-case analysis (multiple case studies)
• Rationale for cases selection: theoretical sampling
investment in technology is the purchase of cutting-edge tools.
Reliability • Adoption of an interview protocol This company is ISO 27001 certified. ISO 27001 is the international
• Development of a case study database standard in Europe for information security management.

5.1.1. Cyber resilience context

3.2 Risk management process for cyber security (Katsumata et al.,
Among the six phases in which a risk management process is
2010; Collier et al., 2014)
conventionally divided, the key informant acknowledged that the
4.2 Risk analysis approach (Sharkov, 2016)
company is missing a key step, namely the definition of the perimeter,
5.2 Definition of cyber resilience (Bodeau & Graubart, 2011; Boyes,
which should be performed among the first steps of risk definition and
2015; Burstein et al., 2012; Tran et al., 2016)
identification. Indeed, the size of the company involves many difficulties
2. Actions for cyber resilience
in the development of risk analysis. Being unable to consider everything,
1.2 Reactive/proactive approach against cyber attacks (Katsumata
the company gives priority in risk analysis to value-added processes and
et al., 2010)
to those processes with a strong impact on the budget.
2.2 By mean of which actions the company introduces and imple­
According to the key informant, one of the most frequent errors is
ments cyber security (Linkov, Eisenberg, Bates, et al., 2013;
looking at security as a cost without any monetary return. On the other
Linkov, Eisenberg, Plourde et al., 2013)
hand, Case 1 company invests yearly about one million euros for the
prevention of risks related to information security.
Case analysis was conducted following recommendations of Yin
An interesting observation, concerning the interpretation of resil­
(1984), Eisenhardt (1989), McCutcheon and Meredith (1993), and Miles
ience, emerged as the key informant stressed the importance for the
and Huberman (1994). We conducted a within-case analysis according
company of not incurring in damages rather than earning money. The
to coding techniques (Strauss & Corbin, 1990; Strauss, 1987). Cross-case
key informant states that resilience does not consist in knowing how to
analysis was conducted according to Eisenhardt (1989), Runkel (1990),
protect oneself but in being able to deal positively with what happens.
and Yin (1984), seeking matches, similarities, differences, and crossing
Regarding the choice between a reactive and proactive approach
variables, among cases, to maximize validity and generalizability of the
against cyber attacks, the key informant claims that it is increasingly
study. Criteria of internal validity, construct validity, external validity,
necessary to adopt a proactive approach.
and reliability were taken into account, according to Cook and Campbell
(1979), Yin (1984), Eisenhardt and Graebner (2007), and are schema­
5.1.2. Actions for cyber resilience
tized in Table 3.
Recently, a series of initiatives gathered under the name of threat
First, we performed a within-case analysis in order to understand the
intelligence (which are going to mix with artificial intelligence) are
relevance of contextual factors and their influence and capability of
taking place more and more in the cyber field. These activities are based
explaining cyber security’s practices and the effects in enhancing
on the concept of neural systems or systems that “learn”. There are
organizational resilience. After that, we used the factors to perform a
threat intelligence services and activities that help identifying new
cross-case analysis in order to allow comparisons between different
emerging threats day by day. These services are based on feed mecha­
implementation contexts. The analysis revealed some interesting dis­
nisms that send a data stream and anticipate threats, starting from an
cernments for enhancing resilience in organizations having similar or
intelligence analysis.
different criticalities in terms of contexts.
For some activities such as Vulnerability Assessment and Penetration
Test, it is important to consult the CVSS catalogue (Common Vulnera­
5. Results bility Scoring System) and to check if these vulnerabilities are exploit­
able, i.e. if a hacker can take advantage from them and be able to attack
The case studies enabled us to examine data at the micro level. and violate the system.
Through these six cases, we had the opportunity to collect and to analyse According to the key informant, when cyber security attacks occur, it
data from real situations providing insights coming from primary and is important that critical infrastructure operators learn from it and un­
secondary data, while the different industries and organizational envi­ dertake actions in order to avoid similar situations in future. A key
ronments allowed a cross-contexts analysis. aspect in this process, as every risk management process, is the need to
conduct an update and review of the information deriving from pre­
5.1. Case 1: the multinational consultancy company liminary phases.
Although intrusion detection systems and monitoring tools play a
The first organization analyzed is a service company, a world leader significant role in network security, the key security element, among all,
in the strategic, legal and financial consulting market: the key informant is represented by human resources. Employees play the most delicate
involved in the study is the cyber security manager for Italy. role because, having access to company data and privacy, they have a
In this company, only in Italy, more than 100 employees are focused great responsibility. For this reason, there are considerable investments
on cyber security. It is necessary, however, to make a distinction: on the in HR allocating compulsory, online and frontal training paths with a
one hand, there is a portion of the company that provides services to teacher. Some of these courses focus on specific topics, such as data
other organizations and includes a hundred people working with the key protection. These courses provide information to employees about on­
informant; on the other hand, there is a dedicated team focusing line security and social engineering, when users are connected to their
exclusively on company’s security. In the second case, it is not merely an workstations and access websites that could lead to potential cyber at­
IT function but a well-structured security function, composed of a Cyber tacks. Further, training programs are very often able to monitor users’
Information Security Office (CISO) that deals with the security of progress. To this extent, reviewing and updating training programs is a

6
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 4 administrations is the best solution for responding to cyber attacks.

Case 1 context and managerial actions.
Case 1 Cyber Context Managerial 5.2.1. Cyber resilience context
Actions Within a cyber risk management process, the six steps conventionally
• Strategic, legal and • More than 100 individuals • Artificial recognized in a risk management cycle are executed. It is an iterative
financial consultancy are focused on Intelligence; process that, at the end of the risk mapping and after designing an action
organization cybersecurity but just 20 • Audit Log; framework, dynamically restarts: the goal is that of creating a cycle that
• One of the biggest and are focused in that one of • Cost-benefit keeps threats under control. Each stage is assigned to a manager who
most important the “Case 1” organization analysis;
organization of this sector • The organization is certified • Social
conducts a constant monitoring while coordinating with the other sector
in the world ISO27001. Engineering; managers, possibly with the support of IT tools.
• The key informant is a • Threat Through the analysis, one of the most important information is the
Cyber Security Manager Intelligence; list of risk priorities together with the corresponding response plans.
• Trend Analysis;
This is because the attack surface is so wide that one cannot afford, not
• Penetration
Test; even as a nation, to establish countermeasures for any type of threat, as
• Vulnerability this would imply particularly high costs. Therefore, the first thing to do
Assessment; is to define the potential attacks for which it is valuable to take pre­
• Training; ventive measures and, therefore, to draw a perimeter within which only
the risks with greater priority assigned will fall.
key step in ensuring their effectiveness. The Case 2 organization has set up the main figures who must comply
The training outcome is then tested with the direct use of social with what their duties and role require. Certainly, the problem arises in
engineering activities: employees are exposed to real receipts of false e- the case of small and medium-sized enterprises, when these do not have
mails, attacks, and other simulations of attempts to extort sensitive data. enough staff to dedicate to this purpose. In these cases, it is therefore
These tests are also performed to reduce the risk that people did not pay necessary to proceed with an ad hoc investment program. Investing in
enough attention during training and formation. Of course, training cyber security, however, as well as undertaking risks, often turns out to
courses will not avoid human errors but, if done correctly, they can be very expensive.
increase awareness. The key informant suggests that the salient point of each organiza­
For what concerns future development directions, the manager tion’s policy should be to establish, even in agreement with the trade
acknowledged that two paths are opening for the future in cyber: arti­ unions, clear rules that do not appear as simple regulatory dictates or
ficial intelligence and insurance. prescriptions but rather are shared with employees. He claims that there
About artificial intelligence the manager believes that we are going is a need for creating a knowledge culture in which everyone must know
more and more towards a world in which man will give instructions and why each policy has a reason to exist: employees must be aware of
machines will learn. The new cyber trend will see hackers no longer reasons behind security concerns, e.g. if passwords must be of a certain
attempting to attack the system but badly instructing machines in doing type, if the usage of external USB drives is not authorized, or access is not
it. About insurance, the key informant sustains that it is difficult to allowed during the weekend or night hours to external systems from
mitigate all the risks, so he highly recommends the development and the outside. It is mostly about establishing a continuous dialogue and a full
adoption of cyber risk insurances. In Table 4, context and managerial sharing of objectives with the company. Also, creating repositories and
actions of “Case 1” organization are summarized. archives, to be reviewed and updated, with data on previous measures
and attacks contributes to this goal.
Resilience is a very structural and systemic concept, according to the
5.2. Case 2: the public military organization key informant. Even considering resilience as the ability to resume op­
erations following a damage suffered, it must be considered that resil­
The second interview was submitted to a cyber security manager ience can assume political, infrastructural, physical, logical and
operating in the military context. His field of expertise is related to the individual character. From the political point of view, resilience is the
protection of military networks and military information in Italy and ability of the Nation to put in place policies that then allow all systems to
abroad, where there are networks connected or military actions resume functioning in unanimity. From an infrastructural point of view,
undergoing. system redundancy, whether infra-structural or info-structural, must
The organization chart includes a command and staff area and an exist.
operational department, a training area and an experimental area. The We must not forget that internet was born in the ARPA (Advanced
mission of Case 2 organization is focused on cyber defense and cyber Research Projects Agency) as the ability to allow the various nodes to
network defense. communicate in cases of nuclear war, to get information from EBI (Eu­
Cyber defense is a static defense of the network, using monitoring ropean Bioinformatics Institute) ensuring the possibility of taking
systems that allow the company to observe the integrity and availability different paths. Therefore, while the physical resilience is given by the
of data and networks on which they work. On the other hand, cyber redundancy of the systems, alternative A, B or C plans constitute the
network defense also includes the ability to perform Vulnerability logical resilience since, given a failure or an inefficiency, we can still
Assessment (VA) and Penetration Test (PT), i.e. the continuous verifi­ connect the various nodes through them. In this case, a great contribu­
cation of network efficiency and the search for vulnerabilities. tion could be made from the world of modeling and simulation, with
The key informant is a manager who has been working in the cyber those algorithms and data mining that allow us to automatically extract
defense sector for more than four years. He takes care of the organiza­ useful information from huge amounts of data and make them under­
tion, the management of human resources, the info-structure and stand the correlations.
infrastructure sector and takes care of all the educational and training Finally, resilience must be considered from an individual point of
activities of the personnel, which consists of a few hundred people. view. Resilience takes the cultural character of people and how the
The cyber environment has exploded over the past decades. In the nation faces the issue of system security, so a large component is pre­
last five years, there has been a strong acceleration in the need to adhere cisely the training of personnel, who must understand their central role
the indications provided by the NIST and GDPR directives, regarding the in the process of building resilience. People must first be educated to
protection of privacy. According to the key informant, creating a link protect themselves more, and this practically means being less superfi­
between the academic world, the industrial world and other cial in generating passwords and not disclosing, for example, their email

7
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

to anyone. Resilience obviously also depends on the amount of in­ Table 5

vestments that are made. Therefore, since cyber security is a “problem” Case 2 context and managerial actions.
of the Nation and many contributing actors are involved, procurement Case 2 Cyber Context Managerial
initiatives are necessary, thus acquiring technologies and material ca­ Actions
pacities, which are above all characterized by interoperability, allowing • It is one of the military • Less than 100 employees • Audit Log;
the various ministries to communicate. Surely, all the aspects of antic­ organizations of a are focused in • Backup;
ipation, recovery, resistance, evolution, are necessary to build a resilient European country: it cybersecurity • Data mining;
environment for cyber attacks, but there is a need to start building provides cyber security • Investment in Cyber • Penetration
solutions also for other Security have been Test;
tailored systems not relying on “commercial” solutions. public organizations introduced more than 10 • Recruitment
In order to be resilient, organizations cannot privilege exclusively a • The main objective is to years ago but in the last 5 and retention;
reactive approach or proactive approach, but it is above all the union of increase cyber defence and years increased to • SIEM tool;
the two, a third approach that is the predictive prognostic approach, to cyber network defence. adequate to NIST e GDPR • Training.
• The key informant is a standards.
ensure that there are capabilities for resilience. The key informant ex­
Brigade General
plains that he calls it “prognostic approach” because through data cor­
relations it is possible to forecast the arrival of a catastrophic event.
Speaking of a reactive approach, the key informant refers to an attitude indeed a real problem, a false positive or even a failed attempt, the CERT
of the Nation that is ready to react in a very short time thanks to comes into play.
communication, to info sharing and to industrial capabilities. Within this group there is a primary structure, the Security Opera­
tions Centre (SOC), from which monitoring and supervision activities
5.2.2. Actions for cyber resilience are carried out, and a secondary structure that represents the real heart
According to the manager, the Case 2 company focuses on the arti­ of CERT, corresponding to the second level of incident response, who is
ficial intelligence sector, but there should be a greater focus in called to intervene in cases of extreme necessity. Therefore, the CERT is
embracing solutions that allow systems to react automatically. With specifically the body that oversees confirming the occurrence of a real
regards to monitoring technologies, the most advanced ones now rely on accident, and in this case indicates the countermeasures to be taken, or
SIEM (Security Information and Event Management) systems of all instead to ascertain whether it is an oversight of the system or a false
types, which can make correlations between data form different sources positive. Incident management includes many aspects because, based on
and of different nature, ranging from IBM to the Firewall. The support of the type of issue that emerged, certain initiatives are taken rather than
the human being is fundamental, that is, there must be a class of oper­ others. Companies must periodically conduct reviews on the effects
ators that have an all-encompassing knowledge and awareness of sys­ produced by countermeasures put in place, so as to update all previous
tems employed. steps, e.g. the identification of risks, to provide a more effective guid­
As already reported, the key informant thinks the key factor in cyber ance in case of future attacks.
security is the “human” factor. For this reason, the activities on which Since the introduction of the GDPR (General Data Protection Regu­
Case 2 company invests the most are training, recruitment and retention lation), the document already illustrated in the previous case study,
mechanisms to avoid the loss of key employees who bring value to the there are certain areas and contexts in which there are constraints that
organization. The key informant suggests that the education of the require special attention. These are mandatory constraints and, if the
human system should start from schools. threat is real and falls within a specific case, it is necessary to contact
The manager affirms that there will be a constant raise in IT and designated experts and evaluate with them whether to proceed with a
cyber security investments in the next five or ten years. Indeed, in the publication for customers, in case the threat impacts on them. The cyber
next five years, he foresees that major investments will be dedicated to environment is very large, and this means that the company uses a lot of
the retrofit of all ICT information systems; for the next ten years, he also resources in cyber security. It includes anti-fraud activities, threat in­
expects a lot to be invested in artificial intelligence. Furthermore, the telligence, prevention and protection teams, which operate to prevent
manager stressed the risks and issues deriving from the lack of education and protect against threats in a preventive way. This constitutes a great
of the national leadership: nowadays the world of information tech­ gain for the company because preventing threats rather than having to
nology is entrusted only to a small group of specialized technicians, who manage them once they happen brings an advantage in terms of re­
are unable to effectively communicate the real criticalities of the cyber covery costs. In this company, about 150 people are employed in the
context. Therefore, it is important to invest in training and foremost into cyber security context in different sites in Italy.
educational activities oriented at building cyber security culture and Investment is very high: about tens of millions euros per year.
global awareness. In table 5, context and managerial actions of “Case 2” Obviously, it depends on the type of organization, and it will therefore
organization are briefly reported. be proportional to the company’s business and to the volume of users/
customers: the greater the volume of the company, the greater is the
5.3. Case 3: multinational banking services company investment made to protect the core business and users.

The third interview was submitted to a computer security consultant 5.3.1. Cyber resilience context
of one of the largest banking services companies in Italy (and in the The cyber security issue can be analyzed from different points of
world), labelled as Case 3. The key informant is a senior analyst who has view: first of all, from the operational point of view of the analyst, but
been dealing with computer security for about seven years and, for this also from that of processes and of governance-related context. Based on
reason, he had the opportunity to learn about many aspects of this area, the company’s specific cyber security approach, several risk manage­
including, for instance, online application security and infrastructure ment steps are performed. This way of acting is part of the risk man­
security. He deals with defining what the mitigation actions downstream agement prevention phase. There is a specific field related to cyber,
of a risk should be and what the costs are related to these actions. namely business continuity, that allows the company to guarantee
CERT is the acronym of “Computer Emergency Response Team”: it is business continuity and, in a companies like the one under analysis, this
a team designated to respond to security issues in case of need. Usually, plays a fundamental role. In this regard, the company favors a proactive
several levels of response are established: a team is in charge of the approach, despite it demands higher costs compared to the reactive one.
supervision, then real-time monitoring of all the corporate in­ According to the key informant, estimating costs related to a possible
frastructures, twenty-four hours a day and seven days a week and, when contingency is certainly the most effective way to react. For this reason,
certain alarms occur, if the employees are not able to understand if it is there are figures dedicated to prevention and protection that work on

8
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

this aspect of proactivity: starting from one or more problems that false attack vectors, simulations of the possible occurrence of certain
happened in the past, outcomes are analyzed to understand strengths conditions reported as anomalous. An example of simulation is the
and weaknesses and to study ways of improvement. After this analysis, phishing campaign, that is a targeted attack to a certain group of em­
the team looks for the right system that can bring improvements in both ployees that aims at obtaining data and information from them, and this
qualitative and quantitative monitoring. means not just sensitive data but also personal ones (name, surname,
For the key respondent of Case 3 company resilience cannot be date of birth), from which it is possible to obtain the identity, or
generalized, it must always be contextualized. In a cyber environment, particular private data of interest for the attacker. In this way, a phishing
adapting to change is very difficult because it goes much faster than one simulation allows to test the overall preparedness of employees to in­
can keep up. The key informant says that organizations need to know formation stealing attempts. Therefore, in practice, the phishing
how to adapt to change moving from risks faced in a specific moment campaign consists in monitoring how many people fall into the trap to
and defines resilience as the ability to stand up once fallen. In risk see if the awareness campaign had an impact or not, because companies
management, context resilience is the intrinsic ability to change its aim to develop the ability to recognize the possible attack vectors and
functioning before, during and following a change or a disturbance, he have a complete picture of the company’s perimeter of exposure.
says. This definition is well suited to the context under study as the cyber The company in question, for the most part, carries out these activ­
space is a field characterized by highly dynamic systems. ities internally but there are technologies that are still entrusted to third
The intent is to approach resilience in a dynamic way, but it is not parties. There are very critical assets that must be managed internally,
always possible in the environment in which one finds oneself because while there are less sensitive assets that can be outsourced. Theoreti­
sometimes there are constraints linked to certain business realities that cally, if the company has a working SIEM it can entrust the management
could constitute obstacles for an incident response process, which of assets to third parties, monitor their progress remotely and make
should instead manage the occurrence of these issues. These difficulties specific risk analyzes to understand the situation before contacting the
often derive from another factor that must be considered, namely the manager.
fact that, within large companies, modifying processes is very difficult. Many appliances and software have already begun to exploit artifi­
What can be done, instead, is to intervene in operations by making cial intelligence, a part of computer science that allows machines to self-
changes that can be made even without modifying the process. This learn. This part of artificial intelligence is called “machine learning” and
difference becomes important when it is not enough to change the is already implemented by the company that uses this type of system.
approach to a problem, but it is necessary to change the way of This is a very powerful technology but also very risky because, in
approaching that problem. managing a self-learning system, the most relevant problem is being able
to configure its learning in a proper way.
5.3.2. Actions for cyber resilience Machine learning is certainly one of the most important future di­
Within the IT world and, in general, companies that have many as­ rections of this field: this is especially true considering that new tech­
sets to monitor, protect and defend (meaning both physical and digital nological solutions, driven by automated systems, are being developed
assets, both end points and servers, network devices such as routers and at an increasing rate. However, the key informant remains of the opinion
switches), there are systems that collect logs, or systems that maintain that know-how and dynamism of people are irreplaceable by artificial
the computerized traces that devices produce, thus allowing to store the intelligence that can instead be introduced as a support, concluding that
information collected by the systems in the field, centralize them and the figure of computer analyst has not to be eliminated. Currently, ac­
aggregate them according to data models. These systems are called SIEM cording to the key informant’s experience, the biggest mistake that can
and today are a key requirement for managing events of all kinds. They be made is cutting safety costs. Luckily, this now happens less and less
collect all the events that originate from the various devices and, starting frequently because organizations begun to understand the importance of
from the evidences identified, they create an alarm system that is safety, which is the pillar for the survival of any company and therefore
designed, developed, tested and then fielded. With this alarm system, one of the most important aspects on which to invest economic re­
trends are defined and analyzed so that the alarm is triggered whenever sources. A strong limitation is that security is often considered only as a
something is out of the baseline trend. The company Case 3 has an alarm cost and the real benefits are not realized. Another problem lies in the
that monitors whether an antivirus identifies specific files on the ma­ lack of sensitivity to contents that should be managed and protected,
chines, and, in this case, an incident response process starts. The key both on the part of those who perform security-related activities and on
informant sustains that the weak link in modern computing and Cyber is the part of those who benefit from them. It often happens that people
the “human” element because it is the one who makes mistakes and within companies are hostile to security consultations because users
introduces risks. In order to mitigate this aspect and train people, may feel limited. Nevertheless, this is necessary to reduce their proba­
awareness campaigns are promoted. Often, these campaigns are not very bility of making mistakes and to put them in situations of greater pro­
effective because of the availability of people, who should be ready to tection from possible attacks, preserving the reliability and integrity of
accept it. An effective way to enhance awareness consists in creating the company’s systems. Cyber is increasingly becoming a source of
attack and defense, but people do not yet have an awareness of the
Table 6
importance of data. Table 6 briefly describes context and managerial
Case 3 context and managerial actions. actions of the “Case 3” organization.

Case 3 Cyber Context Managerial

Actions 5.4. Case 4: consultancy company

• The organization is focused on • The cybersecurity team • Anti-fraud

the cybersecurity of one of the is composed by 150 Intelligence;
The key informant of “Case 4” company is a self-employed consultant
biggest Italian banks individuals • Audit log; for cybersecurity who belongs to an Italian company operating in the
• The organization invests a lot • Clone system; Audit & Consulting sector, inserted in an international network of
in cybersecurity, about 10 • Phishing similar organizations. The organization has about 950 employees
million euro per year simulations;
operating in 17 workplaces in Italy while the international network in­
• The key informant is a • Threat
computer security consultant intelligence; cludes a much higher number of people, more than 10.000.
• Trend The company decided to delegate IT security responsibilities to a
analysis; team composed by three people who (and eventually to consultants).
• SIEM tool; Investments in cybersecurity is below the average of the investments
• Training;
made by similar companies: the percentage of turnover is lower than

9
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

2%. The cyber resilience process can be improved: a greater commit­ corporate resilience from cyber-attacks by reducing response time and
ment from management would greatly increase the organization’s se­ promoting internal collaboration. The importance of this documentation
curity levels. for the company is confirmed by the frequency with which the protocol
The company is currently ISO 27001 certified for information sys­ is reviewed by the team, in fact 2/3 times a year a document evaluation
tems. The decision to certify the company was promoted by the IT se­ process is carried out aimed at implementing certain changes necessary
curity manager in order to regulate internal processes; it was necessary to respond to new critical issues and improve the overall process.
to consult a team of external consultants who provided all the infor­ Controls are not done internally but are delegated to external com­
mation necessary to prepare the documentation needed for the panies that test the system through operation tests, in this way a service
certification. quality standard is ensured but the organization is exposed to several
risks due to the information sharing with external users. The system
5.4.1. Cyber resilience context modification process is handled internally in the most procedural way
As mentioned in the previous paragraph, the company has not possible.
invested significantly in IT security in the past. International standards Not only the technical part of the system is updated, but also the
are important referments for the process development and request is to human part: every 6 months a cyber war news training is carried out
certify at least the company information systems in which confidential aimed at testing users, then data are collected to be able to train those
documents are kept. The organization has started to protect itself against who need it. The sanctioning policy favors the compactness of the staff
cyber threats such as identity theft. and aims to reduce system vulnerabilities by constantly updating the
The process is delegate to a small team with limited resources but most attackable users. System vulnerabilities are also reduced thanks to
with decades of experience in the world of information security. the use of tools such as multifactor authentication to access information
Through the knowledge acquired with expert consultants and subse­ in the system and email, also no user is an administrator of the machine;
quently with the practices dictated by the ISO27001 standards, the the centralization of the system favors and facilitates the management of
process is much more formalized even if it would be appropriate to the various machines inside, allowing the team to intervene more
monitor and manage the IT risks present throughout the network and quickly if necessary.
not only in the most critical areas to increase the levels of protection. The search for vulnerabilities is carried out on a continuous and daily
The ISO27001 certification drastically improved the development of basis through systems that use a sort of artificial intelligence. The pro­
the company IT security level and greater economic investments in this cess is based on the use of a cloud and the services offered in collabo­
direction would be needed. ration with a programming language (SWIFT). This allows the team to
Numerous procedures and policies have been formalized within the constantly monitor the health of the system and collect information from
organization since 2018; all this guarantees a good level of protection numerous machines connected to the network. The cloud therefore has a
and an increasing awareness of the importance of process and actions of double function, it is in fact used as a cybersecurity engine, as through
everyone. the cloud the user behavior is monitored giving the possibility to quickly
find anomalies, and it is used to allocate information of the organization,
5.4.2. Actions for cyber resilience being an important tool for the organization for which high safety levels
The management strongly conditions the way the company’s policies should be maintained. For these reasons, management has recognized it
and procedures are implemented and has the responsibility to endorse as a critical infrastructure to which it pays attention to prevent cyber
the proposals made by the security managers. It evaluates the proposals attacks especially related to the theft of or damage to information.
and their feasibility often based on the impact that the update would Part of the information entered in the cloud are the backups made,
have on the way the organization works. The evaluations should analyze the latter are placed on a server owned by the organization located in
the benefits and the risks mitigation. The level of corporate security is Netherlands. In this way, the organization doesn’t let the cloud be
respecting a minimum-security standard that has been accepted by the administered by third parties and protects itself from any accidental
Italian CEO. The proposals made by the IT security manager must damage to the physical structures of the organization.
therefore consider the impact on the users’ activity since the context in Encryption is a very important tool for corporate data security and it
which the company operates requires a strong flexibility of systems is used on all the computers. By encrypting data entered in the machines
used, being continuously in relationship with the external customer. and in the corporate network, the organization achieves to counter the
Levels of too high protection may not be compatible with the external data trash and prevents access to data in the event of theft. There are two
customers’ systems and therefore could compromise business consul­ levels of encryption: one used widely on the operating systems of
tants’ work. This compromise slows down and complicates the pro­ corporate notebooks which, through zip locker, encrypts about 90% of
ductivity of internal collaborators. The proposed procedures and the corporate network and another type for virtual structures.
policies, although they must take into account multiple factors, are well The company makes an accurate monitoring of the accesses in the
formalized. This allows the team to create proposals and solving system network necessary in order to detect anomalous behaviors and intervene
problems by reflecting business needs and subsequently having them promptly in case of threat. Through a log control system, the team can
assessed by the management. monitor all the accesses to the system and monitor all the operations that
In the event of a certain incorrect behavior by a user of the company are carried out by employees, including those related to accessing files
internal network, the IT function starts a report to the human resources on the intranet.
office, as previously mentioned these calls are not connected to real The team considers it very effective increase the level of IT.
sanctions but are calls that refer to the procedure not respected and The process therefore mainly aims to directly involve the personnel
therefore are aimed at improving the individual’s behavior. It would be and not only to protect the structures with sophisticated protection
appropriate to deal analytically with the calls necessary to better systems; through these measures we want to make the employees un­
analyze the potential vulnerabilities of the corporate network. derstand what are the real threats to the company and what are the
The dimension of the company highlighted the need for internal correct actions to carry out and in case of human error the management
communication procedures. In fact, by promoting standardization of the and the team use the various lessons learned to avoid similar wrong
process, the team is able to respond promptly to emergency situations, behaviors in the future.
manage the event appropriately and reduce the impact caused. The It very important from a legal point of view to draw up an accident
protocol was drawn up internally on the basis of an assessment of the report since both ISO27001 and the General Data Protection Regulation
organization’s specific critical issues; the choice to adapt the standard require it. A formalized and consistent data breach procedure is used so
and add new procedures can be defined as a correct choice that increases that if a data breach is opened all the events must be recorded and

10
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 7 is not directly involved but they are managed by delegating a partner
Case 4 context and managerial actions. who will be responsible for managing a budget assigned to him. For the
Case 4 Cyber Context Managerial Actions most relevant decisions, management can be involved at various levels
based on the extent of the problem: if a critical choice for the company is
• The organization is a • The organization started • Artificial
consultancy company investing in Intelligence; to be evaluated, it is discussed in the board of directors.
with 950 employees and cybersecurity just two • Audit log; The board of directors evaluates the reports produced on cyberse­
part of a big international years ago. • Backup; curity at least once a year and makes an examination of data protection
network. • The organization is • Cryptography; and information security system through a report. In this report any
• The key informant is a certified ISO27001. • Penetration Test;
cybersecurity partner • The IT security team is • Phishing
critical issues encountered are analyzed and related requests for inter­
composed by 3 simulation; vention are reported. All this is consistent with what is recommended by
individuals • Multifactor ISO standards; the evaluation of the security levels and internal IT
Authentication; resilience are fundamental to give value to the whole process and it
• Training (Cyber
renewed annually.
war news training);

5.5.2. Actions for cyber resilience

documented, a notification process begins both at the same time towards Being the organization “Case 5” small, cybersecurity roles are not
the compliance of the data breach and therefore involving internal and always formalized. The team is made up of only three resources: the
external interested parties involved in the event, finally all the relevant heterogeneity of the components allows numerous managerial practices
involved stakeholders are informed, as required by the GDPR rules. adoption aimed at increasing the resilience from cyber-attacks of the
Table 7 presents the context and the managerial actions suggested by organization. The entire IT security process is managed by the team that
Case 4. is responsible for the technical-legal analysis in relation to IT security,
including the reference partner in cases the situation requires IT.
5.5. Case 5: consultancy for public administration Cybersecurity policies are made by analyzing the case, it is validated by
the technical managers of the resource in question and finally applied.
The fifth case study analyzes an Italian small consultancy firm and Internal communication is not regulated. The team works closely
the key informant is a self-employed consultant for cybersecurity. The every day, collaboration is improved and facilitated by the context,
core business is represented by data protection consultancy, both for however the presence of formal procedures would speed up the team’s
individuals and public administrations, therefore the company can be response times and increase the team’s productivity.
defined as business-to-costumer and business-to-government. Non- The procedures and policies adopted by the company refer to
standard but customized software are developed based on the specific authoritative standards and some simplified standards. For each pro­
needs of the customer starting from an initial phase of design to develop cedure, the company assesses which is the standard that best suits the
the web-oriented information system. About 30–40 consultants collab­ specific needs and then formalizes the various documents that regulate
orate within the company, which is a medium-small enterprise with a the processes. Very different standards are considered: not only ISO and
team of three people in charge of corporate IT security. The team has NIST standards for information security and operating methods, but also
been working on information security for about five years and it is less authoritative standards such as those drawn up by non-profit or­
composed by professional figures inserted in the same context for many ganizations are used. One of the most used documents is the one that
more years, therefore it has a significant experience. The type of busi­ considers the 10 main vulnerabilities that exist in internet exposed
ness strongly influences business needs in terms of IT security, the small systems. The standard adoption must be consistent with the economic
company size means that the organization does not need to connect strategies. The use ISO or NIST. Standards for the creation of guidelines
many users to the network, therefore management is simplified and for staff allows the organization to keep management costs within the
allows the organization to allocate a coherent figure to cybersecurity limits and dedicate the resources available to manage the main vul­
with corporate needs but tending towards a prudent management of the nerabilities of the system in an adequate.
share capital. It is important to highlight that through the continuous team
Therefore, operating in a cybersecurity context, the company is updating on the various security bulletins, the procedures and policies
aware that it owns many technical data protection skills. The company is change when necessary. An example is a recent update of NIST, in fact its
not certified and its reputation is mainly based on its own work, this standard for credential management has been modified, with an update
implies that a cyber-attack would have a greater impact on the company that modifies the situation: while robustness and complexity remain a
by damaging the reputation; however, the choice to not certify with key element for protection, password rotation is no longer so important.
certain international standards is consistent with the context in which The high frequency with which these complex passwords are pinned in
the company works, the small dimensions are related to a turnover that physical and non-physical places, effectively increase system’s vulner­
is also limited and simplify the risk management process. abilities. After these updates, an evaluation phase of the possible change
begins and after carrying out a cost-benefit analysis.
5.5.1. Cyber resilience context Updating is one of the key factors for the protection and resilience of
The company structure proves to be fairly simplified about the the organization from cyber-attacks, it is not only aimed at the imple­
number of collaborators involved, nevertheless the various figures mentation of new procedures but is linked to staff training. The team
responsible for the IT security process are well defined with the defini­ trains all new resources, company procedures and policies are given to
tion of the related skills; the management therefore decided to entrust all new structured ones, while for sporadic collaborations the process
safety to a team composed by different professional figures able to provides just the information needed to complete the specific project. On
encompass all the skills necessary for adequate risk management. the other hand, there are no update courses on a regular basis for the
Management has a very important role for the cybersecurity as it is staff, but they are only held on special occasions (for an emergent crit­
expensive, and an incorrect economic choice could cause disastrous ef­ icality or an update that involves considerable technological change. It is
fects for the organization. Since the company provides consultancy for important for the company to adapt the personnel to the procedures and
cybersecurity services, the management composed of salespeople who to immediately understand the company’s “modus operandi” in order to
sell these products are facilitated in understanding the advantages standardize the various operations as much as possible and reduce the
related to the investment in cybersecurity, reducing costs related to data system’s vulnerabilities as well as facilitate internal collaboration pro­
loss and reputation. Despite this, for ordinary decisions the management cesses. The courses’ frequency should be regularized: the lack of these

11
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 8 necessary, in these cases the phases of revision, control, evaluation and
Case 5 context and managerial actions. subsequent changes’ implementation could prove to be very long,
Case 5 Cyber Context Managerial complex and expensive for the organization.
Actions

• The organization operates • The organization started • Audit Log; 5.6.2. Actions for cyber resilience
in the field of managerial investing in cybersecurity • Backup; The risk management process is regulated by the company policy and
consultancy five years ago. • Cost-Benefit procedures used over time. Being very concentrated on IT security, all
• It is composed by 40 • It is not certified Analysis; the phases are regulated by procedures that refer to international stan­
employees • The IT security team is • Risk
• The key informant is a self- composed by 5 individuals Analysis;
dards and risks and system vulnerabilities are identified and monitored.
employed consultant for • Training. The company is very organized for what concerns the identification
cybersecurity of the necessary roles and skills: it entrusted a high-level security
governance that dealt with the management of the cybersecurity audit.
In some specific cases, the company call external consultants to solve
events can hide a number of system vulnerabilities. However, manage­
specific problems that cannot be resolved through the vulnerability as­
rial choices could be influenced by company size, the medium-small size
sessments made internally.
of the company network system implies a reduced number of updates
An increase in safety levels has been requested by the new man­
and affects the management choices. Table 8 presents the context
agement. More resources have been given regarding company policy
described and the managerial practices implemented by Case 5.
and regulations within the organization: new procedures were imple­
mented concerning the systematic search for vulnerabilities and the
5.6. Case 6: banking industry business continuity plan was modified to analyze the incident response
processes and the incident management.
The sixth case study shows the cyber resilience context and mana­ The reference banking group regulations represents the way the
gerial actions undertaken by one of the main Italian banking in­ company operates. Since the process is well regulated, all the process
stitutions. The management of the IT services has been entrusted to a stages have been integrated into the business plans and foresee pro­
subsidiary organization in which our key informant works. It deals with cedures. Attention has been paid to the constant updating of all this to
the management of a much larger context both in terms of turnover and keep them up to date and efficient by defining various professional
in terms of company size. figures responsible for the revision process, communication and imple­
The company has always been focused on issues related to possible IT mentation of the changes. The differentiation of roles and figures is
attacks and, being a rib of the banking group, it has always dealt with the considered a strength to improve the quality of the process by inserting
institution’s IT security. It is composed by 500 employees, including 5 various technical skills within it both as regards the IT system itself and
with duties related to corporate IT security. for the means by which to communicate the changes that have occurred
For legal reasons and to improve internal coordination, the company on the vulnerabilities detected and for being able to effectively imple­
uses standards such as ISO27001 and ISO 9001. ment the managerial provisions. The importance of cyclically carrying
out a process review allows the organization to be able to rely on valid
5.6.1. Cyber resilience context and updated tools such as the various plans mentioned above, all of this
The highly organized company structure ensured the right level of represents a competitive advantage for the company and are a funda­
internal coordination and of operations’ standardization; about 5% of mental tool for good organizational resilience.
the company’s turnover is invested in cybersecurity. In this context, the information held by the company represents a
Raising awareness on the cybersecurity issue is explicitly wanted by great asset for it and a theft would represent enormous damage to the
management to raise the overall level of company security by reviewing system and organization more generally. For this reason, there is a safety
the occurring events and subsequently improving procedures. compliance office in charge of drawing up procedures for using the
The policy deriving from that of the entire banking group has systems, responsible for monitoring them. The involvement of managers
inherited a high level of accuracy, detail, rigorousness and complete­ of individual business units and office managers is also expected to
ness. This allowed the organization to have an adequate level of un­ implement the various procedures and to check in detail the use of
derstanding of the importance of the whole process, formed by the confidential and valuable data for the company.
highly regulated cooperation of motivated users. One of the strengths of To further increase and improve control, log systems are used to
the organization lies in the constant updating of the entire process, both monitor access to the system. Through specific properties attribution
in terms of hardware and human resources; collaboration and innova­ and access rights for each employee, the organization has managed to
tion make the process very efficient and the context increases company better protect critical information, profiling the various users of the
security levels and the productivity of the specific function. network and allowing access to certain files and/or systems only to those
Coordination with other corporate functions is an organizational who have one proven need. Users “external” to the organization as
strength since each new service designed must be assessed and deemed suppliers, guests or visitors could access the system if necessary, through
consistent with the company policy. Each new project developed in­ ’ad hoc’ credentials that allowed limited access to specific areas of the
volves the cybersecurity team to allow the organization to evolve, system to avoid intrusions. Access monitoring provides a real-time
innovate but at the same time be consistent with its strategies and control which allows the team in charge to constantly check the sys­
protected in the field of IT security. The importance of the process can be tem and in the event of unwanted or unauthorized access to track
seen from the involvement: the attention to regulation has strongly anomalous logs through specific procedures. All this allows the organi­
empowered the staff responsible for IT security and their collaborators, zation to respond quickly to an external intrusion and resolve any crit­
who are also responsible for the security of the entire system, increasing ical issues promptly, significantly reducing the impact of the attack.
the collaboration capacity within the organization and overall security The control system is connected to a corporate policy which provides
levels. for sanctions in case of unsuitable behavior. The policy provides for a
The context can be defined highly formalized, the present regulation series of gradual penalties, starting from reminders made by those
allows a rapid execution of the various phases of the risk management directly responsible up to reports to the personnel office. There are a
process even if the company is made up of 500 employees. Strong series of responses proportional to the seriousness of the action
regulation can however be problematic when the process undergoes committed by the collaborator. These practices are not commonly used,
important changes and the revision of the entire system becomes especially in small or medium-sized enterprises; the corporate

12
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 9 from the organization. For these reasons, there are rules for the use and
Case 6 context and managerial actions. change of passwords, blocking of desktops and non-dissemination of
Case 6 Cyber Context Managerial Actions information that is not authorized outside the organization. Table 9
presents the context and the managerial actions suggested by Case 6.
• The organization is part • The organization core • Audit Log;
of one of the biggest Bank activity is data protection • Backup;
in Italy • It is composed by 500 • Intrusion
• The key informant is a employees, including 5 Detection
5.7. Multiple cases analysis
business continuity & with duties related to Systems;
disaster recovery corporate IT security. • Operation The multiple case analysis revealed interesting insight regarding the
manager • The company uses Security; existence of common managerial actions introduced and implemented
ISO27001 and ISO 9001 • SIEM tool;
to enhance cyber resilience and differences due to different contexts.
standards • Risk Analysis;
• Training; The figure below (Fig. 1) reported the set of managerial actions and
• Vulnerability the future directions; the shared practices are reported in the in­
Assessment. tersections and the specific organization that mentioned them are
specified in parenthesis. In the figure, in correspondence of each set and
of any possible intersection, we specified also the peculiarities of the
dimension and the rigorous way of acting however make it inevitable
context. The managerial actions and future directions mentioned are
and functional for the organization to use this tool to keep track of errors
reported for each intersection.
and protect itself from any opportunistic behaviors. This partially re­
In table 10 there is a summary of the six cases context and managerial
presses the spirit of collaboration necessary for the organization to
actions.
implement in time quick business procedures.
The definitions of the managerial actions suggested by the key in­
In addition to this, at the end of each relationship, whether working
formants of the six cases are listed in Table 11.
or not with a user connected to the network, a standard procedure was
Case 1 and Case 4 (customer oriented private organizations) belong
implemented to revoke the system access credentials from the user to
to the multi-sectoral managerial consultancy industry and are charac­
effectively expel him from the system and protect the latter from
terized by few critical structures/activities, Case 2 and 5 (public,
external access.
customer oriented public organizations) belong to the public adminis­
Attention to credentials is emphasized by the presence of a specific
tration context with critical structures/activities and Case 3 and Case 6
policy, the organization has in fact made available to the various col­
(respectively consumer and customer oriented) belongs to the banking
laborators rules of conduct on the use of the tools available. All of this is
industry and are characterized by critical structures/activities.
aimed at reducing the system’s vulnerabilities, in fact, the access points
What directly emerges from the presented cases is the great impor­
are considered critical elements and therefore require special attention
tance of “training” and the recognition of “artificial intelligence” as the

Fig. 1. Cross Case analysis.

13
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 10
Context and managerial actions of the six cases.
Case Cyber Context Managerial Actions

Case 1 • More than 100 individuals are focused on cybersecurity but just 20 are • Artificial
focused in that one of the “Case 1” organization Intelligence;
• Strategic, legal and financial consultancy organization • The organization is certified ISO27001. • Audit Log;
• One of the biggest and most important organization of this sector in • Cost-benefit analysis;
the world • Social Engineering;
• The key informant is a Cyber Security Manager • Threat Intelligence;
• Trend Analysis;
• Penetration Test;
• Vulnerability
Assessment;
• Training;
Case 2 • Less than 100 employees are focused in cybersecurity • Audit Log;
• Investment in Cyber Security have been introduced more than 10 years ago • Backup;
• It is one of the military organizations of a European country: it but in the last 5 years increased to adequate to NIST e GDPR standards. • Data mining;
provides cyber security solutions also for other public organizations • Penetration Test;
• The main objective is to increase cyber defense and cyber network • Recruitment and
defense. retention;
• The key informant is a Brigade General • SIEM tool;
• Training.
Case 3 • The cybersecurity team is composed by 150 individuals • Anti-fraud
Intelligence;
• The organization is focused on the cybersecurity of one of the biggest • Audit log;
Italian banks • Clone system;
• The organization invests a lot in cybersecurity, about 10 million euro • Phishing simulations;
per year • Threat intelligence;
• The key informant is a computer security consultant • Trend analysis;
• SIEM tool;
• Training;
Case 4 • The organization started investing in cybersecurity just two years ago. • Artificial
• The organization is certified ISO27001. Intelligence;
• The organization is a consultancy company with 950 employees and • The IT security team is composed by 3 individuals • Audit log;
part of a big international network. • Backup;
• The key informant is a cybersecurity partner • Cryptography;
• Penetration Test;
• Phishing simulation;
• Multifactor
Authentication;
• Training
Case 5 • The organization started investing in cybersecurity five years ago. • Audit Log;
• It is not certified • Backup;
• The organization operates in the field of managerial consultancy • The IT security team is composed by 5 individuals • Cost-Benefit
• It is composed by 40 employees Analysis;
• The key informant is a self-employed consultant for cybersecurity • Risk Analysis;
• Training.
Case 6 • The organization core activity is data protection • Audit Log
• It is composed by 500 employees, including 5 with duties related to • Backup
• The organization is part of one of the biggest Bank in Italy corporate IT security. • Intrusion Detection
• The key informant is a business continuity & disaster recovery • The company uses ISO27001 and ISO 9001 standards Systems;
manager • Operation Security;
• SIEM tool;
• Risk Analysis;
• Training;
• Vulnerability
Assessment.

future of cyber security. intelligence, trend analysis, disaster recovery plan and phishing simu­
Common practices of the customer-oriented organizations are lations while in the private cases (in particular Case 2) “data mining”
“Penetration Testing” and “Vulnerability Assessment”, showing a com­ and “recruitment and retention” are the mentioned instruments.
mon understandable interest in testing (rather than in prevention and Three of the four cases presenting a more critical structures use a
protection as in the consumer-oriented case) since they deal with SIEM tool while in the consultancy case the attention is on “artificial
external organizations: they need to know the environment before to intelligence” followed by “disaster recovery plan”, “cryptography”,
provide effective cyber resilient solutions. “anti-fraud intelligence”, “multifactor authentication” and “social engineering”.
“clone system” are reported by the only consumer-oriented and critical All the practices and managerial actions are related to four general
organizations (Case 3 which is a bank) revealing a major interest in the phases proposed by Linkov, Eisenberg, Bates, et al. (2013):
prevention and protection phase rather than in testing; this is plausible
even from a logical point of view since they don’t necessarily need to • plan/prepare: organize to keep services available and assets func­
“test” the organizational context to get to know it and provide solutions. tioning during a disruptive event (malfunction or attack);
“Intrusion detection systems”, “operation security profiling” are re­ • absorb: maintain most critical asset function and service availability
ported by the only customer oriented company belonging to the bank while repelling or isolating the disruption;
industry. • recover: restore all asset function and service availability to their pre-
For the private organizations, valuable actions are threat event functionality;

14
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Table 11
Definitions of the managerial actions suggested by the case studies.
Managerial Actions Definition Source(s)

Artificial Intelligence Term used to describe “a machine that mimics “cognitive” functions that humans associate with other Russell & Norvig, 2016, p.2
human minds, such as “learning” and “problem solving” “
Audit Log A chronological record of system activities. Includes records of system accesses and operations NIST - Glossary of Key Information Security
performed in a given period. Terms, 2013CNSSI-4009
Backup A copy of files and programs made to facilitate recovery,if necessary NIST - Glossary of Key Information Security
Terms, 2013SP 800–34; CNSSI-4009
Clone System In computer science, cloning is the process of creating an exact copy of another application program or IBM Knowledge Center
object. It is an operation that enables an administrator to replicate profiles.
Cost-Benefit Analysis “A financial analysis tool used to determine the benefits provided by a project against its costs” PMBOK®Guide – Sixth Edition, 2017, p. 703
Credential Service A trusted entity that issues or registers Subscriber tokens and issues electronic credentials to NIST - Glossary of Key Information Security
Provider (CSP) Subscribers. The CSP may encompass Registration Authorities (RAs) and Verifiers that it operates. A Terms, 2013SP 800–63
CSP may be an independent third party, or may issue credentials for its own use.
Cryptography It is categorized as either secret key or public key. Secret key cryptography is based on the use of a NIST - Glossary of Key Information Security
single cryptographic key shared between two parties. The same key is used to encrypt and decrypt Terms, 2013FIPS 191
data. This key is kept secret by the two parties. Public key cryptography is a form of cryptography
which makes use of two keys: a public key and a private key. The two keys are related but have the
property that, given the public key, it is computationally infeasible to derive the private key [FIPS
140–1]. In a public key cryptosystem, each party has its own public/private key pair. The public key
can be known by anyone; the private key is kept secret
Cyber Insurance “Cyber insurance policies provide coverage against many of the losses associated with cyber-induced Young, Lopez, Rice, Ramsey, & McTasney, 2016,
incidents (e.g., data destruction and theft, extortion, malicious code, denial-of-service attacks, p. 45
response activities and legal claims)”.
Data Mining “An analytical process that attempts to find correlations or patterns in large data sets for the purpose NIST - Special Publication 800–53 Revision 4,
of data or knowledge discovery.” 2013, p.B-6
Fraud Intelligence Fraud intelligence is the analysis of financial transactions to identify out-of-the-ordinary activity and Lloyds Banking Group – Press Release, 2019
thwart fraud before or during a transaction. It combines biometrics, big data and artificial intelligence
to analyze data in real time and prevent frauds.
ICT investments Investments in “all categories of ubiquitous technology used for the gathering, storing, transmitting, NIST - Glossary of Key Information Security
retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing Terms, 2013
systems, software, signal processors, mobile telephony, satellite communications, and networks)”.
Know How Transfer The transferring of tacit, nonproprietary technological knowledge. Kachra & White, 2008
Penetration Testing A test methodology in which assessors, using all available documentation (e.g., system design, source NIST - Glossary of Key Information Security
code, manuals) and working under specific constraints, attempt to circumvent the security features of Terms, 2013, p. 139
an information system.
Phishing simulations A simulation of a “digital form of social engineering that uses authentic-looking—but bogus—emails NIST - Glossary of Key Information Security
to request information from users or direct them to a fake Web site that requests information.” Terms, 2013, p. 142
Recruitment and Once recruited the right employees, retention is a strategic opportunity for many organizations to De Long & Davenport, 2003; Messmer, 2006;
retention maintain a competitive workforce and it is improved when employees are offered compensation and Schramm, 2006
benefits, have a supportive work culture, can develop and advance and balance work and life
activities.
Secure by design “Secure by design is an approach to developing secure software systems from the ground up. In such Santos, Tarrit, & Mirakhorli, 2017, p.1
approach, the alternate security tactics are first thought; among them, the best are selected and
enforced by the architecture design, and then used as guiding principles for developers.”
SIEM tool Application that provides the ability to gather security data from information system components and NIST - Glossary of Key Information Security
present that data as actionable information via a single interface. Terms, 2013, p. 177
Social Engineering Campaigns to make employees aware of the risk of being involved in an “An attempt to trick someone NIST - Glossary of Key Information Security
Campaigns into revealing information (e.g., a password) that can be used to attack systems or networks”. Terms, 2013, p. 185
Threat Intelligence Threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to NIST - Glossary of Key Information Security
provide the necessary context for decision-making processes. Terms, 2013, p.
Training Teaching people the knowledge and skills that will enable them to perform their jobs more effectively NIST - Glossary of Key Information Security
Terms, 2013, p.
Trend analysis “An analytical technique that uses mathematical models to forecast future outcomes based on PMBOK®Guide – Sixth Edition, 2017, p. 725
historical results “
Vulnerability Systematic examination of an information system or product to determine the adequacy of security NIST - Glossary of Key Information Security
Assessment measures, identify security deficiencies, provide data from which to predict the effectiveness of Terms, 2013, p. 212
proposed security measures, and confirm the adequacy of such measures after implementation

• adapt: using knowledge from the event, alter protocol, configuration by the context. In the Context-Based Managerial Cyber Resilience
of the system, personnel training, or other aspects to become more Framework (presented in Fig. 3), this phase is function of the three
resilient. context factors identified in literature and characterizing the companies
under study. The new framework in the Plan / Prepare phase lists the
In consideration of the above evidences and of the state of the art on managerial macro-actions that all companies seem to undertake (Data
cyber security and resilience, we provide in Fig. 2 a managerial cyber Protection, Prevention, Test and Training) to manage resilient systems
resilience framework reporting those practices mentioned by at least and details some actions taken by companies having common contextual
50% of the sample for each context analyzed. factors.
Fig. 2 synthesizes the practices implemented in the cases in a The actions detailed in the specific contexts not only enrich our
Managerial Cyber Resilience Framework that illustrates the four general framework by making it a function of some contextual factors, but they
phases by clarifying the central role of organizational learning and of provide us the evidences to conclude that:
context in the correct selection and implementation of different tools
and practices (large arrows). • having customer as final users leads organizations to focus on pro­
The Plan/Prepare phase is the one that most seems to be conditioned tection phase and test phase to manage cyber resilient systems;

15
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

Fig. 2. Managerial Cyber Resilience Framework.

Fig. 3. Context-Based Managerial Cyber Resilience Framework.

• having critical structure / activities leads organizations to the training and artificial intelligence solutions as machine learning) as
adoption of Security Information and Event Management (SIEM) tool actions to manage cyber resilient systems. For instance, a considerable
to manage cyber resilient systems and to analyse risks; amount of people, both employees and final users/consumers handling
• having a private ownership leads organizations to the implementa­ vital and private information and data, still ignore how easily these in­
tion of managerial actions focused on the prevention of the cyber formation and data can be stolen. Therefore, in all the six cases,
resilience systems. “training” is considered important investment to build resilience from
cyber-attacks. In fact, tools and managerial practices can provide valu­
6. Conclusions able results only if paired with investments in training to develop
awareness and to prevent erroneous behaviors. There is, however, the
Organizations excelling in cyber security recognize the importance need for developing also machine learning: all the key informants
of investing in learning of employees and of machines (human resources highlighted artificial intelligence as a future direction of investment and,

16
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

in the case of the consultancy company, it is already considered as an Collier, Z. A., DiMase, D., Walters, S., Tehranipoor, M., Lambert, J. H., & Linkov, I.
(2014). Cybersecurity standards: Managing risk and creating resilience. Computer, 47
investment.
(9), 70–76.
Indeed, this study recognizes the factor that plays an important role Cook, T. D., & Campbell, D. T. (1979). Quasi-experimentation: Design and analysis for field
in building a resilient system for cyber security: organizational learning. settings. Chicago, IL: Randy Mc Nally.
There is a need for introducing and continuously developing an organi­ Davis, A. (2015). Building cyber-resilience into supply chains. Technology Innovation
Management Review, 5(4).
zational culture of cyber security a deep knowledge of its main aspects De Long, D. W., & Davenport, T. (2003). Better practices for retaining organizational
spreading at all organizational levels rather than pushing the unaware knowledge: Lessons from the leading edge. Employment Relations Today, 30(3), 51.
adoption of high-tech tools and techniques. DiMase, D., Collier, Z. A., Heffner, K., & Linkov, I. (2015). Systems engineering
framework for cyber physical security and resilience. Environment Systems and
Our framework and the linked considerations provide a double Decisions, 35(2), 291–300.
contribution, for both research and practice: it represents a new insight Eisenhardt, K. M. (1989). Building theories from case study research. Academy of
and direction for research on managerial aspects of cyber security and Management Review, 14, 532–550.
Eisenhardt, K. M., & Graebner, M. E. (2007). Theory building from cases: Opportunities
gives awareness of the necessity of investing in training for managers and challenges. Academy of Management Journal, 50, 25–32.
willing to invest in security systems in order to enhance the cyber Ferdinand, J. (2015). Building organisational cyber resilience: A strategic knowledge-
resilience of their organizations. based view of cyber security management. Journal of Business Continuity & Emergency
Planning, 9(2), 185–195.
However, the study has some limitations. First of all, its exploratory Ganin, A. A., Quach, P., Panwar, M., Collier, Z. A., Keisler, J. M., Marchese, D., &
nature that did not give us the opportunity to arrive to a set of propo­ Linkov, I. (2020). Multicriteria decision framework for cybersecurity risk assessment
sitions linking the cause-effect relationship between context, imple­ and management. Risk Analysis, 40(1), 183–199.
Gisladottir, V., Ganin, A. A., Keisler, J. M., Kepner, J., & Linkov, I. (2017). Resilience of
mentation of managerial practices and success of these practices. For
cyber systems with over-and underregulation. Risk Analysis, 37(9), 1644–1651.
instance, the framework did not consider the nature of investments in Haimes, Y. Y. (2009). On the definition of resilience in systems. Risk analysis. An
cyber security, which do not provide a direct return and can be International Journal, 29(4), 498–501.
considered as sunk costs. Future research efforts should take into ac­ Hohenstein, N. O., Feisel, E., Hartmann, E., & Giunipero, L. (2015). Research on the
phenomenon of supply chain resilience: A systematic review and paths for further
count also this aspect to understand the overall willingness of company investigation. International Journal of Physical Distribution & Logistics Management, 45
to invest in cyber security, given the highlighted drawback. The set of (1/2), 90–117.
companies studied is small, and future research is needed with a larger Huberman, M., & Miles, M. B. (Eds.). (2002). The qualitative researcher’s companion.
Thousand Oaks, CA: Sage.
sample to confirm our findings, to offer a set of propositions for theory Jensen, L. (2015). Challenges in maritime cyber-resilience. Technology Innovation
building subsequently confirmed by a quantitative study for theory Management Review, 5(4), 35.
testing using a survey methodology. Kachra, A., & White, R. E. (2008). Know-how transfer: The role of social, economic/
competitive, and firm boundary factors. Strategic Management Journal, 29(4),
425–445.
CRediT authorship contribution statement Kamalahmadi, M., & Parast, M. M. (2016). A review of the literature on the principles of
enterprise and supply chain resilience: Major findings and directions for future
research. International Journal of Production Economics, 171, 116–133.
Alessandro Annarelli: Conceptualization, Methodology, Valida­ Kaplan, S., & Garrick, B. J. (1981). On the quantitative definition of risk. Risk analysis, 1
tion, Formal analysis, Investigation, Data curation, Writing - original (1), 11–27.
draft, Writing - review & editing, Visualization. Fabio Nonino: Katsumata, P., Hemenway, J., Gavins, W. (2010). Cybersecurity risk management. In
MILCOM - military communications conference (pp. 890–895).
Conceptualization, Methodology, Validation, Formal analysis, Investi­
Kawanaka, T., Matsumaru, M., & Rokugawa, S. (2014). Software measure in cyber-
gation, Data curation, Writing - original draft, Writing - review & edit­ attacks on production control system. Computers & Industrial Engineering, 76,
ing, Visualization, Supervision. Giulia Palombi: Conceptualization, 378–386.
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015). A survey of
Methodology, Validation, Formal analysis, Investigation, Data curation,
cyber security management in industrial control systems. International Journal of
Writing - original draft, Writing - review & editing, Visualization. Critical Infrastructure Protection, 9, 52–80.
Koelemeijer, D. (2018). Enhancing the cyber resilience of critical infrastructures through
Acknowledgement an evaluation methodology based on assurance cases. Procedia Computer Science,
126, 1779–1791.
Kott, A., Wang, C., & Erbacher, R. F. (Eds.). (2015). Cyber defense and situational
This work is supported by the fund “Progetto di Eccellenza” of the awareness (Vol. 62). Springer.
Department of Computer, Control and Management Engineering Kott, A., & Linkov, I. (Eds.). (2019). Cyber resilience of systems and networks. Springer
International Publishing.
“Antonio Ruberti” of Sapienza University of Rome. The department has Linkov, I., Eisenberg, D. A., Bates, M. E., Chang, D., Convertino, M., Allen, J. H., …
been designated by the Italian Ministry of Education (MIUR) for being Seager, T. P. (2013). Measurable resilience for actionable policy. Environmental
“Department of Excellence” in advanced training programs in the field Science & Technology, 47(18), 10108–10110.
Linkov, I., Eisenberg, D. A., Plourde, K., Seager, T. P., Allen, J., & Kott, A. (2013).
of cybersecurity. Resilience metrics for cyber systems. Environment Systems and Decisions, 33(4),
471–476.
References Linkov, I., & Trump, B. D. (2019). The science and practice of resilience. Springer
International Publishing.
Linkov, I., Roslycky, L., & Trump, B. D. (Eds.). (2020). Applying resilience to hybrid threats:
Abdullah, N. A. S., Noor, N. L. M., & Ibrahim, E. N. M. (2013). Resilient organization:
Integrating infrastructural, digital and social systems (Vol. 55). IOS Press.
Modelling the capacity for resilience. In International conference on research and
Lloyds Banking Group, Press Release (2019). Smelling a rat: Lloyds Bank’s fraud team
innovation in information systems (ICRIIS) (pp. 319–324).
uses artificial intelligence to help sniff out scams BEFORE they happen. Available
Alberts, D. S., & Hayes, R.E. (2003). Power to the edge: Command... control... in the
online: https://www.lloydsbankinggroup.com/globalassets/documents/media/
information age. Office of the Assistant Secretary of Defense Washington DC
press-releases/lloyds-bank/2019/lloyds-banks-fraud-team-uses-artificial-intellige
Command and Control Research Program (CCRP).
nce-to-help-sniff-out-scams.pdf.
Bishop, M., Carvalho, M., Ford, R., & Mayron, L. M. (2011). Resilience is more than
McCutcheon, D. M., & Meredith, J. R. (1993). Conducting case study research in
availability. In Proceedings of the 2011 new security paradigms workshop (pp. 95–104).
operations management. Journal of Operations Management, 11(3), 239–256.
Bodeau, D., Graubart, R. (2011). Cyber resiliency engineering framework. MTR110237,
Messmer, M. (2006). Four keys to improved staff retention. Strategic Finance, 13–15.
MITRECorporation.
Miles, M. B., & Huberman, A. M. (1994). Qualitative data analysis: An expanded source
Boyes, H. (2015). Cybersecurity and cyber-resilient supply chains. Technology Innovation
(2nd ed.). London, UK: Sage.
Management Review, 5(4), 28.
Mourtzis, D., & Vlachou, E. (2016). Cloud-based cyber-physical systems and quality of
Burstein, M., Goldman, R., Robertson, P., Laddaga, R., Balzer, R., Goldman, N., &
services. Total Quality Management, 28(5), 704–733.
Keller, P. (2012). Stratus: Strategic and tactical resiliency against threats to
Mourtzis, D., Vlachou, E., Xanthopoulos, N., Givehchi, M., & Wang, L. (2016). Cloud-
ubiquitous systems. In IEEE sixth international conference on self-adaptive and self-
based adaptive process planning considering availability and capabilities of machine
organizing systems workshops (pp. 47–54).
tools. Journal of Manufacturing Systems, 39, 1–8.
Carayannis, E. G., Grigoroudis, E., Rehman, S. S., & Samarakoon, N. (2019).
Mourtzis, D., Milas, N., & Vlachou, A. (2018). An internet of things-based monitoring
Ambidextrous cybersecurity: The seven pillars (7Ps) of cyber resilience. IEEE
system for shop-floor control. Journal of Computing and Information Science in
Transactions on Engineering Management.
Engineering, 18(2).
Caron, F. (2019). Obtaining reasonable assurance on cyber resilience. Managerial
Auditing Journal.

17
A. Annarelli et al. Computers & Industrial Engineering 149 (2020) 106829

National Academies (US). (2012). Disaster resilience: A national imperative. National Tran, H., Campos-Nanez, E., Fomin, P., & Wasek, J. (2016). Cyber resilience recovery
Academies Press. model to combat zero-day malware attacks. Computers & Security, 61, 19–31.
NIST Interagency/Internal Report (NISTIR) – 7298 - Rev. 2 (2013). Glossary of Key Von Solms, R., & Van Niekerk, J. (2013). From information security to cyber security.
Information Security Terms. Computers & Security, 38, 97–102.
NIST Special Publication (SP) - 800-53 - Rev. 4 (2013). Security and Privacy Controls for Wang, W., & Lu, Z. (2013). Cyber security in the smart grid: Survey and challenges.
Federal Information Systems and Organizations. Computer networks, 57(5), 1344–1371.
Patton, M. Q. (2002). Qualitative research and evaluation methods (3rd ed.). Thousand Wieland, A., & Wallenburg, C. M. (2013). The influence of relational competencies on
Oaks, CA: Sage. supply chain resilience: A relational view. International Journal of Physical Distribution
PMBOK® Guide – Sixth Edition (2017). & Logistics Management, 43(4), 300–320.
Ribeiro, J. P., & Barbosa-Povoa, A. (2018). Supply Chain Resilience: Definitions and Yin, R. K. (1984). Case study research: Design and methods (2nd ed.) Newbury Park, CA:
quantitative modelling approaches–A literature review. Computers & Industrial Sage. Applied Social Research Method Series.
Engineering, 115, 109–122. Young, D., Lopez, J., Jr, Rice, M., Ramsey, B., & McTasney, R. (2016). A framework for
Roege, P. E., Collier, Z. A., Chevardin, V., Chouinard, P., Florin, M. V., Lambert, J. H., … incorporating insurance in critical infrastructure cyber risk strategies. International
Todorovic, B. (2017). Bridging the gap from cyber security to resilience. In Resilience Journal of Critical Infrastructure Protection, 14, 43–57.
and Risk (pp. 383–414). Dordrecht: Springer.
Rogers, R., Apeh, E., Richardson, C.J. (2016). Resilience of the Internet of Things (IoT)
Alessandro Annarelli (PhD) is a Post-Doc Research Fellow at Sapienza University of
from an Information Assurance (IA) perspective. In 10th International Conference on
Rome. After receiving his Master Degree at Sapienza University of Rome, he obtained a
Software, Knowledge, Information Management & Applications (SKIMA) (pp.
PhD in Sustainable Energy and Technologies at the Free University of Bolzano-Bozen
110–115).
(Italy). During his PhD, he spent a visiting period at Luleå Tekniska Universitet (LTU) in
Rohmeyer, P., Ben-Zvi, T., Lombardi, D., & Maltz, A. (2017). Capability effectiveness
Luleå, Sweden. His interests are on digitalization, cybersecurity and product-service sys­
testing for architectural resiliency in financial systems. In Portland international
tems. His main publications appeared in Omega – The International Journal of Manage­
conference on management of engineering and technology (PICMET) (pp. 1–7).
ment Science, Journal of Cleaner Production and Industrial Management and Data
Rowe, B. R., & Gallaher, M. P. (2006). Private sector cyber security investment strategies:
Systems.
An empirical analysis. In The fifth workshop on the economics of information
security (WEIS06).
Runkel, P. (1990). Casting nets and testing specimens: Two grand methods of psychology. Fabio Nonino (PhD) is Associate Professor of Business Management and Project Man­
New York, NY: Praeger. agement at Sapienza University of Rome. He carries out his research activities in the field
Russell, S. J., & Norvig, P. (2016). Artificial intelligence: A modern approach. Malaysia: of Management focusing on Operations and Service Management, Innovation Manage­
Pearson Education Limited. ment and Organizational Behaviour development. His main publications appeared in
Santos, J. C., Tarrit, K., & Mirakhorli, M. (2017). A catalog of security architecture Journal of Cleaner Production, Supply Chain Management: An international Journal,
weaknesses. In 2017 IEEE international conference on software architecture workshops Production Planning & Control, Omega – The Journal of Management Science, Interna­
(ICSAW) (pp. 220–223). IEEE. tional Journal of Production Research and Technological Forecasting and Social Change.
Schramm, J. (2006). Future focus: Targeting retention. HR Magazine, 51(9), 216. He is a Member of the editorial board of Kybernetes – The International Journal of Cy­
Schramm, W. D. (1971). How communication works. In The Process and Effects of Mass bernetics, Systems and Management Sciences and the International Journal of Information
Communication (p. 4). Urbana: University of Illinois Press. Systems and Supply Chain Management.
SEBoK. (2017). System resilience. Systems engineering body of knowledge. Available:
http://sebokwiki.org/wiki/System_Resilience.
Giulia Palombi (PhD) is a Post-Doc Research Fellow at Sapienza University of Rome,
Sharkov, G. (2016). From cybersecurity to collaborative resiliency. In ACM workshop on
currently she is carrying out mainly researches on the managerial aspects of Cyber Secu­
automated decision making for active cyber defense (pp. 3–9).
rity, being working on the “Excellence Program of Cyber Security” of her university
Soni, U., Jain, V., & Kumar, S. (2014). Measuring supply chain resilience using a
department. Her other research interests concern Intra Organizational Social Networks,
deterministic modeling approach. Computers & Industrial Engineering, 74, 11–25.
Behavioural Economic in Management, Operation/Industrial Management and Project
Steen, R., & Aven, T. (2011). A risk perspective suitable for resilience engineering. Safety
Management. Previously she received her master’s degree with honour on Management
science, 49(2), 292–297.
Engineering at Sapienza University of Rome and her PhD in 2019 in Industrial and Man­
Strauss, A. L. (1987). Qualitative analysis for social scientists. Cambridge, NY: Cambridge
agement Engineering at Sapienza University of Rome with an experimental PhD thesis
University Press.
developed in collaboration with University of Kentucky. During her PhD, she awarded a
Strauss, A. L., & Corbin, J. (1990). Basics of qualitative research. Grounded theory
personal special scholarship for her visiting at the LINKS centre for Social Network
procedures and techniques. Newbury Park, CA: Sage.
Analysis at University of Kentucky (centre of excellence for Social Network in Management
Tapoglou, N., Mehnen, J., Vlachou, A., Doukas, M., Milas, N., & Mourtzis, D. (2015).
studies). She presented her studies at several international conferences including
Cloud-based platform for optimal machining parameter selection based on function
EUROMA, IFKAD and ISPIM and she published on Journal of Manufacturing Technology
blocks and real-time monitoring. Journal of Manufacturing Science and Engineering,
Management.
137(4).
Tierney, K., & Bruneau, M. (2007). Conceptualizing and measuring resilience: A key to
disaster loss reduction. TR News May-June, 2007, 14–17.

18