Armenia, Stefano; Ferreira Franco, Eduardo; Nonino, Fabio; Spagnol,i Emanuele
Stefano Armenia, Università degli Studi di Roma “La Sapienza”
armenia@dis.uniroma1.it
Eduardo Ferreira Franco, Escola Politécnica of University of São Paulo
eduardo.franco@usp.br
Fabio Nonino, Università degli Studi di Roma “La Sapienza”
fabio.nonino@uniroma1.it
Emanuele Spagnoli, PricewaterhouseCoopers
ema.spagno@gmail.com
Nowadays our society is increasingly becoming economic and social dependent on the cyberspace, which includes physical network assets and software based systems. However, the cyberspace is exposed to numerous risks, and there is a constant threat of exploitable vulnerabilities, which could cause significant reputational and economic damages to the companies. For addressing these increasing threats, the Italian National Cyber Security Framework was developed to offer a uniform approach to assessing cyber risks into organizations, as well as to help improve the related security through focused investments. Still, this evaluation is not a straightforward endeavor. Using the principles of the Systems Thinking paradigm, this work presents a way to put into causal relationship the self-assessment risk-categories of the framework by associating them to the various aspects of reference inside a theoretical organizational structure (composed of business areas, process, functions, and roles), hence deriving a systemic causal-effect relationship map capable of evidencing, at least qualitatively for this study, how a change in one or more categories is driving changes also into other ones.
Keywords: National Cyber Security Framework; Cyber-security Risks; System thinking.