Kyberturvallisuuden johtaminen ja kehittäminen osana kriittisen infrastruktuurin organisaation toimintaa – Systeemiajattelu

Abstract

The structure of the modern society is based on the cooperation of different parts of the critical infrastructure. Their mutual functional ability depends primarily on operationally reliable organizations that form systems, i.e. parts of the infrastructural whole. This doctoral dissertation focuses on developing cybersecurity leadership in enterprises and other organizations in the network of national critical infrastructure. The research emphasizes controlling the continuity of their functional processes in all operational environments. The dissertation presents different models of cybersecurity leadership and development for organizations. The focus is on proactiveness as well as creating trust, preserving reputation and managing the continuity of functional processes. The research method used was Soft Systems Methodology, SSM. While the people, processes and technologies of an organization present its capabilities, they also contain vulnerabilities. The most central research question of the dissertation concentrates on cybersecurity leadership procedures and a comprehensive system review of cybersecurity management in a national critical infrastructure organization. It means cybersecurity management on all levels of decision-making (strategic, operative and technical/tactical). Three practical measures for development are presented: first, embedding new technological solutions into the organization’s piers cyber security structure, second, drafting comprehensive cyber security risk assessments and third, preparing contingency plans in order to improve an organization’s resilience. In implementing the organizational cybersecurity development measures presented in the dissertation, the PDCA-method of process improvement can be applied. These organization-specific measures advance the protection of national critical infrastructure and thus also cyber self-sufficiency, comprehensive security, security of supply and both national and organization-specific competitive advantage. Keywords: cyber security, national critical infrastructure, system, organization, process, system, device