On the Complexity of Cybersecurity Exercises Proportional to Preparedness

The purpose of this study is to illustrate how exercises can play the role of a driving power to improve an organization’s cyber security preparedness. The degree of cyber security preparedness varies significantly among organizations. This implies that training and exercises must be tailored to spe...

Full description

Saved in:
Bibliographic Details
Published inJournal of disaster research Vol. 12; no. 5; pp. 1081 - 1090
Main Authors Aoyama, Tomomi, Nakano, Toshihiko, Koshijima, Ichiro, Hashimoto, Yoshihiro, Watanabe, Kenji
Format Journal Article
LanguageEnglish
Published 01.10.2017
Online AccessGet full text

Cover

More Information
Summary:The purpose of this study is to illustrate how exercises can play the role of a driving power to improve an organization’s cyber security preparedness. The degree of cyber security preparedness varies significantly among organizations. This implies that training and exercises must be tailored to specific capabilities. In this paper, we review the National Institute of Standards and Technology (NIST) cybersecurity framework that formalizes the concept of tier, which measures the degree of preparedness. Subsequently, we examine the types of exercises available in the literature and propose guidelines that assign specific exercise types, aims, and participants to each level of preparedness. The proposed guideline should facilitate the reinforcement of cybersecurity risk management practices, reduce resource misuse, and lead to a smooth improvement of capabilities.
ISSN:1881-2473
1883-8030
DOI:10.20965/jdr.2017.p1081