Towards the Definition of a Dynamic/Systemic Assessment for Cyber Security Risks through a Systems Thinking Approach

Nowadays our society is increasingly becoming economic and social dependent on the cyberspace, which includes physical network assets and software based systems. However, the cyberspace is exposed to numerous risks, and there is a constant threat of xploitable vulnerabilities, which could cause significant reputational and economic damages to the companies. For addressing these increasing threats, the Italian National Cyber Security Framework was developed to offer a uniform approach to assessing cyber risks into organizations, as well as to help improve the related security through focused investments. Still, this evaluation is not a straightforward endeavor. Using the principles of the Systems Thinking paradigm, this work presents a way to put into causal relationship the self-assessment risk-categories of the framework by associating them to the various aspects of reference inside a theoretical organizational structure (composed of business areas, process, functions, and roles), hence deriving a systemic causal-effect relationship map capable of evidencing, at least qualitatively for this study, how a change in one or more categories is driving changes also into other ones.