Christine Große

This study examines the role of crisis management as an enabling practice for organizational cyber resilience within the public sector. Taking a stakeholder perspective, this qualitative case study analyzes how a Swedish municipal social administration, which was the victim of a ransomware attack that escalated into a crisis, managed to maintain essential services despite widespread disruptions to its digital systems. The case study demonstrates the limitations of a purely technical approach to managing cyberattacks. It offers valuable insights into the characteristics of a cyber crisis and its impact on critical municipal services. The results highlight the need to integrate crisis management and cybersecurity efforts for enhanced organizational cyber resilience. They also highlight the role of specific stakeholders “at the edge” of the organization during a (cyber) crisis: the nontechnical employees who were the first to handle the operational consequences of the digital disruption and ensured that the public services continued to function. The article presents findings on how public service cyber resilience can be strengthened and sustained through effective crisis management practices, including adaptability, sound decision‐making, and clear communication. This study thus contributes to an enhanced understanding of cyber crisis management in public organizations in general and practices relevant to strengthening cyber resilience in particular.

This paper provides an overview and mapping of needs and use of data related to formal risk analysis within the context of critical infrastructures, including activities of risk assessments and risk modelling as a part of preventive work against major accidents and crises. The aim is to contribute to a greater understanding of the type of data that is actually used in published sources where different risk assessment or risk analysis methods are applied for critical infrastructure protection. The study focuses specifically on the presentation of applications of quantitative or semi-quantitative risk analysis in the scientific literature within the domain of societally important services and critical infrastructures. The survey was delimited to peer reviewed research papers between the years 2010 and 2020 and resulted in a total number of 183 papers subject for evaluation. The results provide insights into the type of data that is used, missing or difficult to obtain for an application of the identified methods. To obtain a comprehensive critical infrastructure risk analysis data needs are related to three different data dimensions; geospatial topology data, socio-economic data, and infrastructure data. However, no databases are currently available with the explicit purpose to support critical infrastructure risk analysis. Even though this is not viewed as a problem in the examined papers, collecting that data is resource intensive which is a barrier for a more systematic use of formal risk analysis methods.