Dimensions of cybersecurity performance and crisis response in critical infrastructure organisations: an intellectual capital perspective

Abstract

PurposeThis research addresses the relationships between the current, dynamic organisational cyber risk climate, organisational cybersecurity performance and changes in cybersecurity investments, with an aim to address the hostile epistemic climate for intellectual capital management presented by the dynamics of cybersecurity as a phenomenon.Design/methodology/approachExpanding on the views of digital security and resilience as a knowledge problem, the research looks at cybersecurity as a critical capability within organisations, particularly relevant in critical infrastructure sectors. The problem is studied from the perspective of 400 C-level executives from critical infrastructure sectors across the UK. Data collected at the peak of the coronavirus disease 2019 (COVID-19) pandemic, a time when critical infrastructure organisations have been under a significant strain due to an increase in cybersecurity incidents, were analysed using partial least square structural equation modelling.FindingsThe research found a significant correlation between the board's perception of a change in their cybersecurity risk climate and patterns of both the development of cybersecurity management capabilities and cybersecurity investments. The authors also found that a positive correlation exists between the efforts placed by critical infrastructure organisations in cybersecurity training and the changes in investment in their cybersecurity, particularly in relation to their intellectual capital development efforts.Originality/valueTo the best of the authors’ knowledge, this is the first paper that explores the board's perception of cybersecurity in critical infrastructure organisations both from the intellectual capital perspective and in the dynamic cyber risk climate derived from the COVID-19 crisis. The authors’ findings expand on the growing perception of cybersecurity as a knowledge problem, and thus inform future research and practice in the domain of intellectual capital management and its role in supporting the cybersecurity and digital resilience of business and society.

How can rural businesses thrive in the digital economy? A UK perspective

“…Finally, cyber vulnerabilities, which are the weakness that can be exploited by cybercriminals ( Garcia-Perez et al., 2021 ), are a continued and growing threat for all businesses in the digital era, including rural SMEs (Centre for Rural Enterprise Engagement ( CREE), 2021 ). Miller (2022) reports that rural businesses face similar cyber security challenges to their urban counterparts such as ransomware attacks, database breaches, fraudulent payment requests, and so on.…”

“…These spikes can also create an uncertain view of digital business operations in the future with regards to cyber security ( Lallie et al., 2021 ). Using evidence from 400 UK companies, Garcia-Perez et al. (2021) suggest that to effectively manage their risks associated to the digital environment, businesses need to balance the adoption of new technologies and the implementation on the best practices and/or applications related to cyber security in their organisations.…”

The Idea of Organizational Resilience in the Face of Cybercrime

“…However, there is no turning back from information technology, let alone from digital transformation: it is a reality to which organizations must adapt. Currently, more and more researchers describe the risks associated with digital transformation (Casey & Souvignet, 2020;Hacioglu & Sevgilioglu, 2019) and digital resilience as a necessity for organizations functioning in the 21 st century (Garcia-Perez et al, 2021;Paulus et al, 2022;Tran, 2020).…”

Maritime cybersecurity: are onboard systems ready?

“…For instance, Lee ( 2021 ) proposed a new framework for cyber risk management that includes four layers: cyber ecosystem, cyber infrastructure, cyber risk assessment and cyber performance, which includes three activities (i.e., implementation, monitoring and controlling, and continuous improvement). Garcia-Perez, Sallos, and Tiwasing ( 2021 ) defined four indicators for cybersecurity performance, including Focus (provision of foundational cybersecurity element), Capability, Resilience and Prep (cybersecurity training and preparation efforts). However, there is no universally accepted definition of cybersecurity performance.…”