Data Governance to Counter Hybrid Threats against Critical Infrastructures

Abstract

Hybrid threats exploit vulnerabilities in digital infrastructures, posing significant challenges to democratic countries and the resilience of critical infrastructures (CIs). This study explores integrating data governance with business process management in response actions to hybrid attacks, particularly those targeting CI vulnerabilities. This research analyzes hybrid threats as a multidimensional and time-dependent problem. Using the Business Process Model and Notation, this investigation explores data governance to counter CI-related hybrid threats. It illustrates the informational workflow and context awareness necessary for informed decision making in a cross-border hybrid threat scenario. An airport example demonstrates the proposed approach’s efficacy in ensuring stakeholder coordination for potential CI attacks requiring cross-border decision making. This study emphasizes the importance of the information security lifecycle in protecting digital assets and sensitive information through detection, prevention, response, and knowledge management. It advocates proactive strategies like implementing security policies, intrusion detection software tools, and IT services. Integrating Infosec with the methodology of confidentiality, integrity, and availability, especially in the response phase, is essential for a proactive Infosec approach, ensuring a swift stakeholder response and effective incident mitigation. Effective data governance protects sensitive information and provides reliable digital data in CIs like airports. Implementing robust frameworks enhances resilience against hybrid threats, establishes trusted information exchange, and promotes stakeholder collaboration for an emergency response. Integrating data governance with Infosec strengthens security measures, enabling proactive monitoring, mitigating threats, and safeguarding CIs from cyber-attacks and other malicious activities.

Keywords

• hybrid threats dimensions
• data exfiltration
• situational awareness workflow
• BPMN
• CIA
• Infosec lifecycle