Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
organizational processes. All the nodes are tightly interconnected by organizational
intradependencies, whereby significant change or disturbance in any node (such
as, changes that affect security e.g., attacks on physical elements, staff cuts,
technology upgrades etc.) distorts the overall shape of organizational model.
Therefore, for the organization to retain its shape, simultaneous changes are
necessary in other nodes to compensate for this initial change.
Figure III—27 Four node organization model and its intradependencies.
From the point of view of information security, most organizations now implement
and maintain a diverse set of information security controls that span all the four
nodes of Figure 27. These controls are amalgamated under some formal
information security management (ISM) system. ISM systems are well established
as an integral component in most organizations and a range of standards have been
published to guide their implementation (Kenning 2001). 86 The primary focus of
ISM tends to be more inward-looking, by putting an emphasis on the
intradependencies within an organization, and treating the interdependency with
nodes belonging to other organizations as a secondary issue. By contrast, CIIP
objectives have a broader scope, placing equal emphasis on both
intradependencies and interdependencies associated with a particular organization.
86 An example ISM standard is the tripartite BS 7799 standard that was developed in the early
1990s in response to demand from private and public sector organizations for a common
information security framework. The standard initially published by the British Standards
Institute, has since been internationalized as the ISO/IEC standards 27001 and 27002.
128 NORDREGIO REPORT 2007:5