The fourth industrial revolution has brought several risks to factories along with its plethora of benefits. The convergence of new technologies, legacy technologies, information technologies and operational technologies in the same network generates a wide attack surface. At the same time, factories need continuous production to meet their customers' demand, so any stopped production can have harsh effects on a factory's economy. This makes cyber resilience a key requirement in factories nowadays. However, it is difficult for managers to define effective cyber resilience strategies, especially considering the difficulty of estimating adequate investment in cyber resilience policies before the company has suffered cyber incidents. In this sense, the purpose of this article is to define and model an effective cyber resilience strategy. To achieve this, the system dynamics methodology was followed in order to get five experts' opinions on the best strategy to invest in cyber resilience. Interviews were conducted with these experts; their reasoning was put into behavior over time graphs and a system dynamics model was built from these findings. The main conclusion is that a cyber resilience investment strategy should be dynamic, investing in both technical security and personnel training, but at first with an emphasis on technical security and later shifting to have an emphasis on training.

A growing majority of the world's population lives in cities, and the concentration of people and critical services in cities increases their exposure to acute shocks and long-term stresses. Therefore, building resilient cities that are able to resist and absorb threats and are capable of adapting to and recovering from shocks and stresses is vital for the wellbeing of society. Although the literature offers several studies on how city resilience can be improved, operationalizing resilience is still a challenge. This article describes the different phases of the co-creation process followed in the development of a maturity model that can guide cities in assessing and future improving their resilience level. This co-creation process was conducted using different methodologies involving an interdisciplinary group of international experts who contributed their knowledge and experience to the development process of the maturity model. The outcome of this process is the final version of a maturity model that operationalizes the steps that should be taken to build city resilience.

Climate change (CC) is one of the most challenging issues ever faced, as it affects every system worldwide at any scale. Urban areas are not an exception. Extreme weather-related events have seriously affected urban areas in recent years, and they have a significant impact on the welfare of people. According to UN projections, by 2050 more than 68% of the world's population could be concentrated in urban areas. Additionally, daily life in urban areas is highly dependent on certain critical services and products provided by critical infrastructures (CIs). Therefore, it is especially relevant to understand how CC affects urban CIs in order to develop mechanisms to improve their capacity to handle crises derived from CC. In this context, resilience-based strategies provide a holistic approach, considering both predictable and unpredictable threats. This paper proposes a guide for assessing and enhancing the resilience level of cities against CC, considering urban CIs as key agents in improving the city's capacity to face and recover from CC-related crises. The guide was developed through a co-creation process in which two cities in the Basque Country (Spain) worked together with CI providers and other relevant stakeholders in the resilience-building process. The resulting guide is to be used by city stakeholders at a strategic level, providing them with: (1) a qualitative assessment of the city's current resilience level in the CC context; (2) better knowledge about urban CI sectors, their interdependency relationships and the chain of impacts due to cascading effects in the short, medium and in the long term and; (3) a set of policies that enhance city resilience.

Unexpected crises and risks affect the urban population. Critical infrastructure dependency, climate change and social dynamics have captured the attention of city decision makers across different disciplines, sectors, and scales. Addressing these challenges mandates an increase in resilience. This article presents the development of the novel European Resilience Management Guideline (ERMG) developed by the European H2020 Smart Mature Resilience (SMR) project. It encompasses five supporting tools for city resilience. The purpose of this article is threefold. First, it describes the extensive co-creation methods used to establish, validate and test the five ERMG tools as collaborations among seven city stakeholders and researchers in Europe. Second, it explains concisely the features of each tool and its use and applicability in the city resilience building process. Third, it shows how EMRG supports strategic management in encouraging the visibility of risk dependencies, identifying vicious loops and potential cascading effects, and promoting collaboration between stakeholders to share resources. The article concludes with a discussion of SMR standardization activities to support the transfer of these research results to wider audiences. It covers guidance on local resilience planning and supporting efforts in building and operationalizing resilience at the city level.

A growing majority of the world's population lives in cities. This rapid urbanization increases the concentration of people and critical services in cities, which also upscale their exposure to acute shocks and long-term stresses such as floods, earthquakes, climate change or social dynamics. While all of these challenges are complex in themselves, in most cases, cities must face a combination of them. Resilience thinking demands cities plan holistically so that they are prepared for whatever shocks and stresses may arise. Although there is a set of frameworks aimed at building city resilience, frameworks specifically aimed at operationalizing the resilience-building process within cities remain undeveloped. This research begins to fill this gap by developing a Resilience Maturity Model (RMM) that provides cities with a roadmap for operationalizing the resilience-building process. For that purpose, the RMM defines a sequence of maturity stages and a set of policies that help cities to assess their current maturity stage and identify the policies that need to be implemented to improve their resilience level.

Although the positive impact of cloud computing seems obvious for both big and small companies, the adoption rate of services associated with it has not reached the levels that were expected. In the case of software as a service (SaaS), the adoption rates of the different application types are not homogeneous. Some well-established application types, such as enterprise resource planning (ERP) software, have lower adoption rates as compared to other applications, such as customer relationship management (CRM) systems. Understanding the drivers of this phenomenon can help software companies design more successful SaaS applications. In this study, we present a framework that can help software companies evaluate the application-cloud fit, along with two strategies that enhance cloud application adoption.

Critical Infrastructures (Cls) play a relevant role in both society and industry since they provide ba sic goods a nd services. Cls are interependent on each other and a failure in one Cl may spread rapidly to other dependent Cls. The resulting cascading effect leads to the amplification of the perturbation, giving rise to high-impact crises. Modelling and simulation methodologies have been suggested as suitable tools to properly analyse and assess the effect and consequences of crisis in Cls. This paper undertakes a systematic literature review to study which modelling methodologies are the most appropriate for analysing Cls, depending both on the Cl sector and the scope of the modelling.

A resilience-focused approach requires the collaboration of a variety of stakeholders including the local government, emergency services, citizens, and companies in adapting to disasters. Currently however, governments fail to encourage stakeholders to take part in the resilience-building process. To address this challenge, this study presents a maturity model (MM) that provides local governments with a sequence of stages and policies to improve the collaboration with stakeholders. The MM was developed in close collaboration with six European cities and was put into practice through a case study in a UK city. The MM made it possible to assess the current stage of the city under study and to implement policies for engaging stakeholders in the resilience-building process. Finally, challenges associated with the involvement of stakeholders encountered in the city under study are discussed.

Recent efforts undertaken by international organizations and national governments to build cities' resilience illustrate the need to involve the different stakeholders of a city in the city resilience building process. Although there are studies that propose frameworks for building resilient cities, these studies do not provide detailed guidelines that include the sequential steps that local governments need to take to involve the different stakeholders in the city resilience building process. Given this gap, this paper presents a maturity model that provides an ideal sequence of maturity stages that can guide local government in how to involve the different city stakeholders in the city resilience building process. In addition, the maturity model provides a number of policies that local governments need to implement at each maturity stage in order to foster four principles (collaboration and networking, awareness and commitment, learning, and training and preparedness) that represent the foundation for involving stakeholders in the resilience building process. The maturity model was developed and validated as result of an iterative process that included semi-structured interviews with representatives from six different European cities

A resilience-focused approach leads organizations to improve the management of disasters through being aware, flexible, trained, and prepared, having committed top managers and staff, and being part of a wider network of stakeholders. Based on the organizational resilience principles identified in the literature, this article analyses the potential for improvement of the organizational resilience of disaster management organizations through their involvement in virtual communities of practice (VCoPs). VCoPs are groups of stakeholders from different organizations with a common interest that collaborate and exchange knowledge on a regular basis. This article presents a Delphi study that was conducted with a multidisciplinary group of international experts that work in disaster management organizations to evaluate the contribution of VCoPs. The results of the Delphi show that VCoPs help organizations to improve the organizational resilience principles. Nevertheless, there is still a series of barriers that organizations need to face in terms of collaboration and information sharing. This article classifies the existing barriers that hinder participation in VCoPs and suggests solutions to overcome them.

The welfare of society is more and more dependent on the proper functioning of Critical Infrastructures (CIs), and crises that affect CIs usually aggravate their impact on society. Therefore, improving the resilience of CIs is the most important objective of today's crisis managers. Although several resilience frameworks can be found in the literature, their implementation is still incipient and detailed prescriptions for their implementation are lacking. Moreover, some frameworks are only limited to describing the activities performed within the boundaries of the CI, neglecting the role of external agents. This research describes a practical and holistic resilience framework for improving the resilience of CIs taking into account the external agents. The framework is composed of three elements: a set of resilience policies; an influence table that assesses the influence of policies on prevention, absorption and recovery stages; and an implementation methodology that defines the temporal order in which the policies should be implemented. Two empirical studies were undertaken in two CIs to implement this framework. The studies show that the resilience framework helps CIs to diagnose their resilience level, detect areas of potential improvement and complement their risk management approach with a transversal approach to be better prepare to deal with crises. (C) 2015 Elsevier Inc. All rights reserved.

Building on lean and agile practices, DevOps means end-to-end automation in software development and delivery. Hardly anybody will be able to approach it with a cookbook-style approach, but most developers will benefit from better connecting the previously isolated silos of development and operations. Many DevOps tools exist that can help them do this.

Para mejorar la gestión de desastres naturales es necesario que los agentes involucrados analicen las experiencias pasadas, identifiquen buenas prácticas y documenten lecciones aprendidas. Sin embargo, actualmente los agentes todavía tienen que hacer frente a una serie de dificultades para intercambiar la información y el conocimiento adquirido con el resto de agentes involucrados. En primer lugar, el conocimiento se encuentra fragmentado entre la variedad de agentes procedentes de distintos niveles jerárquicos, culturas y organizaciones involucrados en la gestión de desastres. En segundo lugar, no hay un repositorio común que facilite el intercambio de información y conocimiento entre diferentes organizaciones. Además, hay que añadir la dificultad para compartir información de carácter sensible como informes sobre lecciones aprendidas y buenas prácticas que pueden presentar errores cometidos por las organizaciones en eventos pasados. Por último, existe un exceso de información sobre la gestión de desastres naturales que los agentes no son capaces de analizar. Este artículo presenta un caso de estudio sobre el proyecto europeo ELITE que tiene como objetivo mejorar el intercambio de información y conocimiento entre la comunidad de expertos europeos en la gestión de desastres naturales. Para ello, el proyecto ELITE ha formado una Comunidad de Práctica Virtual (CPV) que agrupa a 70 expertos multidisciplinares en la gestión de desastres naturales a nivel europeo.

Disasters are complex phenomena, by diverse nature and whose management is complicated. An efficient analysis of potential impacts that may result as consequence of a disaster has to be conducted to improve the preparation and response in face of future events

The proper functioning of critical infrastructures is crucial to societal well-being. However, critical infrastructures are not isolated, but instead are tightly coupled, creating a complex system of interconnected infrastructures. Dependencies between critical infrastructures can cause a failure to propagate from one critical infrastructure to other critical infrastructures, aggravating and prolonging the societal impact. For this reason, critical infrastructure operators must understand the complexity of critical infrastructures and the effects of critical infrastructure dependencies. However, a major problem is posed by the fact that detailed information about critical infrastructure dependencies is highly sensitive and is usually not publicly available. Moreover, except for a small number of holistic and dynamic research efforts, studies are limited to a few critical infrastructures and generally do not consider timedependent behavior. This paper analyzes how a failed critical infrastructure that cannot deliver products and services impacts other critical infrastructures, and how a critical infrastructure is affected when another critical infrastructure fails. The approach involves a holistic analysis involving multiple critical infrastructures while incorporating a dynamic perspective based on the time period that a critical infrastructure is non-operational and how the impacts evolve over time. This holistic approach, which draws on the results of a survey of critical infrastructure experts from several countries, is intended to assist critical infrastructure operators in preparing for future crises. (C) 2014 Elsevier B.V. All rights reserved.

Monitoring is critical to IT system health and thus to businesses' bottom line. This article discusses current tools that monitor networks to detect issues, ensure the components' availability, and measure the resources those components use

To choose the most appropriate cloud-computing model for your organization, you must analyze your IT infrastructure, usage, and needs. To help with this, this article describes cloud computing's current status.

Purpose This study aims to present a resilience framework for critical infrastructures (CIs) taking into account internal and external stakeholders involved in a crisis situation and covering the four resilience dimensions defined in the literature, as well as providing practical policies to facilitate their implementation in practice. Design/methodology/approach The research methodology consists of an iterative process in which different research methods such as group model building, multiple case study and Delphi method are applied to gather knowledge from experts in the field. Findings This study presents a holistic and easily applicable framework for CIs where: first, a list of resilience policies is defined and second, the influence of each resilience policy in the three resilience life-cycle stages is assessed. Originality/value This study overcomes three of the main limitations that current resilience building frameworks have: some of them only focus on one resilience dimension without covering the four resilience dimensions of resilience, most of them only focus on internal stakeholders without taking into account external stakeholders, and finally, most frameworks limit to describe the framework theoretically without explaining how it can be implemented in practice.

The safety and proper functioning of Critical Infrastructures (CIs) are essential for ensuring the welfare of society, which puts the issue of improving their resilience level at the forefront of the field of crisis management. Most of the resilience-building principles defined in the literature do not cover all the dimensions that make up resilience and most of them only focus within the boundaries of the CI, neglecting the role of the external agents that also have an influence on enhancing resilience. Furthermore, most of the principles that are present in the literature are theoretical and difficult to implement in practice. In light of this situation, the aim of this research is to present a holistic resilience framework for critical infrastructures in order to improve their resilience level by taking into account internal and external agents and covering all the resilience dimensions. Furthermore, this framework has been defined in close collaboration with the general management of CIs to facilitate its implementation in practice. Finally, in order to illustrate the value added of this framework it was implemented in a nuclear plant.

The dependency of society on the proper functioning of critical infrastructures (CIs) has been highlighted in recent natural disasters. CIs set up complex and interconnected systems and consequently a failure in one CI can spread to other dependent sectors. This represents a further complication in the response phase of a crisis, increasing the impact of natural disasters and seriously affecting the welfare of society. The aim of this paper is to illustrate the important role that CIs have on the propagation of the impact of a crisis. For that reason, a simulation model that represents the propagation, among interdependent CIs, of the effects of a storm on a region has been developed. This simulation model has a pedagogical purpose in which the effects of applying different crisis management policies can be simulated. This type of simulation models can represent different crisis scenarios. Therefore, simulation models can be used by managers allowing them to identify good practices and areas of improvement in face of future events.

While crises may appear to be event-driven, post-mortem accounts often identify factors that accumulate over time and increase the likelihood of failure. These factors are particularly difficult to anticipate when multiple organizations are involved in crisis preparation and event detection. Through the development of a systems-based model of crisis management, we learned that knowledge sharing can be accelerated or inhibited by the development of trust among organizations through the management of events. Is it possible to operationalize this finding? This hypothesis is being integrated into our current research in progress, a multi-national Community of Practice in disaster management.

Recientes desastres naturales han puesto de relieve la dependencia de la sociedad en el correcto funcionamiento de las infraestructuras críticas (ICs). Las ICs forman sistemas complejos e interconectados por lo que un fallo en una IC puede propagarse a otros sectores que dependan de ella. Ello supone una complicación añadida en la fase de respuesta de una crisis, aumentando el impacto y afectando seriamente al bienestar de la sociedad. El objetivo de este trabajo es ilustrar el importante papel que las interdependencias entre ICs tienen sobre el impacto global de una crisis causada por un desastre natural. Para ello, se ha desarrollado un modelo de simulación que representa los efectos de una fuerte tormenta sobre una isla con ICs interdependientes. El modelo de simulación desarrollado es un modelo de carácter pedagógico en el que se pueden simular los efectos de aplicar distintas políticas de gestión de crisis. Este tipo de modelos de simulación pueden representar escenarios de crisis diferentes por lo que pueden ser usados por gestores de crisis permitiéndoles identificar buenas prácticas y áreas de mejora ante futuros eventos. Palabras clave: Gestión de crisis, evaluación de impactos, infraestructura crítica, interdependencias, desastre natural.

Enterprise systems are quickly evolving from monolithic silos to distributed applications with service-oriented flexible usage schemes. To keep up, IT organizations must adapt their legacy systems to meet changing business challenges almost in real time, with no second chances. Service-oriented architectures (SOAs) have evolved to flexibly operate and federate business processes and underlying systems. Authors Nicolas Serrano, Josune Hernantes, and Gorka Gallardo provide an overview of current SOA technologies and how to evolve in legacy environments.

The proper functioning of critical infrastructures (CIs) is vital for society¿s welfare. A disruption in one of them may lead to a crisis that affects not only the CI where the triggering event occurs but also the whole society. Therefore, it is fundamental to increase the whole system¿s resilience level. This paper defines resilience as the capacity of a system to prevent a crisis occurrence, to reduce the consequences from failure, and to recover rapidly and efficiently. Although there is much information about the definition of resilience, literature still lacks to provide a detailed holistic prescription about what activities should be carried out to improve the resilience level of the CIs and the society as a whole. This paper defines twelve policies that help to enhance the resilience level of all the stakeholders involved in crisis management, using information gathered from experts and examining several case studies.

The severe consequences of a Critical Infrastructure (Cl) crisis demand continued research directed toward proactive and reactive management strategies. Despite the best efforts of governments and communities, the diversity of stakeholders, conflicting demands for resources, and a lack of trust among organizations create complexities that limit the effectiveness of the response. This paper identifies four specific problems that appear to reoccur when Us are challenged: heterogeneity, multiple and inconsistent boundaries, resilience building and knowledge transfer and sharing. A combination of collaborative modeling and software simulation methodologies is proposed in order to identify the interrelationships among diverse stakeholders when managing the preparation for and reaction to a Cl crisis. This approach allows experts to work together and share experiences through the modeling process which can lead them to a better understanding of how other organizations work and integrate different perspectives. In addition, simulation models enable domain experts to understand the consequences of certain policies in the short and long terms, thus improving the crisis managers' knowledge for future crisis situations. This paper presents a practical case of a hypothetical crisis in the Cl sector and the approach used in order to deal with the four problems identified above. (C) 2013 Elsevier Inc. All rights reserved.

With smartphones being the primary handheld device for more than a billion people, mobile Web apps are a necessity in both technical and commercial fields. There are several approaches to developing mobile Web apps, but given the fast speed of mobile software evolution, in which the leading companies become marginal in months and new gadgets continually appear, it's crucial to understand the basic technologies. Authors Nicola¿s Serrano, Josune Hernantes, and Gorka Gallardo examine current development approaches that can enhance the decision-making pro

A major industrial accident is an unpredictable event which triggers a disruption in a Critical Infrastructure (CI). This disruption can spread through other sectors, affecting not only the CI where the triggering event takes place but the whole society as well. In the case of major industrial accidents, system resilience consists of both the resilience of the CI (internal resilience) and resilience of society (external resilience). Resilience is the system¿s ability to reduce the probability of failure, the consequences from failure and the response and recovery time. However, little is known about how to achieve a high resilience level. In this paper, using the information gathered from experts and examining several major industrial accidents, we derive twelve policies that enhance the system¿s resilience level. The definitions of these policies are clarified through real case examples where the consequences of their use or lack of use are explained.

Resilience building has become one of the most promising strategies for crisis managers to improve the security and proper functioning of critical infrastructures (CIs). Therefore, crisis managers will benefit from both general and detailed guidance for building and maintaining CI resilience levels. This paper aims to contribute to this purpose by presenting a framework that helps crisis managers improve the resilience level of CIs based on internal and external aspects of the CI that are often overlooked. This framework proposes sixteen resilience policies that have been suggested as influential in developing resilience. The influence and relative effectiveness of each policy in promoting the resilience of the system is postulated. The framework was reviewed and validated through an expert panel and a Delphi process providing grounded support for the evaluation and prioritization of the resilience policies. The results show that internal policies are the most influential ones when avoiding a crisis occurrence and external policies are most helpful when bouncing back to the usual state.

Recent natural disasters have highlighted society¿s dependency on the correct functioning of critical infrastructures (CIs). The existing interdependencies among CIs complicate matters further, since a failure in a CI can spread through cascading effects to other infrastructures or sectors. Thus society's welfare becomes severely affected, complicating emergency response and increasing the total impact of natural disasters. The aim of this paper is to illustrate the important role that affected CIs have on the overall impact of a natural disaster. We have developed a simulation model that represents a huge storm affecting the energy system, transport and food CIs on a small island. Through this simulation model we can show the effects associated with CIs and the effects of applying crisis management policies.

Las crisis son fenómenos complejos, de diversa naturaleza, la mayoría de las veces inevitables y cuya gestión resulta muy complicada. Por ello, para facilitar el proceso de gestión, es necesario realizar un profundo análisis de los posibles impactos que puedan ser consecuencia de una crisis. En el presente artículo se procede a analizar las diversas metodologías para la clasificación de impactos que se utilizan actualmente para, posteriormente, hacer una crítica constructiva sobre las dificultades que en dichas clasificaciones se encuentran. Finalmente se describen una serie de recomendaciones para mejorar el proceso de clasificación de impactos en situaciones de crisis.

Large crises management, affecting CIs needs multidisciplinary knowledge including technical, economical, social, political, legal and managerial knowledge. Being these crises international a huge variety of agents is involved in their response. This situation concludes in a set of stakeholders who only have fragmented knowledge. In the presence of dispersed and incomplete knowledge, and of fragmented and disrupted crisis management, the collaborative approach group model building (GMB), where modelling experts unify fragmented, tacit knowledge from domain experts, is a valuable option. However, GMB has been little used in CIP. We have done so in the context a European project on crisis management of large-scale power cut crises. Particulars in CIP ¿ variety of time horizons, different national perspectives, and challenges to create an international approach, among others ¿ require adaptations in the GMB approach. This paper describes such adaptations and provides insights for better future collaborative modelling

Introducción: Los grandes accidentes industriales son eventos impredecibles que se desencadenan con una interrupción en una Infraestructura Crítica (IC). Esta perturbación se extiende posteriormente a varios sectores, afectando a la IC en la que la crisis comienza pero también a toda la sociedad. Resiliencia es la capacidad de una infraestructura o un sistema para reducir la probabilidad de fallo, las consecuencias del fallo y el tiempo de respuesta y recuperación. Sin embargo, se sabe poco acerca de cómo conseguir un nivel adecuado de resiliencia. Método: Mediante la revisión bibliográfica de grandes accidentes industriales y entrevistas con expertos en gestión de crisis se han definido dos tipos de resiliencia. Cada uno de ellos se divide en varias dimensiones. Además se han identificado políticas de mitigación para aumentar el nivel de resiliencia del sistema. Resultados: En el caso de grandes accidentes industriales, la resiliencia del sistema se divide en dos: la resiliencia de la IC (resiliencia interna) y la resiliencia de la sociedad (resiliencia externa). A su vez, se definen doce políticas de mitigación que ayudan a mejorar el nivel de resiliencia del sistema, tal y como se muestra en diferentes casos reales analizados.

Crisis is a wide concept which may include a diverse set of events and behaviour patterns. Thus, crisis management requires complementary approaches that provide a more complete perspective. This paper describes a useful methodology to analyse crises from a multiple perspective approach that contributes to acquire a more deep understanding about crises and their management. The first approach focuses on the peak of the crisis paying attention to how to respond to the crisis¿triggering event and to the cascading effects that amplify the crisis impact. The second approach adopts a long¿term perspective, identifying the relationship between the policies implemented on the pre¿crisis phase and the subsequent impacts on the crisis peak and post¿crisis phases. The third approach researches on the learning process from one crisis to the next one.

La mejora continua es un proceso dinámico y complejo, caracterizado por su dificultad de mantenimiento en el tiempo, ya que su implantación conlleva un cambio cultural en toda la empresa. En los programas de mejora continua, los equipos de mejora son un elemento muy importante, y el modo en que se desarrollen y evolucionen es determinante para el éxito del programa. Por este motivo, el objetivo de este trabajo de investigación es desarrollar un modelo de simulación que permita analizar el desarrollo de equipos de mejora. El modelo obtenido representa la evolución de estos equipos en distintas situaciones. Gracias al modelo se pueden entender mejor cómo funcionan los equipos de mejora y los factores más importantes que deben tenerse en cuenta a la hora de implantar nuevos proyectos; como el seguimiento de la Dirección, el reconocimiento a los equipos, la formalización del sistema, la asignación de recursos y los objetivos que se pretenden alcanzar. Al mismo tiempo, el modelo es una herramienta de formación para todos aquellos implicados en los equipos de mejora.