Allocation of Resources to Production= Pressure to do Work*(Resources to Security-Min Resources for Security)/Average Resources Allocation Delay Units: Resource/(Week*Week) The rate of resources being allocated to production. It depends on the pressure to do work and the resources for increasing security (which can not drop below its minimum value), and the allocation delay. Allocation of Resources to Security= Pressure to Increase Security*Effect of Work Pressure on Shortcuts*(Resources to Production -Min Resources for Production)/Average Resources Allocation Delay Units: Resource/(Week*Week) The rate of resources being allocated to increase security. The value depends on the pressure to increase security, the effect of shortcuts, minimal amount of resources devoted to production (that can never drop below its minimal value), and the allocation delay. Average Resources Allocation Delay= 1 Units: Week It takes some time to move people from one work mode to another. This value simulates the average delay which affects the transition of resources from increasing security to production or from production to security. Company Goal for Performance Gap Satisfaction= 25 Units: Unit/Week The company's goal to close performance gaps. Desired Performance= 150 Units: Unit/Week The desired performance of the organization. It might be a production goal appointed by managers or determined by customer orders. Effect of Security Level on Performance= TEoSLoP(Security Level/Min Security Level Req for Optim Performance) Units: 1 If the effect drops below 1, the optimal performance is jeopardized. We assume that the performance is dependent on security level. A very high security level can improve Performance, but only to a certain degree. Effect of Severity on Performance= TEoSoP(Severity of Incidents) Units: 1 The effect which determines the noticeable impact of the incident severity on the performance. Effect of Work Pressure on Shortcuts= TEoWPoS(Pressure to do Work) Units: 1 When faced with increasing demand for production, workers tend to take shortcuts in their work. The higher the pressure to do work, the more likely workers are taking shortcuts - they spare more time for production at the cost of security increase. Effectiveness of Resources for Production= 2 Units: Unit/Resource The average number of units a single resource is able to produce. Effectiveness of Resources for Security= 1 Units: 1/Resource The effectiveness of resources dedicated to security. FINAL TIME = 50 Units: Week The final time for the simulation. Incident= Incident Type*PULSE(5,1) Units: 1 The pulse that imitate an incident occurring. Incident Type= 0 Units: 1 [0,6,0.1] The type of incident. Ranges from 1 (insignificant incident) to 6 (catastrophic incident). 0 indicates there is not an incident. INITIAL TIME = 0 Units: Week The initial time for the simulation. Min Resources for Production= 0.5*Total Resources Units: Resource/Week The minimal amount of resources dedicated to production. Resources to production can never drop below this value. Min Resources for Security= 0.1*Total Resources Units: Resource/Week The minimal amount of resources dedicated to improving security. Resources to improve security can never drop below this value. Min Security Level Req for Optim Performance= 50 Units: 1 As the name states the minimum security level required for optimal performance. Can be perceived as maintaining firewalls or other software / devices preventing operations against casual threats and disruptions. If the security level drops below the minimum required level, optimal performance can not be achieved. Performance= Resources to Production*Effectiveness of Resources for Production*Effect of Security Level on Performance *Effect of Severity on Performance Units: Unit/Week The performance of the organization (can be measured as production of barrels per week). It depends on resources for production, the security level, the effect from incidents, and the effectiveness of resources for production. Performance Gap= MAX(Desired Performance-Performance,0) Units: Unit/Week The difference between desired and actual performance. If desired performance is greater than actual performance, a performance gap occurs. Pressure Allocation= 0.6 Units: 1 [0,1] Pressure allocation indicates the managerial decision regarding allocation of resources to improve security or to production. The value ranges from 0 to 1. The higher the value, the managers put more pressure towards production. Pressure to Close Performance Gap= Performance Gap/Company Goal for Performance Gap Satisfaction Units: 1 The pressure which arises in an organization once the performance gap (difference between desired and actual performance) exists. Pressure to do Work= Pressure to Close Performance Gap*Pressure Allocation Units: 1 The pressure in the organization towards production. Is affected by the pressure to close the performance gap and a managerial decision regarding pressure allocation. Pressure to Increase Security= Pressure to Close Performance Gap*(1-Pressure Allocation) Units: 1 The pressure in the organization to increase security. It depends on pressure to close performance gap and a managerial decision regarding pressure allocation. Resources to Production= INTEG ( Allocation of Resources to Production-Allocation of Resources to Security, Total Resources-Resources to Security) Units: Resource/Week Resources dedicated to production. Resources to Security= INTEG ( -Allocation of Resources to Production+Allocation of Resources to Security , 0.25*Total Resources) Units: Resource/Week Resources dedicated to improving security. SAVEPER = TIME STEP Units: Week [0,?] The frequency with which output is stored. Security Increase Delay= 2 Units: Week The time it takes to increase security Security Level= INTEG ( +Security Level Increase-Security Level Decrease, Effectiveness of Resources for Security*Resources to Security*Security Level Erosion Time ) Units: 1 The aggregated measure for technical, human and organizational security culture. The higher the security level the less damage are caused by various incidents. A metaphor of the security level - a shield, armor, bullet proof vest. One who wears the bulletproof vest can get hurt but the impact of the shot is mitigated. Security Level Decrease= Security Level/Security Level Erosion Time Units: 1/Week The rate at which security level deteriorates. Security Level Erosion Time= 2 Units: Week The time it takes for security to erode Security Level Increase= DELAY3(Effectiveness of Resources for Security*Resources to Security,Security Increase Delay ) Units: 1/Week The rate at which the security level is built. It is not an instant process and requires time, which is modeled as a third order delay. Severity of Incidents= MAX(Incident-Security Level/100, 0) Units: 1 The severity of an incident is affected by the security level in the organization. The severity of an incident is more efficiently mitigated the higher the security level is. TEoSLoP( [(0,0)-(2,1.5)],(0,0),(0.2,0.3),(0.4,0.55),(0.6,0.75),(0.8,0.9),(1,1),(1.2 ,1.08),(1.4,1.135),(1.6,1.175),(1.8,1.195),(2,1.2)) Units: 1 The table function for the effect of security level on performance. TEoSoP( [(0,0)-(10,1)],(0,1),(1,0.99),(2,0.97),(3,0.95),(4,0.9),(5,0.8),(6,0)) Units: 1 Table function for the effect of severity on performance. More severe incidents impair performance. In case of catastrophic incidents the performance can drop even to zero if there is not a sufficient level of security. TEoWPoS( [(0,0)-(1,1)],(0,1),(0.1,0.98),(0.2,0.95),(0.3,0.9),(0.4,0.8),(0.5,0.5),(0.6 ,0.2),(0.7,0.1),(0.8,0.05),(0.9,0.02),(1,0)) Units: 1 Table function for the effect of work pressure on shortcuts. TIME STEP = 0.1 Units: Week [0,?] The time step for the simulation. Total Resources= 100 Units: Resource/Week The total value of available resources in an organization.