Threats take many forms, and reasoning about them to make organisations more resilient remains challenging given their, often, qualitative nature. Many resilience management models and standards exist. They help enterprises recover from harmful incidents. No approach today examines views that contribute to resilience concerns from multiple perspectives. In this paper, I argue it is necessary to consider a much broader spectrum of threats and harms in order to better understand the complex dependencies and interactions between an enterprise ('self') and the environment ('world'). This paper adapts the Self-Discrepancy Theory from psychology to help establish and reason about multiple views of the enterprise: the actual, ideal and ought enterprise, as viewed by the self and others. The paper also explores how changes in priorities and operations might affect the self (again, as seen by the self and others). This framework does not compete with existing models and standards. Instead, the purpose is to complement them by exhaustively creating different perspectives (views) of enterprises with the aim to re-contextualise resilience concerns. By using this framework, risk-owners can start asking questions that are analogous to: “what would my opponent do in my shoes?” or, “if I change my enterprise's operations, what effect might this have on my security (or vice versa)?” Viewing enterprises and their resilience from different perspectives is an underexplored topic in research, and is a key motivator behind this article. This paper acts as a positional paper, and further studies will be necessary to provide empirical evidence that shows that this approach is feasible in real-world settings.
This paper is included in the program of DIGILIENCE 2019 and will be published in the post-conference volume.
}, year = {2019}, journal = {DIGILIENCE 2019}, month = {2-4 October}, address = {Sofia, Bulgaria}, language = {eng}, }