Emergent vulnerabilities in Integrated Operations: A proactive simulation study of economic risk

International Journal of Critical Infrastructure Protection

Volumn 2, Issue 3, 2009, Pages 110-123

  Rich, Eliot ^a   Gonzalez, Jose J ^b,c   Qian, Ying ^b   Sveen, Finn Olav ^b   Radianti, Jaziar ^b   Hillen, Stefanie ^b  

^a STATE UNIVERSITY OF NEW YORK   (United States)

^b UNIVERSITY OF AGDER   (Norway)

^c NORWEGIAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Norway)

Author keywords

Computer security; Oil and gas operations; Simulation

Indexed keywords

COMPUTER SECURITY; CRITICAL INFRASTRUCTURE; DATA-DRIVEN METHODS; DECISION SUPPORTS; ECONOMIC RISKS; EXPONENTIAL GROWTH; GROUP MODEL BUILDING; HISTORICAL DATA; INTEGRATED OPERATIONS; NEW TECHNOLOGIES; NUMERICAL RESULTS; OFFSHORE OIL OPERATION; OIL AND GAS OPERATIONS; OIL PRODUCTION; ON CURRENTS; PARAMETERIZED; PREDICTION AND FORECASTING; PROBLEM DOMAIN; SIMULATION; SIMULATION STUDIES; SIMULATION TECHNIQUE; SYSTEM DYNAMICS MODEL; TECHNOLOGY CHANGE; VULNERABILITY MITIGATION; WORK PRACTICES; WORK PROCESS;

DECISION SUPPORT SYSTEMS; MODEL BUILDINGS; RISK PERCEPTION; SECURITY SYSTEMS; SYSTEMS ANALYSIS;

SIMULATORS;

EID: 70149083461     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2009.07.002     Document Type: Article

References (53)

1. Norwegian Ministry of Petroleum and Industry (Det Kongelige Olje- og Energidepartementet), Oil and gas activities, Oslo, Norway, White Paper, Stortingsmelding, 38, 2002. Available at: http://odin.dep.no/filarkiv/159874/Sreportno38.pdf
2. Norwegian Ministry of Petroleum and Industry (Det Kongelige Olje- og Energidepartementet), Faktahefte om olje- og gassvirksomheten. Available at: http://odin.dep.no/oed/english/doc/reports/026031-120028/dok-bn.html
3. Norwegian Ministry of Petroleum and Industry (Det Kongelige Olje- og Energidepartementet), On the petroleum activity (Om Petroleumsvirksomheten), Oslo, Norway, White Paper, Stortingsmelding, 38, 2004. Available at: http://odin.dep.no/filarkiv/212963/Stmeld_38_2003-2004_Eng.pdf
4. Norwegian Oil Industry Association (Oljeindustriens Landsforening - OLF), Potential value of Integrated Operations on the Norwegian Shelf. Available at: http://www.olf.no/english/news/?32101.pdf
5. S.O. Johnsen, M.B. Line, A. Askildsen, Towards more secure virtual organizations by implementing a common scheme for incident response management, in: Eighth International Conference on Probabilistic Safety Assessment and Management, PSAM8, New Orleans, US, 2006
6. Norwegian Oil Industry Association (Oljeindustriens Landsforening - OLF), Integrated operations on the Norwegian Continental Shelf. Available at: http://www.olf.no/?22894.pdf
7. Norwegian Oil Industry Association (Oljeindustriens Landsforening - OLF), Integrated work processes: Future work processes on the Norwegian Continental Shelf. Available at: http://www.olf.no/io/arbprosesser/?28867.pdf
8. D. Firesmith, Engineering safety- and security-related requirements for software-intensive systems, in: Sixth International IEEE Conference on Commercial-off-the-Shelf (COTS)-Based Software Systems, ICCBSS'07, 2007
9. A. Sneddon, K. Mearns, R. Flin, R. Bryden, Safety and situation awareness in offshore crews, in: The Seventh SPE International Conference on Health, Safety, and Environment in Oil and Gas Exploration and Production, Alberta, Canada, 2004
10. Stoneburner G. Toward a unified security/safety model. IEEE Computer 39 August (2006) 96-97
11. Johnson C. Failure in Safety-Critical Systems: A Handbook of Incident and Accident Reporting (2003), Glasgow University Press, Glasgow, Scotland
12. Arbaugh W.A., Fithen W.L., and McHugh J. Windows of vulnerability: A case study analysis. IEEE Computer 33 (2000) 52-59
13. Henderson J., Wright K., and Brazier A. Human factor aspects of remote operation in process plants. Health and Safety Information (2002), Caerphilly
14. Reason J. Managing the Risks of Organizational Accidents (1997), Ashgate Publishing Ltd., Aldershot, Hants, UK
15. N.G. Leveson, Applying systems thinking to analyze and learn from events, in: NeTWorK 2008: Event Analysis and Learning from Events, Berlin, 2008
16. Rooney J.J., and Vanden Heuvel L.N. Root cause analysis for beginners. Quality Progress (July, 2004) 45-53. http://www.asq.org/pub/qualityprogress/past/0704/qp0704rooney.pdf Available at: http://www.asq.org/pub/qualityprogress/past/0704/qp0704rooney.pdf
17. Johnsen S., Ask R., and Roisli R. Reducing risk in oil and gas production operations. Critical Infrastructure Protection. IFIP International Federation for Information Processing vol. 253 (2007), Springer, Boston
18. Mürmann A., and Oktem U. The near-miss management of operational risk. Journal of Risk Finance 4 (2002) 25-36
19. Kjellén U. Prevention of Accidents Through Experience Feedback (2000), Taylor & Francis, London
20. Baskerville R.L., and Wood-Harper A.T. A critical perspective on action research as a method for information systems research. Journal of Information Technology 11 (1996) 235-246
21. Orlikowski W., and Baroudi J.J. Studying information technology in organizations: Research approaches and assumptions. Information Systems Research 2 (1991) 1-28
22. Vennix J.A.M. Group Model Building: Facilitating Team Learning Using System Dynamics (1996), John Wiley & Sons, Chicester
23. Luna-Reyes L.F., Martinez-Moyano I.J., Pardo T.A., Cresswell A.M., Andersen D.F., and Richardson G.P. Anatomy of a group model building intervention: Building dynamic theory from case study research. System Dynamics Review 22 (2006) 291-320
24. Vennix J.A.M. Group model building: Tackling messy problems. System Dynamics Review 15 Winter (1999) 379-401
25. Vennix J.A.M., Rouwette E.A.J.A., Richardson G.P., and Andersen D.F. Group model building: Problem structuring, policy simulation and decision support. European Journal of Operational Research 58 (2007)
26. Norwegian Ministry of Petroleum and Industry (Det Kongelige Olje- og Energidepartementet), Fact 2008 - The Norwegian petroleum sector, Oslo, Norway 2008. Available at: www.petrofacts.no
27. Andersen D.F., and Richardson G.P. Scripts for group model building. System Dynamics Review 13 Summer (1997) 107-129
28. Andersen D.F., Richardson G.P., and Vennix J.A.M. Group model building: Adding more science to the craft. System Dynamics Review 13 (1997) 187-201
29. Richardson G.P., and Pugh III A.J. Introduction to System Dynamics Modeling with DYNAMO (1981), MIT Press, Cambridge, MA
30. Forrester J.W. Industrial Dynamics (1961), MIT Press, Cambridge, MA
31. Sterman J.D. Business Dynamics: Systems Thinking and Modeling for a Complex World (2000), Irwin/McGraw-Hill, Boston
32. Rasmussen J. Risk management in a dynamic society: A modelling problem. Safety Science 27 (1997) 183-213
33. Leveson N.G. A new accident model for engineering safer systems. Safety Science 42 April (2004)
34. Leveson N.G. A systems-theoretic approach to safety in software-intensive systems. IEEE Transactions on dependable and secure computing 1 January (2004) 66-86
35. D.F. Andersen, D. Cappelli, J.J. Gonzalez, M. Mojtahedzadeh, A. Moore, E. Rich, J.M. Sarriegui, T.J. Shimeall, J. Stanton, E.A. Weaver, A. Zagonel, Preliminary system dynamics maps of the insider cyber-threat problem, in: the 22nd International Conference of the System Dynamics Society, Oxford, UK, 2004
36. Conrad S.H., LeClaire R.J., O'Reilly G.P., and Uzunalioglu H. Critical national infrastructure reliability modeling and analysis. Bell Labs Technical Journal 11 Fall (2006) 57-71
37. Band S.R., Cappelli D.M., Fischer L.F., Moore A.P., Shaw E.D., and Trzeciak R.F. Comparing Insider IT Sabotage and Espionage: A Model-based Analysis (2006), Software Engineering Institute, Pittsburgh, PA
38. D.M. Cappelli, A.G. Desai, A.P. Moore, T.J. Shimeall, E.A. Weaver, B.J. Willke, Management and education of the risk of insider threat (MERIT): System dynamics modeling of computer system sabotage, in: 25th International System Dynamics Conference, Boston, MA, 2007
39. A. Borshchev, A. Filippov, From system dynamics and discrete event to practical agent based modeling: Reasons, techniques, tools, in: Proceedings of the International System Dynamics Society, Boston, MA, 2005
40. Dalkey N., and Helmer O. An experimental application of the Delphi method to the use of experts. Management Science 9 (1963) 458-467
41. Checkland P., and Scholes J. Soft Systems Methodology in Action: A 30-year Retrospective (1999), Wiley, Chichester
42. Rowe G., and Wright G. The Delphi technique as a forecasting tool: Issues and analysis. International Journal of Forecasting 15 (1999) 353-375
43. Barlas Y. Formal aspects of model validity and validation in system dynamics. System Dynamics Review 12 (1996) 183-210
44. Forrester J.W., and Senge P.M. Tests for building confidence in system dynamics models. TIMS Studies in the Management Sciences 14 (1980) 209-228
45. Eden C., Ackermann F., Bryson J.M., Richardson G.P., Andersen D.F., and Finn C.B. Integrating modes of policy analysis and strategic management practice: Requisite elements and dilemmas. Journal of the Operational Research Society 60 (2008) 2-13
46. United Kingdom Offshore Operators Association, Piper Alpha - A History. Available at: http://www.ukooa.co.uk/issues/piperalpha/index.htm
47. Richardson G.P. System dynamics. In: Gass S., and Harris C.M. (Eds). Encyclopedia of Operations Research and Management Science. 2nd edition (2001), Kluwer Academic Publishers, Boston
48. Barlas Y. Multiple tests for validation of system dynamics type of simulation models. European Journal of Operations Research 42 (1989) 59-87
49. Integrated operations - Trondheim. Digital Energy Journal November-December (2007) 20-26
50. M.G. Jaatun, S.O. Johnson, M.B. Line, O.H. Longva, I.A. Tøndel, A. Albrechtsen, I. Wærø, Incident Response Management in the oil and gas industry, SINTEF, Trondheim December 17 2007
51. Stanhope N., Crowley-Murphy M., Vincent C., O'Connor A.M., and Taylor-Adams S.E. An evaluation of adverse incident reporting. Journal of Evaluation in Clinical Practice 5 (1999)
52. Sveen F.O., Sarriegi J.M., Rich E., and Gonzalez J.J. Toward viable information security reporting systems. Information Management & Computer Security 15 (2007) 408-419 Available at: doi:10.1108/09685220710831143
53. J. Wiik, J.J. Gonzalez, P.I. Davidsen, K.-P. Kossakowski, Chronic workload problems in CSIRTs, in: 27th International Conference of the System Dynamics Society, Albuquerque, NM, USA, 2009