A Group Model Building Approach for Identifying Simulation Scenarios in Critical Infrastructure

Table-top and field simulation exercises are common tools for learning and practicing responses to unplanned IT security and critical infrastructure (CI) events. Preparing, executing and debriefing complex exercises are expensive and time consuming. Computer simulations can generate numerous potential scenarios and focus exercises on those that generate the most informative results. Credible scenarios must be based on a grounded causal structure that drives the dynamics of the crisis and response. As part of a project to examine a CI & IT crisis with cross-border effects we used Group Model Building (GMB) and system dynamics to develop plausible scenarios. Expert consensus was achieved about the crisis causal structure "driving" the event into a cross-border crisis. The model shows the negative effects of uncoordinated single country action on crisis perception and resource misallocation, in turn escalating crisis duration and severity. It is particularly severe if the crisis is exacerbated by ICT failures.