Search

Die vorliegende Forschungsarbeit beschäftigt sich mit der Erstellung eines praktikablen, auf Cybersecurity-Incidents ausgerichteten, Krisenmanagementmodells für Unternehmen. Kontext und Problemstellung In den letzten Jahren ist das Thema „Schäden für Unternehmen, die durch IT-gestützte Sicherheitsvorfälle (Cybersecurity-Incidents, kurz CSIs) entstehen“, zunehmend in den Fo-kus der Forschung gerückt. Zahlreiche Werke und Studien wurden zu dieser Thematik publiziert. Cybercrime ist für die Wirtschaft und Gesellschaft insbesondere dadurch beson-ders bedrohlich, dass CSIs schwer zu erkennen sind und aufgrund der inhärenten Komple-xität der miteinander kommunizierenden Systeme nur bedingt beherrschbar sind. Durch die gegenseitigen Abhängigkeiten der Systeme sowie die weltweite Vernetzung kann aus ei-nem CSI eine existenzbedrohende Situation für Unternehmen entstehen. Die Analyse des aktuellen Forschungsstandes zum Thema „Management CSI-basierter Krisen“ zeigt sehr deutlich, dass es derzeit keinen anwendbaren, international gültigen Krisenmanagement-standard gibt, der auf CSIs näher eingeht. Der wissenschaftlichen Literatur mangelt es sichtlich an CSI-spezifischen Krisenmanagementmodellen und -ansätzen. Dies ist insbe-sondere deshalb problematisch, weil durch die Digitalisierung und zunehmende Vernet-zung der IT-Systeme, die Anzahl an Cybersecurity-Incidents kontinuierlich ansteigt. Es be-steht die dringende Notwendigkeit eines Modells, das Unternehmen beim Aufbau eines auf CSIs ausgerichteten Krisenmanagements unterstützt. Theoretischer Teil In diesem Abschnitt der Forschungsarbeit wird das theoretische Grundgerüst für das zu entwickelnde, auf CSIs ausgerichtete Krisenmanagementmodell erörtert und es werden wichtige Termini, wie bspw. „Cybersecurity-Incidents“, definiert. Die verschiedenen Arten von Cybersecurity-Incidents, die derzeitigen und zukünftigen Entwicklungen im Bereich der Cybersecurity-Incidents sowie der Cyberattacken-Lebenszyklus, also die Phasen, die Cy-berkriminelle bei einer Cyberattacke durchlaufen, werden näher beschrieben. Hinsichtlich des Aufbaus des auf CSIs ausgerichteten Krisenmanagementmodells, wird das Prevention-Preparedness-Response-Recovery-Modell inklusive Aktivitätsbereiche vorgestellt. Weiters werden regulative Anforderungen aufgezeigt, die für das auf CSIs ausgerichtete Krisenma-nagement relevant sind. Entwicklung eines auf CSIs ausgerichteten Krisenmanagementmodells Dieser Abschnitt widmet sich dem entwickelten, auf CSIs ausgerichteten Krisenmanage-mentmodell. Hierbei werden die präventiven und reaktiven Krisenmanagementphasen, die Prozesse sowie der Mehrwert des erarbeiteten Modells dargelegt. Ergebnisse, Diskussion und Conclusio Im letzten Abschnitt wird die praktische Anwendbarkeit des entwickelten, auf CSIs ausge-richteten Krisenmanagementmodells anhand schriftlicher, leitfadengestützter Expertinnen- und Experteninterviews empirisch überprüft. Die erhobenen Daten werden mit der zusam-menfassenden, qualitativen Inhaltsanalyse nach Mayring (2010) ausgewertet. Die aus den Interviews resultierenden Ergebnisse werden zusammengefasst dargelegt. Danach werden die empirischen Ergebnisse diskutiert und mit theoretischen Erkenntnissen in Verbindung gesetzt. Abschließend wird ein Fazit gegeben und die durchgeführte Forschung kritisch reflektiert. Ein kurzer Forschungsausblick rundet die vorliegenden Masterarbeit ab. The present research project deals with the development of a practicable, CSI-oriented crisis management model for companies. Context and problem definition In recent years, the topic "damage to companies caused by IT-supported security incidents (cybersecurity incidents, or CSIs for short)" has increasingly moved into the research focus. Numerous works and studies have been published on this topic. Cybercrime is particularly threatening for the economy and society as CSIs are difficult to detect and can only be con-trolled to a limited extent due to the inherent complexity of the systems communicating with each other. Due to the mutual dependencies of the systems as well as the worldwide net-working, a CSI can lead to a situation threatening the existence of companies. The analysis of the current state of research on the topic of "Management of CSI-based crises" shows very clearly that there is currently no applicable, internationally valid crisis management standard that deals with CSIs in greater detail. The scientific literature obviously lacks CSI-specific crisis management models and approaches. This is particularly problematic as the number of cybersecurity incidents is continuously increasing due to digitalisation and grow-ing networking of IT systems. There is an urgent need for a model that supports companies in setting up CSI-oriented crisis management. Theoretical part In this section of the research work, the theoretical framework for the CSI-oriented crisis management model to be developed is discussed and important terms such as "cybersecu-rity incidents" are defined. The different types of cyber security incidents, the current and future developments in the field of cyber security incidents as well as the cyber attack life cycle, i.e. the phases that cyber criminals go through during a cyber attack, are described in more detail. With regard to the structure of the CSI-oriented crisis management model, the prevention-preparedness-response-recovery model including activity areas is present-ed. Furthermore, it is described what causes the need of companies for a CSI-oriented cri-sis management model. Development of a CSI-oriented crisis management model This section is dedicated to the developed CSI-oriented crisis management model. It de-scribes the preventive and reactive crisis management phases, the processes and the added value of the CSI-oriented crisis management model. Results, discussion and conclusion In the last section, the practical applicability of the developed CSI-oriented crisis manage-ment model is empirically tested through written guideline-based expert interviews. The collected data is then evaluated using the summarising, qualitative content analysis accord-ing to Mayring (2010). The results of the interviews are summarised and presented. The results are then linked to the developed CSI-oriented crisis management model and theory in form of a discussion. Finally, a conclusion is given and the realised research is critically reflected. A short research outlook completes the present master thesis. vorgelegt von: Matthias Dworschak Wien, FH Campus Wien, Masterarb., 2020

Hintergrund: Gesundheits- und Krankenpflegepersonen stellen neben den Ärtz*innen einen wesentlichen Teil der Gesundheitsversorgung der lokalen Bevölkerung sicher. Umso wichtiger ist es, dass das Krankenpflegepersonal im Falle eines Katastrophen- oder Großschadensereignisses vorbereitet ist. Ziel: Ziel dieser Arbeit ist es das Ausmaß der Einsatzkompetenzen sowie den aktuellen Wissensstand des gehobenen Gesundheits- und Krankenpflegepersonals bezüglich Katastrophenvorsorge zu erheben und darzustellen. Methode: Es wurde der quantitative Forschungsansatz mittels Fragebogen verwendet. Die Daten wurden mit dem IBM- Programm SPSS Version 25 ausgewertet. An dieser Studie nahmen 145 gehobene Gesundheits- und Krankenpflegepersonen teil, die im traumatologischen Schwerpunktbereich tätig sind. Ergebnisse: Es zeigt sich, dass beim Krankenpflegepersonal ein Rollenbewusstsein existiert. Ebenfalls ist eine positive Einstellung gegenüber dem Thema Katastrophenschutz verzeichnet werden. Jedoch konnte festgestellt werden, dass das bestehende Wissen teilweise im geringem Ausmaß eingesetzt werden kann. Diskussion: Nur durch Aus,- und Weiterbildungen können Pflegepersonen mit den Fähigkeiten ausgestattet werden, die sie benötigen, um in einer Krisensituation effektiv arbeiten zu können. Darüber hinaus müssen Möglichkeiten zur Teilnahme an Katastrophenschulungen und Übungen bestehen um das Selbstvertrauen der Pflegepersonen und die Vertrautheit bei der Reaktion auf Katastrophen zu verbessern. Background: Allied healthcare and nursing staff stand alongside doctors in looking after the healthcare needed of the local population. It is therefore important that nursing staff are well-prepared for catastrophes and mass incidents. Aim: The aim of this study was to determine and improve the practical skills and knowledge of nursing staff with regards to catastrophe management. Methods: Questionnaires were used as the research tool. The data was analysed using the programme IBM-SPSS version 25. 145 nursing staff showed and awareness of their roles. In addition, a positive attitude towards Crisis Resource Management was demonstrated. However, it was also shown showed that their existing knowledge could only partly be used to a limited extent. Conclusion: Only through further training can healthcare staff become adequately equipped to effectively work in a crisis situation. Future opportunities for crisis resource management training and practice will improve self-confidence and competence in managing catastrophes. Wien, FH Campus Wien, Masterarb., 2019

本稿では，戦後の災害対策の政策を，その前提となる政治，行政，国民の認識の変化を念頭に，防災関係の法令及び予算を概観し，次に危機管理研究の成果である危機の定義と危機の段階的把握を整理した上で，災害政策の傾向，すなわち災害政策が「防災」から「危機管理」へ変化，拡大されていく過程及びその意義を明らかにする。初めに戦後の我が国の災害を概観し，同時期の災害関係の法令と予算を検討する。次に災害政策を考える上で参考となる危機管理研究の成果である危機の定義と危機の段階的アプローチを整理する。最後に政治・行政の分野で災害対策が「防災」から「危機管理」へ拡大あるいは統合されていく過程を明らかにしその意義を考察する。, I try to clarify the following problems in this report. A postwar disaster policy of our country to change from "disaster prevention" to "crisis control" and the extended process and significance. I investigate what kind of influence a change of the political administrative recognition had on legislation and budget. I arrange "the definition of the crisis" that is the result of the crisis control study. Then I arrange "the graded grasp of the crisis" and confirm the tendency of the disaster policy.Firstly I survey the disaster that occurred in postwar our country. Then I examine disaster-related laws, ordinances and budget. Then I arrange "the definition of the crisis" and "the graded approach of the crisis" that is the result of the crisis control study to serve as a reference in thinking about a disaster-policy.Finally anti-disaster measures clarify expansion or a unified process from "disaster prevention" to "crisis management" politics in an administrative field.

As the above mentioned quotations underline, the current development of the European Union (EU) and the North Atlantic Treaty Organization (NATO) comprehensive approach is characterized by an open rivalry between both organizations. Both actors strive to be recognized as the favorite regional peacekeeper of the United Nations (UN). The EU points at its "uniqueness" as an actor gathering civilian and military capabilities whereas NATO emphasizes its highly efficient military might. The dynamics of EU/NATO relationship and the current competition between both organizations are closely linked to the evolution of the European security architecture. The end of the Cold War and the development of the European Security and Defence Policy (ESDP) have deeply affected the relations between EU and NATO.

У статті на основі систематизації досліджень виокремлено науково-методичні підходи до трактування антикризового управління. Визначено його основні принципи та функції, а також доведено необхідність активізації застосування превентивного антикризового управління. В статье на основе систематизации исследований выделены научно-методические подходы к трактованию антикризисного управления. Определены его основные принципы и функции, а также доказана необходимость активизации внедрения превентивного антикризисного управления. In the article scientific and methodical approaches to crisis-management interpretation were distinguished on the basis of systematization of researches. Its main principles and functions were defined, and the necessity of preventive crisis-management was proved.

У статті систематизовано науково-методичні підходи до співвідношення управління та антикризового менеджменту в діяльності суб’єктів господарювання. Доведено, що останній є окремим видом управління, зі своїми інструментами та об’єктами дослідження; авторами проведено порівняльний аналіз традиційного та антикризового менеджменту. В статье систематизированы научно-методологические подходы к соотношению управления и антикризисного менеджмента в деятельности субъектов хозяйствования. Доказано, что последний является отдельным видом управления, со своими инструментами и объектами исследования; авторами проведён сравнительный анализ традиционного и антикризисного менеджмента. Methodological approaches to correlation between crisis-management and traditional management in economic entities’ activity are systematized in the article. The fact that the latter one is individual kind of management with its own instruments and objects of research is proven; comparative analysis of crisis-management and traditional management is held by authors.

У статті систематизовано основні науково-методичні підходи до трактування сутності економічної кризи. Автором виокремлено основні етапи розвитку теорії економічних криз та антикризового менеджменту; доведено, що кризи є закономірною стадією розвитку будь-якої системи, які мають згладжуватися з допомогою інструментів антикризового управління з метою забезпечення стабільної діяльності суб’єктів господарювання. The basic scientific and methodological approaches to the interpretation of the nature of the economic crisis are systematized in the article. The author specifically mentioned the main stages of development of the theory of economic crises and crisis management; it is proved that the crisis is a natural stage of development of any system that have to be managed by using the tools of crisis management to ensure stable activity of business entities.

The war between Israel and Hezbollah in 2006 came to an end when both con- flict parties accepted the plan of reinforcing the United Nations Interim Force in Lebanon (UNIFIL) as a means to enable a ceasefire. In political as well as mili- tary terms, European nations were the driving force behind this UNIFIL 'enhancement' - marking a difficult return to the UN peacekeeping system since the debacles in the former Yugoslavia. This Egmont Paper explores both the political and military logic underlying the UNIFIL enhancement. On the basis of a detailed analysis of both the political decision-making process and the military planning cycle of the operation it develops two interlinked arguments. On the one hand, it argues that UNIFIL's operational strategy relies on its three- dimensional presence as a security buffer, as a mechanism for de-escalation and as an important actor in the local economy. On the other hand, it argues that friction between the political and military levels is at the root of persisting prob- lems in terms of information management, organisational structures and the conceptual foundations of operational planning. As such this Egmont Paper assesses the strategic rationale of the operation, which is shown to be limited, and accounts for a variety of practical problems that hamper an effective func- tioning of the operation. On the basis of this twofold argument, three main conclusions can be drawn. Firstly, the enhancement of UNIFIL showed that the UN peacekeeping system still constitutes a suitable platform for deploying European armed forces, but under two specific conditions. On the one hand, the question under which organisational flag troops are deployed was answered on a pragmatic basis. The UN framework in this case was chosen because the host nation insisted on it. The Lebanese government excluded the other options, whether NATO, ESDP or an ad hoc multinational coalition. On the other hand, the European troop con- tributors insisted on redesigning the organisational set-up for theoperation, both in terms of expanding oversight via the ad hoc established Strategic Mili- tary Cell as well as introducing their own approach to planning operations. Secondly, the inherent tension between intergovernmental political decision- making process and integrated military planning that is natural to any multina- tional operation was compounded by a mental gap between the UN political staff and the NATO trained military officers from European contributors. This mental gap boiled down to two competing views on how to manage operations. The UN approach was characterised by a much higher level of political sensitiv- ity - with obvious implications for information management e.g. - and a decentralised approach to operation management. The greater political unity amongst European troop contributors as well as the preference for more robust com- mand structures thus created a structural fault line in the mission set-up early on. Interestingly, the confrontation between both worlds proved to be a learning experience and tensions eased over time. Individual UN staffers came to see that military planning doctrine as standardised by NATO had something to offer in terms of making planning and management processes work smoothly. At the same time, European troop contributors rediscovered UN peacekeeping ten years after leaving it and found it could be made to work better than it had in the past. Thirdly, peacekeeping in a context such as Lebanon after the 2006 war is fraught with conceptual problems when it comes to operational planning doc- trine. The UN's approach to operations, which is procedurally flexible but chronically under-resourced, is very light on the content of operational plan- ning. There is no real peacekeeping doctrine spelling out the causal reasoning how the ambitious goals set out in the mandate can be achieved. Peacekeeping thus relies on a more programmatic approach to planning operations, bringing about conditions that hopefully lead in the right direction. If such hopes prove to beidle, the operation simply goes on in time and becomes part of the scenery. The NATO planning doctrine preferred by European troop contributors does give planners the conceptual toolkit for designing operations, but this concep- tual toolkit is only fully applicable to missions with powerful political mandates. Traditional planning concepts such as centre of gravity and end-state remain useful as an intellectual compass, but in a peacekeeping context they lead plan- ners to think far beyond their mandate. What can be made of the strategic effectiveness of the enhanced UNIFIL? The most straightforward effect was that the enhanced UNIFIL made the ceasefire on 14 August 2006 possible in the first place and contributed to maintaining it ever since. The three-dimensional strategic role outlined in this paper does give a coherent answer to how the operation can foster the intended effects. The enhanced UNIFIL in this sense does harness the use of armed forces for political ends. Yet it is equally true that such a strategy cannot achieve conflict resolution - it can only enable the sort of conditions that make renewed hostilities less likely. An operation with a limited political mandate can only achieve limited objectives. In that sense, the enhanced UNIFIL cannot be strategically decisive: it manages conflict on an interim basis, but does not make peace.