The concept of Network Based Defence and knowledge de-

The conceptual model of the transition from traditional operations to Network Based Defence is adapted from the article "Managing information security risks during new technology adoption" by Qian [7] and presented in figure13.

The transition to Network Based Defence is illustrated by two chains. One chain includes the transformation of "traditional operations" via "NbF in place" to "mature NbF". The other chain includes development of "traditional knowledge" into "new knowledge" and "mature knowledge". The two chains must follow each other to achieve the desired improvements. The operators therefore have to learn what to do (the new type of operations) and how to do it (new knowledge) in order to adopt new technology. Then they can use the new technology effectively and achieve the desired improvements.

To understand how the model translates to reality, the various variables and parameters can be described as follows:

• Developing NbFis a rate describing how fast Network Based Defence is devel-oped. To start the development, traditional operations must first be reviewed.

Desired changes must be identified and new type of operations must be doc-umented and transformed into user’s guides. Developing NbF is the process owner’s responsibility.

• Integrating NbF. In order to integrate NbF, the operators need to be famil-iar with what to do and remember the tasks. The operators are relying on the user’s guide developed previously. The actual rate describes how fast the operators are able to familiarize with the new type of operations.

• NbF in place. Even if NbF is in place, the operators are not familiar with the new type of operations, and old routines might appear unintentionally.

Continuous follow ups are therefore necessary, typically by colleagues or user manuals. "NbF in place" is a stock accumulating as more and more NbF is implemented. The stock is decreased when "NbF in place" matures.

NbF in place=(developing NbF - integrating NbF)

• Mature NbF. The NbF process is mature when the operators are familiar with new type of operations and can work independently. "Mature NbF" is a stock increasing when more NbF is integrated. The productivity is higher with ma-ture NbF than with NbF in place.

• Developing new knowledge is a rate describing how fast new knowledge is developed. The rate includes development of information material and ed-ucation related to Network Based Defence (NbF). This process is a typical management responsibility.

• Integrating new knowledgeis a rate describing how fast the operators learn

Figure 13: Conceptual model for the transition of Network Based Defence. Adapted from Qian [7]

how to use Network Based Defence. The rate includes how and why they should use the new type of operations. The operators are responsible for this rate.

• New knowledgeis a stock representing new knowledge when it is introduced together with Network Based Defence processes and technology. The opera-tors’ knowledge is not quit up to speed yet, and they are not able to utilize the new type of operations optimal due to misinterpreting or misunderstanding of information. Their productivity is therefore lower than wanted. The stock

"New knowledge" increases when new knowledge is developed and decreases when knowledge matures.

New knowledge = (developing new knowledge - integrating new knowledge)

• Mature knowledge is a stock describing knowledge when details related to NbF operations have become routine, and the desired productivity is achieved.

Mature knowledge increases when new knowledge is integrated.

• New initiatives burden traps transition to NbF. Because change is difficult, NbF in place and new knowledge are burden to people, slowing down the integration of NbF and development of new knowledge.

• A knowledge gapis generated, because knowledge maturation takes time. It is easier to understand what to do than how to do it. Acquiring new knowledge is necessary to understand how to accomplish a task effectively in accordance with Network Based Defence. When new type of operations is introduced, corresponding knowledge is desired, but the knowledge maturation takes time. A knowledge gap is introduced between desired mature knowledge and the actual mature knowledge. The knowledge gap drives vulnerability, and hence also frequency of incidents.

• Time to mature new type of operations. In ordinary workplaces, where the plat-form is continuously in use, several weeks are necessary to memorize what to do if new type of operations are in place. Operative military units work in a different manner, and employ the technical tactical platform only some weeks during a year, when the units are doing operative exercises. Without proper routines for repetition, the operators might need heavy guidance and follow ups to employ the platform properly next time. Time to mature might therefore take several months if not followed up properly. For simplicity, an estimate equal to 3 months is used, suggesting that exercises conducted dur-ing three months are sufficient.

• Time to mature new knowledge is more time demanding than implement-ing new technology, and productivity improvements can be measured for several years as the operators continuously are "learning by doing". In this project, practice through the exercises during three months are estimated to

Figure 14: Major causal loop diagram for transition of Network Based Defence adapted from Qian [6]

be enough time, to employ the platform sufficiently.