Air Force Institute of TechnologyAFIT Scholar

Theses and Dissertations Student Graduate Works

3-24-2016

Cyberspace and Organizational Structure: AnAnalysis of the Critical Infrastructure EnvironmentMichael D. Quigg II

Follow this and additional works at: https://scholar.afit.edu/etd

Part of the Information Security Commons

This Thesis is brought to you for free and open access by the Student Graduate Works at AFIT Scholar. It has been accepted for inclusion in Theses andDissertations by an authorized administrator of AFIT Scholar. For more information, please contact richard.mansfield@afit.edu.

Recommended CitationQuigg, Michael D. II, "Cyberspace and Organizational Structure: An Analysis of the Critical Infrastructure Environment" (2016).Theses and Dissertations. 409.https://scholar.afit.edu/etd/409

CYBERSPACEANDORGANIZATIONALSTRUCTURE:

ANANALYSISOFTHECRITICALINFRASTRUCTUREENVIRONMENT

THESIS

MichaelD.QuiggII,Captain,USA

AFIT‐ENV‐MS‐16‐M‐177

DEPARTMENT OF THE AIR FORCE AIR UNIVERSITY

AIRFORCEINSTITUTEOFTECHNOLOGY

Wright-Patterson Air Force Base, Ohio

DISTRIBUTIONSTATEMENTA.APPROVEDFORPUBLICRELEASE;DISTRIBUTIONUNLIMITED.

TheviewsexpressedinthisthesisarethoseoftheauthoranddonotreflecttheofficialpolicyorpositionoftheUnitedStatesAirForce,UnitedStatesArmy,DepartmentofDefense,ortheUnitedStatesGovernment.ThismaterialisdeclaredaworkoftheUnitedStatesGovernmentandisnotsubjecttocopyrightprotectionintheUnitedStates.

AFIT-ENV-MS-16-M-177

CYBERSPACEANDORGANIZATIONALSTRUCTURE:

ANANALYSISOFTHECRITICALINFRASTRUCTUREENVIRONMENT

THESIS

PresentedtotheFaculty

DepartmentofSystemsEngineeringandManagement

GraduateSchoolofEngineeringandManagement

AirForceInstituteofTechnology

AirUniversity

AirEducationandTrainingCommand

InPartialFulfillmentoftheRequirementsforthe

DegreeofMasterofScienceinEngineeringManagement

MichaelD.QuiggII,BBA

Captain,USA

March2016

DISTRIBUTIONSTATEMENTA.APPROVEDFORPUBLICRELEASE;DISTRIBUTIONUNLIMITED.

AFIT-ENV-MS-16-M-177

CYBERSPACEANDORGANIZATIONALSTRUCTURE:

ANANALYSISOFTHECRITICALINFRASTRUCTUREENVIRONMENT

MichaelD.QuiggII,BBA

Captain,USA

CommitteeMembership:

LTCMasonRice,PhDChair

MichaelR.Grimaila,PhD,CISM,CISSPMember

MajBenjaminRamsey,PhDMember

AFIT-ENV-MS-16-M-177

iv

Abstract

Nowmorethanever,organizationsarebeingcreatedtoprotectthe

cyberspaceenvironment.Thecapabilityofcyberorganizationstaskedtodefend

criticalinfrastructurehasbeencalledintoquestionbynumerouscybersecurity

experts.Organizationaltheorystatesthatorganizationsshouldbeconstructedtofit

theiroperatingenvironmentproperly.Littleresearchinthisarealinks existing

organizationaltheorytocyberorganizationalstructure.Becauseofthecyberspace

connectiontocriticalinfrastructureassets,thefactorsthatinfluencethestructureof

cyberorganizationsdesignedtoprotecttheseassetswarrantanalysistoidentify

opportunitiesforimprovement.

Thisthesisanalyzesthecyber‐connectedcriticalinfrastructureenvironment

usingthedominantorganizationalstructuretheories.Byusingmultiplecasestudy

andcontentanalysis,2,856samplingunitsareanalyzedtoascertainthelevelof

perceiveduncertaintyintheenvironment(complexity,dynamism,and

munificence).Theresultsindicatethatthegeneralexternalenvironmentofcyber

organizationstaskedtoprotectcriticalinfrastructureishighlyuncertainthereby

meritingimplementationoforganicstructuringprinciples.

AFIT-ENV-MS-16-M-177

v

TomySaviorJesusChrist,thesourceofeverythinggoodinmylife;momanddad;my

wifeformodelingChrist’slovewhileraisingthegirls.

vi

Acknowledgments

IwouldliketothankLTCMasonRiceforjoyfullyacceptingmeasaresearch

pupilandforguidingmewithpassion,creativity,andkindness;JuanLopezforbeing

thepersonificationofmentorship,professionalism,andexcellenceduringmy

research;Dr.Grimailaforyourwisdomthroughoutandfornurturinganideaintoa

thesis;Dr.Ramseyforthetime,attention,andlevelofdetailyougavetomakingthis

aworkIcantrulytakejoyin.IamalsoindebtedtotheDepartmentofHomeland

Securityforfundingthisresearch.

Finally,thankyoutoMAJDerekYoung,StephenDunlap,andCPTJungsang

Yoonforyourincredibleselflessnessinsupportofthisresearch.

MichaelD.QuiggII

vii

TableofContents

Page

Abstract.........................................................................................................................................................iv

Acknowledgments....................................................................................................................................vi

TableofContents......................................................................................................................................vii

ListofFigures.............................................................................................................................................ix

ListofTables................................................................................................................................................x

I.Introduction.............................................................................................................................................1

OperationalMotivation......................................................................................................................1ResearchQuestions.............................................................................................................................3Methodology...........................................................................................................................................3Limitations..............................................................................................................................................4Implications............................................................................................................................................4

II.LiteratureReview................................................................................................................................6

StructuringOrganizations................................................................................................................6OrganizationalStructureTheory...................................................................................................7InstitutionalTheory..........................................................................................................................8ResourceDependenceTheory.......................................................................................................8PopulationEcologyTheory............................................................................................................9StructuralContingencyTheory..................................................................................................10

Contingencies......................................................................................................................................10Technology..........................................................................................................................................11Size…......................................................................................................................................................11StrategyandStrategicChoice....................................................................................................12Environment.......................................................................................................................................12

EnvironmentalUncertainty..........................................................................................................13Complexity...........................................................................................................................................14Dynamism(Turbulence)...............................................................................................................14Munificence(Resource).................................................................................................................14

Structures.............................................................................................................................................15MechanisticandOrganicinPractice.........................................................................................16MechanisticOrganization:U.S.Army......................................................................................16CreatingMechanisticOrganizations.......................................................................................18OrganicOrganizations:ApacheIndians,AnonymousandAlQaeda.........................21CreatingOrganicOrganizations................................................................................................23

viii

StructureandEnvironmentalUncertaintySynthesis........................................................25

III.Methodology......................................................................................................................................26

ResearchDesignandMethodology...........................................................................................26DataCollection....................................................................................................................................26ArtifactDiscrimination..................................................................................................................27OrganizationalDiversity...............................................................................................................29

Coding.....................................................................................................................................................29ContentCategories...........................................................................................................................30CoderTraining...................................................................................................................................32

DataReduction...................................................................................................................................32Validity...................................................................................................................................................33Reliability..............................................................................................................................................33

IV.AnalysisandResults.......................................................................................................................34

DescriptiveStatistics.......................................................................................................................34IntercoderAgreement.....................................................................................................................35CodeDistribution..............................................................................................................................36StrataAnalysis....................................................................................................................................38Complexity...........................................................................................................................................38Dynamism............................................................................................................................................38Munificence.........................................................................................................................................39

CoderAnalysis....................................................................................................................................40RecommendationsforAction......................................................................................................40

V.Conclusions..........................................................................................................................................42

ConclusionsofResearch.................................................................................................................42RecommendationsforFutureResearch..................................................................................44MeasureGovernmentCyberOrganizations..........................................................................44ReplicatetheStudy..........................................................................................................................44IdentifyDominantFactorsforMunificence..........................................................................44

AppendixA.ArtifactFinalSelection(FrontPageInformation).........................................45

AppendixB.ArtifactsMeetingSelectionCriteria.....................................................................65

AppendixC.RecordingUnitClassificationDiagram...............................................................67

AppendixD.CodedArtifactExample............................................................................................68

AppendixE.CoderTrainingBriefing.............................................................................................71

Bibliography..............................................................................................................................................87 

Page

ix

ListofFigures

Figure Page

1.TheExternalEnvironmentandUncertainty........................................................................15

2.ArmyForceDevelopmentProcess(AR71‐32)[56]...........................................................19

3.ProcessMapforCreatingArmyOrganizations....................................................................20

4.ApacheStructuralDepiction........................................................................................................24

5:OrganizationalStructure,UncertaintyandtheExternalEnvironment.....................25

6.MaxqdaGraphicalUserInterface...............................................................................................30

7.UncertaintyintheGeneralExternalEnvironment.............................................................37

8.PercentageofUncertaintybyDimensionandStrata.........................................................38

9.CoderOverlap.....................................................................................................................................40

x

ListofTables

Table Page

1.StructuralDimensionsofOrganizations....................................................................................7

2.CharacteristicsofMechanisticandOrganicStructures....................................................16

3.U.S.ArmyInfantryDivisionStructure......................................................................................17

4.ApacheIndians,AnonymousHackerGroupandAlQaedaStructures.......................22

5.StructuralFactorsPresentinCreatingOrganicOrganizations.....................................23

6.ArtifactCriteria..................................................................................................................................28

7.ArtifactRetrievalResults...............................................................................................................28

8.CodeCategoryDefinitions.............................................................................................................31

9.TotalCodesbyCoder.......................................................................................................................34

10.PagesCodedbyStrata..................................................................................................................34

11.Flesch‐KincaidReadingScores.................................................................................................35

12.CohensKappa...................................................................................................................................36

13.FrequencyAnalysisofCodes.....................................................................................................37

1

CYBERSPACEANDORGANIZATIONALSTRUCTURE:

ANANALYSISOFTHECRITICALINFRASTRUCTUREENVIRONMENT

I.Introduction

OperationalMotivation

InhisbookBlink,Gladwell[27]describestheabilitytorenderaccurate

expertjudgmentinsituations(e.g.,detectingfraudulentartordiagnosingamedical

condition)quicklywithoutcollectingandanalyzingmassamountsofdata.Experts

incybersecurity,usingtechniquesdescribedbyGladwell,havedeclaredthat

governmentsarenotpreparedtorespondtocyber‐attacks[5,10,13,36].These

experts,understandingcriticalinfrastructurecybersecurity,inherentlyknowthat

responseorganizationscurrentlyinplaceareill‐fittohandleacrisisthatmaybe

rightaroundthecorner.

Theorganizationsthataresupposedtodefendagainstthesethreats(e.g.,

DepartmentofHomelandSecurityandU.S.CyberCommand)maynotbeableto

resistorrecoverfromapersistentcyber‐attack[36,59].Thissituationis

particularlytroublingbecausetheNationalSecurityAgency’sDirectorstatedthat

severalcountries,includingChinaandRussia,havethecybercapabilitiestodisrupt

electricalutilitiesthroughouttheUnitedStates[53].Withoutnecessarilyanalyzing

thecyberoperatingenvironment,expertsfullyunderstandthegovernmentis

modelingcurrentcyberdefenseorganizationsafterpracticallyeveryother

2

governmentorganization(e.g.,rigid,slowtochange,andhierarchical).Perhapsthe

issuestheseorganizationsfacearefoundational.

AsColquitt,LepineandWessonstate,almosteverythinginorganizational

behaviorstartswithstructure[16].Ifsecurityandresilienceincyberspacearea

goal,thenananalysisofstructureshouldbeaninitialprimaryconsideration.

Thestudyoforganizationalstructureislargelyadisciplinewithinthesocial

sciencesandchampionedbyorganizationalstructuretheorists.Overthelastfifty

years,thisareaofresearchhasgrownconsiderably.Recenttheoryhasadvanced

significantlyfromthedivisionoflaboranalyzedbyAdamSmithandMaxWeber.It

appearsthatoncestablesystemsarenowrapidlyrestructuringinuncertain

emergentglobalmarkets,markedbyrapidtechnologicalchangeandtremendous

competition.

PersonalobservationswhileassignedtotheheadquartersstaffforanArmy

organizationtaskedwithcreatinganewcyberunitwereenlightening.Numerous

leadersworkedfuriouslytofindoutthebestwaytoaccomplishthetask.Timewas

limited.Thepressuretobereadytodefendthenetworkwasgreat.Attackson

militarynetworksweregrowingbytheday.Thissituationdidnotallowforslow

anddeliberatetheoreticalanalysis.Rather,itcreatedacyber‐organizationsolution

whosefutureeffectivenesswasinquestion.

Situationslikethisonearehappeningeverywherethereisaneedtodefend

criticalcyberassets.Theurgencyofthecircumstancecreatestheneedfor

3

immediateaction.Thepervasivenessofinformationtechnologyandsocieties

increasingdependenceoncyberisnotlikelytoresolvequickly.Indeedacoupleof

decadesagoIlinitch,D’AveniandLewinclaimedaboutthisnewenvironment,

“Althoughnumerousorganizationsarebeingcreated,fewareexaminingthe

organizationalresearchandmanyareexperimentingwithdisaster”[32].Thisthesis

seekstofillthegapintheliteraturetoaddressthiscriticalissue.

ResearchQuestions

Thisthesisanalyzesrelevantorganizationalstructuretheoryandits

connectiontocyberorganizationstoanswerthefollowingresearchquestions:

1. Whatisorganizationalstructure?

2. Whattheoriescontributetoorganizationalstructure?

3. Howshouldorganizationsstructureincyberenvironments?

Methodology

Theresearchapproachisqualitative,pragmatic,andexploratoryinnature,

usingmultiplecasestudyandcontentanalysis.Theenvironmentofcyber‐connected

criticalinfrastructure,definedascriticalinfrastructurethatconnectstocyberspace

(primarilytheinternet),willbeevaluatedfromtheperspectiveoftheacademic,

governmentalandprivate/practitionercommunities.Documentsprovidethe

informationforanalysis.Contentanalysiscategorizesandquantifiesthelevelof

uncertaintyintheenvironment.

4

Limitations

Limitationsrangedfromsoftwarefunctionalitytomethodselection.

Significantsoftwarelimitationsincludedthelackofflexibilityinsoftware

modification,anduserlicensesrequiringeachcodertohavetheircopyofthe

software.Theresearcherlimitedthecasestothecyber‐connectedcritical

infrastructureenvironment(thoughthenatureofcybercloselylinksthisresearch

withothercyberenvironments),andthesearchenginestoeightsources.

Documentation,providedbythesearchenginesforthedataset,were(insome

cases)limited;notallinformationonthecyber‐connectedcriticalinfrastructure

environmentisavailableandsomerequiredsubscriptions.Theavailabilityof

personnelwithknowledgeofthephenomena,theappropriatereadinglevel,and

codingexpertisewaslimited.Humancodingsufferednaturallimitationsfromthe

ambiguityofwordmeaningtofatigue.Themultiplecasestudyapproachwith

multiplestratawasusedtoovercomedatatriangulation(multipledatacollection

techniques,e.g.,surveys,interviews).Thisresearchusedappropriatetechniquesto

mitigatetheselimitationsandothers(e.g.,rest,training)

Implications

Theorydictatesthatorganizationsshouldstructuretofittheiroperating

environment.Theinsightsofthisanalysisshouldhelpstrategiccyberleaders,

particularlythosetaskedtoprotectcriticalinfrastructure,understandcritical

5

aspectsoftheenvironment.Theconnectionsmadebetweenstructureand

environmentwillaidinstructuringmoreeffectivecyberresponseorganizations.

6

II.LiteratureReview

StructuringOrganizations

Whendiscussingorganizationalstructure,itishelpfultodefinethemeaning

of“organizationalstructure.”Manypeople,whenhearingorganizationalstructure,

willconjureupapictureofanorganizationalchartofsomesort.However,

organizationalstructureencompassesfarmorethanachart.Organizational

structurecommonlybreaksintotwodimensions:structuralandcontextual[17,50].

Thesedimensionshelpexplaintheformsorganizationstakeandwhytheytake

them.Thestructuraldimensionsincludehoworganizationsattempttocontrol

behaviorandcompletetasks.Contextualdimensions,oftencalledcontingencies,are

forcesactingwithinandoutsidetheorganization,whichaffectthestructural

dimensions.Table1displayssomeofthesignificantstructuralandcontextual

dimensions.

7

Table1.StructuralDimensionsofOrganizations

Type Dimensions TraitsStructural Specialization;centralization;

formalization;spanofcontrol;chainofcommand;personalspecialty.

Howmanytasksina job;whohastheauthority tomakedecisionsandwhere;howstandardizedandexplicitaretherules,policiesandprocedures;howmanypeoplearesupervised inaparticulargroup;whoreportstowhomupthehierarchy;whatiseveryonerequiredtoknow.

Contextual Size;strategy;culture;externalandinternalenvironment(competition,hostility,geography);technology.

Whatsizeistheorganizationanditssubunits;whatchoicesarebeingmadebyleadership;perceivedvaluesandbeliefs;whatishappeninginandaroundtheorganizationwhichcanaffectit;thepresenceandeffectsoftechnology.

Thisthesiswillexplorethesedimensionstodeterminetheirimplicationfor

structuringorganizationstooperateincyberspace.Whatfollowsisareviewofthe

dominanttheoreticalprinciples.

OrganizationalStructureTheory

Thestudyoftheexistenceoforganizationsandhowtosustainthatexistence

hasincreaseddramaticallyinthelast75years[49].Theriseandubiquitousnature

ofinformationtechnologyanditseffectsonorganizationalstructuretheoryinthe

socialscienceshaveledtoproportionatelyrapidtheorydevelopment[45].Few

couldforeseetheuniversalityandimportanceoftechnologicalsystems.Thefour

8

dominant,historicaltheoriesonorganizationalstructureare(i)institutional,(ii)

resourcedependence,(iii)populationecology,and(iv)structuralcontingency.

InstitutionalTheory.

DimaggioandPowellintroducedinstitutionaltheory(orinstitutional

isomorphism)in1983.Thecruxofthistheorycanbesummeduprathersimply–

organizationstendtomimiceachother[20].DimaggioandPowellpointtothree

maintypesofisomorphism,whicharecoercive,mimeticandnormative.Coercion

explainshoworganizationsoftenresultinsimilarstructuresbecauseofsimilar

externalenvironmentalpressures(e.g.,governmentoversight).Mimeticexplains

howorganizationsinestablishedfieldstendtomimiceachotherasabulwark

againstuncertainty.Normativeisomorphicprocessesresultfromthe

professionalizationofafieldaccompaniedbycommontraining,standardsand

practices,whichcreatehomogeneity[20].Itisimportanttonote,thatinthecyber‐

connectedcriticalinfrastructureenvironment,institutionalisomorphismmaynot

behelpful.ObservationofgovernmentcyberstructuringintheU.S.Departmentof

Defenseindicatesthepresenceofisomorphism.Forexample,newlycreatedcyber

forcescloselyresembletraditionalmilitaryforces,eventhoughtherearecritical

differencesintheenvironmentsofeach.

ResourceDependenceTheory.

Resourcedependencetheoryarguesorganizationalsurvivalbeabout

acquiringandmaintainingresources[49].Thereisconsiderableoverlapbetween

9

resourcedependenceandpopulationecology.However,thereareseveral

deviations;someexamplesareintherolesofinformationprocessingandstrategic

choice.Populationecologyarguesthat,givencertainconditions,strategicchoiceis

possible.However,mostorganizationsareoftenpowerlesstochoosebecauseof

inter‐organizationaldependenciesandinformationprocessingissues[1].Resource

dependencecountersbyofferingthatinformationsystemsdetermineorganizational

choiceandprovidecriticalinformation[49].Understandingwhatconstitutesa

resourceincyberisdifficult.However,somegeneralexamplesincludemoneyand

people.

PopulationEcologyTheory.

Populationecologyoffersexplanationsbasedonthenaturalselectionmodel.

AldrichandPfefferargueintheEnvironmentofOrganizationsthatorganizations

changebecauseofthedistributionofresourcesintheorganization’senvironment

[3].Theenvironmentselectstheorganizationalform,whichdemandsaconstant

senseofadaptation.Thelistofoncesuccessfulorganizationsthatdidnotadaptto

theenvironmentandquicklyfoundthemselvesobsoleteislong.Governmentcyber

organizationscanillaffordtobeapartofthisgroup.Aconsistentthemeis

developinginthealignmentoftheenvironmentandtheorganization.Structural

adaptationandflexiblestructuringinhighinformationtechnologyindustriesare

nowprominent.

10

StructuralContingencyTheory.

Thistheoryoffersapotentialsynthesisofideasrepresentedinthetheories

above.Structuralcontingencytheorydeclaresthemosteffectiveorganizational

structureistheonewhichbest“fits”thecontingencies[22].Inherentinthis

definitionisthatstructureshouldbetailored.Donaldson[23]statesthatcertain

factorsinfluencestructure.Thesefactors(knownascontingencyfactors)include

technology,size,strategyandtheenvironment[23,47].Mostcontingenciesinvolve

theinternalboundaryoftheorganization,butsomeofthemostcriticalareoutside

ofthatboundary(e.g.,theexternalenvironment).Contingencytheoryoffersseveral

empiricallyverifiedresultsthatshoworganizationsthatfitthecontingencies

presentintheenvironmentoutperformthosewhodonot[23].Itisimportantto

notethatrarelydoesanorganizationhavetoaddressonecontingencyandnot

others,makingradicalorganizationaloverhaulspreferabletoprolonged

incrementalsteps[51].Heuristically,itisalsodesirabletomakethesechanges

earlierinthelifeofanorganizationthanlater,whichbodeswellforcyber

organizations,astheyareintheirinfancy.

Contingencies

Buildinguponcontingencytheory,whatfollowsisabriefreviewofthe

centralcontingenciesintheresearchliteratureandtheirrelevancetothecyber

environment.

11

Technology.

Technologyandthechangesurroundingitincreaseperceiveduncertaintyfor

organizations[55].Asuncertaintyincreasessodoesthepressuretolearnand

increaseknowledge.Thispressureforknowledgecreatesnewworkroles,

workflows,andevenchangesthelanguageusedtodescribework[55].Thefocusis

notwhetherorganizationswilluseinformationtechnologytoaccomplish

something,buthowtheywillaccomplishthingswithinandaroundit.Cyber

organizationsshouldkeeptheseprinciplesinmind,andbecarefulnottodesign

structuresthatarecomfortablebutinappropriate.

Size.

Sizeconsiderablyaffectsthetypeandclassificationofanorganization[47].

Organizationalsizehasbeenfoundtoaffectnearlyeverythingthatdefines

organizationalstructure.Forinstance,largerorganizationsareoftenmorecomplex,

havemoreformalizationandsurvivelongerthansmallerorganizations[7].

Informationtechnology‐richenvironmentshavebeenshowntoreduceorganization

sizeasinformationsystemsreplacemiddlemanagementandallowother

organizationstoincreaseinsizewithoutdecreasingefficiencyandinnovativeness

[19].Itisimportanttonotethatefficiencyhasnotbeenshowntoimproveas

organizationalsizeincreases[28].Collyer[15]statesthatasthesizeoftheproject

increasessodoesthechanceoffailure.Thelikelihoodofthatfailureiscompounded

byincreasedspeedandquantityofchangeintheenvironment.Theconsensus

12

appearstobeformingwhereinlargerorganizationsformright‐sizedsubunitsthat

performwellwhenbasedontherelevantfactors.

StrategyandStrategicChoice.

Thetypeofstrategyanorganizationpursuessignificantlyaffectsthe

structureoforganizations[1,12,23,47].Perhapsmostimportantly,when

organizationschooseastrategytomatchstructuretotherelevantcontingencies,

performanceincreases[21].Thisisastrategycyberorganizationsshouldpursue.

Environment.

Inlinewiththepopulationecologyandresourcedependenceperspectives,

organizationsthatcannotadapttotheirenvironmentcannotsurvive[33].

Environmentalcontingenciesarefundamentallyimportanttoorganizations.They

areofparticularimportancetocyberorganizations,whichhaveaprincipalsecurity

function.Itishelpfultoseparatetheinternalenvironmentoforganizationsfromthe

externalenvironmentoforganizations.Thisresearchwillexclusivelyfocusonthe

generalexternalenvironment,heredefinedastherelevantphysicalandsocial

factorsoutsidetheboundariesofanorganization[24]whichgenerallyeffectall

withinthecyber‐connectedcriticalinfrastructurearea.Limitedresearchconnecting

organizationalstructuretothecyberspaceenvironmentisavailable.However,

researchisbeginningtoemergeonorganizationaloperationsinacyber‐

environment.Forexample,Liuetal.,[41]haveaddressedcommandandcontrolin

cyber‐physical‐socialsystems(CPSS).However,Liu’sresearchfocusesfarmoreon

13

thepotentialcapabilitiesofCPSSandfarlessonoptimalstructuraldimensionsfor

thoseoperatingincyberspace.

Thepresenceofcompetitionandhostilityintheenvironmentcan

significantlyaffectorganizations.Forexample,ifanorganizationperceivestheir

environmenttobehostileorcompetitive,itwillmovetowardcentralizationand

formalization[34,48].Thisreactionmaybeinstinctive.However,itcanleadtoa

structurethatisill‐suitedtomeetthechallengingcharacteristicsofthe

environment.Thisphenomenonisinsightfulinlightofnewlycreatedgovernment

cyberorganizations.Itappearscentralizationandformalizationareincreasingin

theseorganizationsconceivablytotheirperil.

Eachorganizationalenvironmenthasuniqueextrinsicfactors.Thesefactors

influenceorganizationalshape,meansandactionswithintheenvironment[11].In

assessingenvironmentalconsiderations,uncertaintyemergesasafocalpoint[11,

24,39].

EnvironmentalUncertainty

Dynamism,complexityandmunificenceremaintheprimarydimensionsused

toconceptualizethecentralpropertiesoforganizationenvironments[7,18,25]and

actassignificantmeasuresofperceiveduncertaintyintheexternalenvironment[1,

24,25].Thesethreedimensionsrelatetoforcesintheenvironmentthatcan

influencetheorganization.Forceisoperationallydefinedasanentityexternalto

14

cyber‐connectedcriticalinfrastructureorganizationsthatcaneffectchangeintheir

environment.Theseforcescanbecompetitors,customers,economic,technological,

political,ethical,demographic,culturalandsocial[17,24,57].Notethatwhile

complexity,dynamismandmunificencearecapableofprovidinganextensiveview

oftheenvironment,theyarenottheonlydeterminantsofenvironmentaleffectson

structure[31].

Complexity.

Complexityrelatestothetotalamountofforcesintheenvironment,whether

theyareconnectingwitheachother,andthedegreebywhichtheycaninfluence

otherorganizations.Forexample,aweakforceinisolationlowersuncertainty,

whereasmanyinterconnectingstrongforcesincreaseuncertainty[2,18,24].

Dynamism(Turbulence).

Dynamismreferstochangemeasuredinspeedandquantity.Organizations

thatfaceasignificantamountofchangeoperateinenvironmentsthataremore

uncertain.Organizationsthatexperiencesmallamountsofchangehaveless

uncertainty.Anincreasedrateorspeedofchangeonlyaddstotheuncertainty[2,

18,24].

Munificence(Resource).

Munificencedealswithcapacity,ormoregenerally,theamountofresources

availabletosustainorsupportthatenvironment.Thiscategoryrepresentsa

considerableportionofthefocusofstructuraltheory.Asitpertainstouncertainty,

15

thescarcertheresources,thegreatertheuncertainty[2,18,47].Figure1

conceptuallydepictsmunificence,complexityanddynamismassourcesof

uncertaintyintheexternalenvironment.

Figure1.TheExternalEnvironmentandUncertainty

Structures

Themechanisticandorganicstructuralcontinuumrepresentsthetypeof

formsorganizationscantake[11].Thiscontinuumofferstwoextremesfor

managementsystemsbasedonthelevelofperceiveduncertaintyinthe

environment.Empiricalresultsstronglyindicatethatperceivedenvironmental

uncertaintysignificantlycorrelateswithorganicandmechanisticstructuraltypes.

Table2listscharacteristicsofthetwostructures.

16

Table2.CharacteristicsofMechanisticandOrganicStructures

Mechanistic OrganicSpecializedindividual tasks

VerticalhierarchyIndividualresponsibilityCentralized authority

Increasedrules,policiesandproceduresStandardizedverticalcommunication

DirectivesandordersFixed functionaldepartmentsStatusincreasesuphierarchyNarrowspanofcontrol

Adjustable teamtasksFlexible (flatter)structure

Team responsibilityDecentralizedauthorityDecreasedformalization

All‐encompassingcommunicationAdvice andinformationsharing

Fluid (mixed)functionaldepartmentsStatus increaseswithbrilliance

Wide spanofcontrol

MechanisticandOrganicinPractice

Twoorganizationsareusedasexamplestodemonstratemechanisticand

organicstructures.TheU.S.Armyisusedtotypifymechanisticstructures;Apache

Indians,AnonymousandAlQaedadisplayexamplesoforganicstructures.

MechanisticOrganization:U.S.Army.

AnArmyinfantrydivisionrepresentsanorganizationthatdisplays

mechanisticcharacteristics.WhilenotalloftheArmytrendstowardmechanistic,

mostoftheArmyeasilyfitsthisstructure.Atypicaldivisionislargelymechanistic

whenanalyzingitsdimensionaltraits.

ThisparticulartypeofstructureiscommonthroughouttheArmyregardless

oftheenvironmentandcontextinwhichitconductsbusiness.Recentcombat

operationsinIraqareanexample.Duringtheinitialcampaign,Armydivisionswere

deployedtodominatetheenvironmentwithmassresources,againstasingular,

17

weakerandmechanisticadversary.Asthewarmaturedandkineticoperations

diminished,theArmyfounditsdivisionalstructureill‐suitedfornationbuilding,and

struggledtofindtheflexibilitytoadjustamidstthegrowingdynamicsand

complexities(e.g.,environmentaluncertainty)ofacounterinsurgency[4].This

experienceservestohighlighttheneedforflexibleorganizationalmodification

processes.Table3depictsthestructuraldimensionsofatypicalinfantrydivision.

Table3.U.S.ArmyInfantryDivisionStructure

Dimension Trait StructureSpecialization Highlyspecializeddowntotheindividual

throughtasklists;highlyfunctionalandcompartmentalizedintosubunits.

Mechanistic

Centralization Authoritytomakedecisionsisoftenkeptatmultiplelevelsabovetheworker.

Mechanistic

Formalization Highlyformalizedtasksdrivenbydoctrine,codifiedandcheckedfrequently;dozensofpoliciesandproceduresdictateactions.

Mechanistic

SpanofControl Theamountofpersonnelsupervisedisdoctrinally drivenandrigid;oftenanarrowandverticalhierarchy;difficulttochange.

Mechanistic

ChainofCommand

Doctrinally drivenandconsiderablyverticaloftenwithadozenleaderswithauthority tochangewhatthelowestindividualwilldo.

Mechanistic

Professionalism VariedwithdeliberateintentionsofbeinghighthroughouttheArmy.

Mixed‐Organic

Status Increasesupthehierarchy. MechanisticCommunication Morevertical than all encompassing;directive

andordersbased.Mechanistic

ThemeansofcreatinganArmyorganizationofferssomeexplanationasto

whytheyaremechanistic.

18

CreatingMechanisticOrganizations.

TheArmycreatesorganizationsthroughtheForceDevelopmentProcess

which“consistsofdefiningmilitarycapabilities,designingforcestructuresto

providethesecapabilities,andtranslatingorganizationalconceptsbasedon

doctrine,technologies,materiel,manpowerrequirements,andlimitedresources

intoatrainedandreadyArmy”[56].

TherearefivephasesintheForceDevelopmentProcess,andtheyare:

(1)Developcapabilities.

(2)Designorganizations.

(3)Developorganizationalmodels.

(4)Determineorganizationalauthorizations.

(5)Documentorganizationalauthorizations.

Armyorganizationsfollowthisprocess,toincludeArmycyber

organizations.Thisfive‐stepprocessresultsinthecreationofanorganizational

structure.Figure3showsthemodelofthesystemofsystemsprocesswiththe

inputsandoutputs.

19

OncetheArmyidentifiestherequirementforaneworganization,the

planning,programming,budgeting,andexecution(PPBE)processbeginstodevelop

theorganization.TheprocessmapinFigure4highlightsthekeysteps.

Figure2.ArmyForceDevelopmentProcess(AR71‐32)[56]

20

RecieveGuidancefrom...

•NationalSecurityStrategy,NationalMilitaryStrategy,QuadrennialDefenseReview,NationalDefenseStrategy,DefensePlanningGuidance,GuidanceforDevelopmentoftheForce,GlobalForceManagementImplementationGuidance,GuidancefromtheArmy’sseniorleadership(TheArmyPlan),Jointwarfightingconcepts(suchasrapiddecisive,operations,peaceenforcementoperations),and/ornewmaterielcapabilitiesevolvingfromtheresearch,development,andacquisitionprocess.

then..

•Thecapabilitiesdevelopmentcommunitydevelopstheproposedorganization,designs,missions,andfunctionstomeettherequiredoperationalcapabilities,whichiscapturedinaUnitReferenceSheet(URS).

then...

•TrainingandDoctrineCommand(TRADOC)utilizestheArmyCapabilitiesIntegrationCenter(ARCIC)andproponentcentersandschoolstodevelopandanalyzethedesign.

then...

•TheapprovedURSdesignmovesforwardtoARCIC’sForceDesignDirectorateandtheArchitectureIntegrationandManagementDivisionwhomakessuretheproposedorganizationaldesignfitsthroughouttheArmyandthattheproposalisdoctrinallycorrect.

then...

•ForceDesignDirectorateforwardstheirdesigntothecommandinggeneraloftraininganddoctrinecommandforapproval.

then...

•ApprovedrecommendationsareforwardedtoDeputyChiefofStaffDirectorofForceManagmentforaforceintegrationfunctionalareasanalysis.

then...

•TheForcedesignupdateneedstobeapprovedbytheViceChiefofStaff,ArmyorChiefofStaff,Army.

then...

•TheUSArmyForceManagmentSupportAgency,inconjunctionwiththeappropriateforcemanagementproponent,appliesarchitecture,rules,standards,andguidancetothedoctrinallycorrectdesigntoproducetheorganizationalmodel.

then...

•HeadquartersDepartmentoftheArmyApprovesthemodelknownasaMilitaryTableofOrgranizationandEquipment.

then...

•Theorganizationissubmittedtothetotalarmyanalysis(TAA)processtocompeteforresourcestoperformthespecifiedcapabilitiesitwascreatedtodo.Resourcingvaries.

Figure3.ProcessMapforCreatingArmyOrganizations

21

Theprocessmapdoesnotshowalloftheprocess.Forinstance,theArmywill

stillneedtopurchaseequipment,requisitionpersonnel,prepsites,andpublish

doctrine.Allofthishappenswithintheconfinesofwhathasoccurredpreviously.

Thisprocessdoesnothappenquickly.Seniorleaderapprovalcancausebottlenecks

(therearemanyinthisexample),transitionsfromoneorganizationtoanother,

rework,oradditions/modificationsfromapprovingofficials.Leadersoftenchange,

whichcreatesstagnationintheprocess.Severalotherfactorsandvariablescause

delaytoincludeembeddedsubprocesses.Allofthisaddsuptoanorganizational

creationprocessfacilitatingmechanisticentities.Perhapsthemostsignificantpoint

isthattheArmyevaluatesstructuralcontexttodetermineneededcapabilities,not

todeterminestructuralstrategy.

OrganicOrganizations:ApacheIndians,AnonymousandAlQaeda.

TheApacheIndians,AnonymousCyberNetwork,andAlQaedaoffer

examplesoforganicstructuringinanearlypureform.Thesethreeorganizations

exhibitedanunusualabilitytosucceedagainstvastlylargeradversaries;they

operateinhighlyuncertainenvironments,characterizedbysuddenandvast

amountsofchange,considerableforcesthatarepronetoshiftatamoment’snotice,

andlimitedavailabilityofresources.Table4depictsthestructuraldimensionsof

theseorganizations.

22

Table4.ApacheIndians,AnonymousHackerGroupandAlQaedaStructures

Dimension Trait StructureSpecialization Lowlevelofspecializationwithoperators

performingabroadrangeofrandomtaskswithlittle standardization;fluidteamandnetwork‐basedtaskunits.

Organic

Centralization Personnelfollowemergentleadersandoftenactwithautonomy.

Organic

Formalization Frequentlynoformalizationispresentintheperformanceoftasks.

Organic

SpanofControl Emergentandvaried;at timesextraordinarilywide.

Organic

ChainofCommand

Emergentandflexiblebasedoncontingenciesfacingsubunits;nearflat organizationalhierarchywithcommonthemesallowingvariousactorstoplugintotheorganizationwhenneededordesired.

Organic

Professionalism Varied. MixedStatus Increaseswithdisplayedbrilliance. OrganicCommunication Rangesfromhorizontaltoallencompassing;

adviceandinformationsharing.Organic

TheApacheIndianshaveoccupiedwhatarenownorthernMexicoandthe

southwesternUnitedStatesforhundredsofyears.Theyincreasedinfameand

notorietyduringtheeraofSpanishConquistadorsintheAmericasinthe16th

century.TheSpanishappearedtobeunstoppableastheygainedconsiderable

groundthroughoutCentralAmericauntiltheyventurednorthandencounteredthe

Apache.TheSpanishmettheirmatchinanundersizedandunder‐resourced

adversary[9].

23

Theanonymoushackergroupissimilar.TheyclashedwithFortune500

companies,computersecurityfirms,majorreligiousorganizationsandbrought

them,atleasttemporarily,greatdifficulty[44].

AlQaedahasverynoticeablykeptpowerfulmilitariesbusyforoveradecade.

Theyhavedonesousingsimpletechnologyandsneakytacticstomakeupfortheir

lackofairsupport,advancedcommunicationsandweaponry.Thereisa

commonalityinthesethreeorganizationsandtheiradversaries.Alloftheir

adversariesexhibitedtendenciestostructureandoperateinamechanisticfashion

despiteexternalenvironmentalconditionsthatsuggesttheopposite.

CreatingOrganicOrganizations.

Describingthecreationoftheseandotherorganicorganizationsisdifficult;

theyare,almostbydefinition,unstructured.However,BurnsandStalkerhighlight

thepresenceofthreefactorsinthecreationoforganicstructures:sharedbeliefsand

goals,commitmenttoacommonconcern,andpersonnelwithexpertisewhoemerge

asleaders[11].Table5showsthepresenceofthesefactors.

Table5.StructuralFactorsPresentinCreatingOrganicOrganizations

Organization Sharedbeliefs/goals

Commonconcern Emergentleaders

16thCenturyApacheIndians

Yes RepellingtheSpanishinvasion

Nant’ans

AnonymousHackerGroup

Yes Variesonemergent“operations”ofinterest

Opschampion;skilledhackers

AlQaeda Yes Repelthewest;establishacaliphate

Commanders/emirs

24

Thestrengthofthefactorsappearstoincreasethestrengthofthe

organization.Whenbeliefsandgoalsbegintocompetewithoneanother,thiscan

createopposingfactions,effectivelyreducingthecollectivepoweroftheentity.A

commonconcernactstofocusthehorizontalstructure,whichcreatestheimpetus

formoreskilledleaderstochampionit.Weakeningthecommonconcernlikewise

weakenstheintegrationofexistinggroups.Followerschooseleadershipbasedon

proveneffectivenessintheareaofinterest.Theabsenceofskilledleadershinders

theabilityoftheorganizationtoaccomplishgoals.InthecaseoftheApache,leaders

areknownasNant’ans,spiritualandculturalfront‐runnerspeoplelikedfollowing

[9].ThereweremanyNant’ans,andtheywouldattimesalignwitheachotherwhen

needed.Whenonedied,anotherwouldemerge.Figure5isadepictionofhorizontal

andnetwork‐basednatureoftheApacheIndiansinthe16thcentury:

Nant’an

Nant’anNant’an

Nant’an

Figure4.ApacheStructuralDepiction 

25

StructureandEnvironmentalUncertaintySynthesis

Asitrelatestoperformance,thegreatertheperceiveduncertaintyinthe

environment,themoretheorganizationshouldtakeanorganicform,andwithless

uncertainty,theyundertakeamechanisticform[11,29,39].Whenanorganization

takesanorganicforminanenvironmentthatishighlyuncertain,thisisconsidered

astructuralfit,whichisshowntoincreaseperformance[21].Thisalignmentseems

intuitive,asorganicstructuresaremorefluidandadaptable.Followingthesame

logic,organicstructuresarenotashelpfulinstableenvironments.Itisworthnoting

thatnosinglecontingencyorstructureappliestoall.Organicormechanistic

structuraltypesareonly“better”iftheyfitthecontingencies.Organizational

structuresandtheirrelationshiptoenvironmentaluncertaintyandstructural

contingencycanbesynthesizedasshowninFigure2.

Thisresearchseekstofindoutthelevelofuncertaintyinthegeneralexternal

environmentofcyberconnectedcriticalinfrastructuretodeterminestructural

guidanceforcyberorganizationstaskedwithprotectingthesecriticalassets.

Figure5:OrganizationalStructure,UncertaintyandtheExternalEnvironment

26

III.Methodology

ResearchDesignandMethodology

Theresearchmethodisamultiplecasestudy.Theapproachisstructuredas

anexploratorystudywitharetrospectivelensfororganizationalpatterns.Thecase

studymethodallowsinvestigatorstoretaintheholisticandmeaningful

characteristicsofreal‐lifeeventssuchasindividuallifecycles,smallgroupbehavior,

organizationalandmanagerialprocessesandthematurationofindustries[60].

Thedataanalysistechniqueiscontentanalysis.Contentanalysisissuitable

forcondensingmanywordswithinadocumentintoasmallsetofcontentcategories

basedonexplicitcodingrulesforthepurposeofexaminingthem[6,30,37,54].The

contentcategorieswereestablishedaprioribasedtheorganizationalstructure

theoriesofpopulationecology,resourcedependenceandstructuralcontingency.

Thecategoriesweredefinediterativelytomaximizemutualexclusivityand

exhaustiveness[58].Thisresearchhighlightsexternalenvironmentaluncertainty

foritssignificantinfluenceinshapingorganizationalstructureacrossthefollowing

threemeasureddimensionalcategories:(i)complexity;(ii)dynamism(turbulence);

and,(iii)munificence(resource)[18].

DataCollection

Onceexternalenvironmentaluncertaintywaschosenasthefocusofthis

research,thecontentanalystwasabletodrawastratifiedpurposivesampleof

27

artifacts(documents)fromthepublishedmaterial.Thestrata(cases)dividedinto

academia,governmentandprivate/practitioner[43,46].Eachrepresents

stakeholdersofpubliclyavailableinformationrelatedtocriticalinfrastructureand

cyberintheUnitedStates.Informationaboutthecyberlinkagetocritical

infrastructureisaspecifictopicofinterestwhererelevantinformationisknown

mostlytoaspecificsubsetofprofessionalswithinthesethreestrata[37].Search

engines(includingGoogle,RAND/CSIS/MITREand.govsources)identifiedthe

artifactsusingalgorithmsthatsortdocumentretrievalfromlargedatabases.This

processhelpstoidentifyartifactswiththemostreferencesandinformationrelated

tocriticalinfrastructureandcyber.TheU.S.GovernmentAccountabilityOffice’s

(GAO)definitionofartifactsasphysicallyseparable,minimallysized,andself‐

containedtextualinformationwasadopted[30].

ArtifactDiscrimination.

Artifactswereretrievedusingthesearchtermsindustrialcontrolsystem,

SCADA,andcriticalinfrastructurecyber,basedontheircloselinkagetocyber‐

connectedcriticalinfrastructure[8].Theinitialsearchharvestedalargenumberof

artifacts.Infilteringtheresults,additionalcriteriawereappliedtoachievea

relevantandrepresentativesampleforeachstratum.Table6liststhecriteria.The

contentanalystconvertedthefinalselectionofartifacts(AppendixA)into

individualportabledocumentformat(PDF)tominimizethefilesize,standardizethe

formatforallcoders,andmakeimportingintocodingsoftware(e.g.,Maxqda)easy.

28

Table6.ArtifactCriteria

Category CriteriaContent Discusscyberandthecriticalinfrastructuregeneral

externalenvironmentGeography U.S.relatedTimeliness Publishedwithinthelastsevenyears(sinceJuly2008)Availability PubliclyavailableSize Nomorethan20codeablepagesperdocument

Table7containsthesearchresults.Moreartifactsthatareacademicwere

reviewedbecauseoftheirperceivedreliability,validityandtrust.Aslightlyhigher

amountofprivate/practitionerartifactswerereviewedthangovernmentbecauseof

searchenginelimitationsuniquetoRAND,CSISandMITRE.Google’splatform

dominatedbyitsabilitytoreturnresultsconcentratedonthefocusarea,whichwas

verytimely(usuallywithinoneyearofpublication).Governmentartifactselection

alsosufferedfromsearchenginelimitationsandsyntacticissues(e.g.,includedonly

minutesfromcongressionalmeetings)thatincreasedtheamountofartifactsneeded

tobeviewed.

Table7.ArtifactRetrievalResults

Strata InitialSample MetCriteria FinalRandomSampleAcademia 91 34 10(50%)Private/Practitioner 73 17 5(25%)Government 65 17 5(25%)Totals 229 68 20(n=60)

ArtifactswererandomizedusingMicrosoftExceltogeneratethefinalsample.

All68artifacts(AppendixB)meetingtheselectioncriterionwerecodedwithanA,

29

P,G(academic,private/practitioner,andgovernment).Thefinalrandomsample

contained20documentspercoder(distributed10‐A/5‐P/5‐G)foratotalofn=60

documents.Itisimportanttonotethatincontentanalysis,unlikequantitative

statisticalanalysis,anaccuraterepresentationofallthedocumentsintheareaof

cyber‐connectedcriticalinfrastructureisnotthegoal.Thegoalistoretrieveauseful

setofartifactstoanswertheresearchquestionfairly[37].

OrganizationalDiversity.

Thedocumentsanalyzedbythecodersrepresentedadiverseamountof

informationfromallthreestrata.Parentorganizationsthathavepublishedcontent

includedinthefinalsampleare:AssociationforComputingMachinery,IEEE,Forbes,

ArmyResearchLab,InternationalJournalofCriticalInfrastructureProtection,

Economist,Tripwire,DepartmentofHomelandSecurity,InstituteforComputer

Sciences,SocialInformaticsandTelecommunicationsEngineering,WhiteHouse,

GovernmentAccountabilityOffice,DowJonesandCo.,andInternationalFederation

forInformationProcessing.

Coding

Krippendorfdefinescodingasthestepofclassifyingthesamplingor

recordingunitsintermsofthecategoriesoftheanalyticalconstructschosen[37].

Thesamplingunitelectedtocategorizetheinformationpresentintheartifactis

“thesentence”[54],becauseofitsabilitytoobtainmeaninginrelationtotext[37],

30

andduetotheuseofhumancoders[30].Eachsentencewasreadandcodedagainst

thecodecategoriesusingtherecordingunitclassificationdiagramlistedin

AppendixC.Codersweretrainedtolookforrepetitivematerialsoasnottocodethe

sameinformationtwice.Thecoderswereinstructedtointerpretthesamplingunit

(e.g.,sentence)inthecontextofanentireartifact(e.g.,contextunit).This

interpretationismeaningfulandfeasibleforanartifactthatcontainslessthaneight

pagesofcodeablematerial[37].AnexampleofacodedartifactisinAppendixD.

ContentCategories.

TheMaxqdagraphicaluserinterfaceprovidesavisualdisplayofcode

categoriesandcodedmaterialtocheckoperationaldefinitionsagainstsampling

units,asdisplayedinFigure6.

Figure6:MaxqdaGraphicalUserInterface

31

The“NotApplicable”codecategorywasincludedinadditiontotheexistinga

prioricategoriesofcomplexity,dynamismandmunificencetoensure

exhaustiveness[30,54].Allforcesdiscussedrelatetothegeneralexternal

environment.Table8liststhecodecategories.

Table8.CodeCategoryDefinitions

CodeCategory SubCategory DefinitionsComplexity Forcesinterconnecting Are theforcesinterconnecting?

(CONNECTEDNESS)Complexity Forcesnotconnecting Are theforcesdisconnected?

(CONNECTEDNESS)Complexity Many forces Are theforcesmany?(AMOUNT)Complexity Fewforces Are theforcesfew? (AMOUNT)Complexity Forcesarestrong Are theforcesstrong?

(STRENGTH)Complexity Forcesareweak Are theforcesweak?

(STRENGTH)Dynamism Forceschangea lot Isthereahighamountofchange?

(AMOUNT)Dynamism Forceschangeinfrequently Are forceschangingverylittle?

(AMOUNT)Dynamism Forceschangefast Ischangehappeningquickly?

(SPEED)Dynamism Forceschangeslowly Ischangehappeningslowly?

(SPEED)Munificence Resourcesarescarce Are theamountofresources

availablescarce?(AMOUNT)Munificence Resourcesarein

abundanceAre theamountofresourcesavailableabundant?(AMOUNT)

Not Applicable Not Applicable Allothersentences (N/A)

32

CoderTraining.

Qualitativedataanalysissoftware(Maxqda)wasselectedfortheabilityto

managelargevolumesoftext,displayinformationwitheaseandforworkingwith

multiplecoders[52].ThecontentanalystfamiliarizedthecoderswithMaxqda,

operationaldefinitionsandcodecategories(seeAppendixE).Also,well‐defined

explicitcodinginstructionswerewrittenintoMaxqdatoimprovecoding

consistency[54].Onlythecontentanalysttrainedandevaluatedeachcoder[37].

Theyparticipatedinabetacodingsessiontoimprovecodingconsistencyandto

minimizeidiosyncraticjudgmentsinthecodingprocess[37].Thetrainingprocess

producedfavorablereliabilityresults.Thecoderstrainedondocumentsnot

includedinthefinalsample.Nocollaborationamongstthecoderswasallowed

duringthecodingprocess.

Threegraduatestudentswithastrongbackgroundincybercodedthe

documents.Theimportanceofcodersbeingfamiliarwiththephenomenaunder

considerationwasacriticalfactorincoderselection[37].Thereadinglevelofthe

documentsdemandedcoderswithahighereducationlevel.

DataReduction

Oncethecodersfinished,thecompletedthumbdrivesweregiventothe

contentanalysttoaggregate.Thecombineddatasetsgeneratednumerous

descriptivestatistics,charts,andtables.Thecontentanalystscrutinizedthedatafor

33

outliers,incompleteartifacts,andotheranomalies.Alloftheartifactsweredeemed

completeandproperlycoded.ThedatawereimportedintoMicrosoftExceltolook

foranalysisofpatternsandtrendswithinandacrosstheset.Numerousgraphsand

tableswerecollapsedintoatightsetwhichbestarticulatedthefindings.

Validity

Everystepoftheresearchprocesswasconductedtoensurethequalityofthe

resultsledtoanacceptanceoftruth.TheguidelinessetforthbyKlausKrippendorff

[37]forvalidityincontentanalysiswerefollowedandreviewedperiodically

throughouttheresearchprocess.

Reliability

Toensurevalidinferencesfromthetext,wordmeaningandcategory

definitionsweretightened,multiplecoderswereusedandintercoderagreement

wascalculated.CohensKappa[14]wascalculatedasameasureofreliability.Itis

consideredastrictmeasureofagreementbetweencodersbasedontheselectionof

aparticularcodefortherecordingunit[42].

34

IV.AnalysisandResults

DescriptiveStatistics

Table9showsthecodingunitsrangefrom1,594to2,067(mean=1,838).The

primaryreasonforthisvarianceliesinhoweachcoderinterpretedthecodingunit.

Theambiguityofthelanguageinthepublishedmaterialmightcauseonecoderto

perceivethepresenceofacodingunitwhileanotherdidnot.

Table9.TotalCodesbyCoder

Coder 1 2 3

Pages 156 156 156Documents 20 20 20Codingunits 2067 1853 1594

Table10showsthateachcoderread156pages,whichaveraged7.8pages

perartifact.Althoughthereweremoreacademicartifactsthangovernment,the

governmentartifactsaveragedmorepages(13.8).Subsequently,thedifficultyof

interpretingthesamplingunit(sentence)inrelationtothecontextunit(artifact)

increased[37].

Table10.PagesCodedbyStrata

Academic Government Private/Practitioner AggregatePagesRead 74 69 13 156PagesPerArtifact7.4 13.8 2.6 7.8

35

Flesch‐KincaidReadingLevelandFleschReadingEasemeasureswere

calculatedforeachartifact.Table11showstheresults.TheFlesch‐Kincaidformulas

aremathematicalderivationsaccountingfortheamountofwordsinasentenceand

syllablesperwordtogenerateagradelevelguideforcomprehensionandeaseof

reading[26,35].Thetotalpagescodedwere156,withanaverage1,838recordable

unitsatagraduatereadinglevelandease(Flesch‐KincaidGrade16/Ease23).The

governmentdocumentsemergedasthemostdifficulttocomprehendbasedon

theseindicesandsufferedthehighestamountofdisagreement.

Table11.Flesch‐KincaidReadingScores

Strata ReadingLevel ReadingEaseAcademic 16 24Government 17 15Private/Practitioner 16 27TotalAverage 16 23

IntercoderAgreement

BasedonLandisandKoch[38],thecoderagreementinTable12rangesfrom

fair(21%‐40%)tosubstantial(61%‐80%)whichresultsinmoderateoverall

agreementwithKapparangingfrom51%‐60%.SeveralfactorscanaffectKappa

(e.g.,amountofcategories(13),specificityofdefinition);sincetheresearchis

exploratory,lowerlevelsofagreementareconsideredacceptable[42].Coderswere

allowedconsiderablelatitudeincontentinterpretationbasedontheirexpertiseand

training.Despitechallenges,theresultsindicateagreementbetweencoders.

36

Table12.CohensKappa

Coders 1and2 1and3 2and3 Mean

Academic 0.66 0.71 0.71 0.69Government 0.39 0.47 0.29 0.38Private/Practitioner 0.36 0.51 0.31 0.40Kappa 0.52 0.60 0.51 0.54

CodeDistribution

Table13liststhefrequencydistributionofcodesacrossthesample(n=60).

Thecodersassignedadimensionalcodeto51.8%ofthecontent(2,856sentences).

Thecategory“notapplicable”wasremovedfromthefrequencyanalysisinTable13

toremovebias.Thefrequencyanalysisindicatesthatcomplexityhasastrong

presence(morethan91%)ineachstratum.Complexity(e.g.,forcesconnecting,

manyforces,forcesarestrong)accountsfor67.43%ofuncertaintyinthecontent

coded.Dynamism(e.g.,amountofchangeishigh,forceschangefast)accountsfor

8.12%ofuncertaintyinthecontentcoded.Munificence(e.g.,resourcesarescarce)

accountsfor5.85%ofuncertaintyinthecontentcoded.Basedoncoder

interpretation,asFigure7indicates,thereisastrongpresence(81.4%)of

uncertaintyinthegeneralexternalenvironmentpresentacrossthethreestrata

sampled.

37

Table13.FrequencyAnalysisofCodes

Parentcode Code Frequency Percent DocumentsComplexity ForcesConnecting 872 30.53 56Complexity ManyForces 537 18.80 55Complexity ForcesareStrong 517 18.10 58Munificence ResourcesareinAbundance 225 7.88 36Munificence ResourcesareScarce 167 5.85 44Dynamism AmountofChangeisHigh 144 5.04 44Complexity ForcesNotConnecting 140 4.90 32Dynamism ForcesChangeFast 88 3.08 25Dynamism ForcesChangeSlowly 65 2.28 20Complexity ForcesareWeak 57 2.00 29Dynamism AmountofChangeisLow 34 1.19 11Complexity FewForces 10 0.35 8

Total 2,856 100.00 ‐

Figure7.UncertaintyintheGeneralExternalEnvironment

38

StrataAnalysis

Thefollowingsectionswillprovideananalysisofthepresenceofuncertainty

inthegeneralexternalenvironment,withinandacrossstrata,displayedinFigure8.

Complexity.

Figure8illustratesthereisstrongevidencetosupportthatcomplexityis

extremelyhigh.Allthreestratashowedastrongpresenceofcomplexityinthe

generalexternalenvironment.Infact,thedataappearstobeastatisticaldead‐heat

atabout90%.

Dynamism.

Dynamismpresentsadifferentpicture.Private/practitionerdisplays

significantlyhigheruncertaintythangovernmentandacademicstrata.Thislevelof

Figure8.PercentageofUncertaintybyDimensionandStrata

39

uncertaintyappearstobereasonablebecauseoftheincreasedcompetitionand

desireforrevenuepresentintheprivate/practitionerenvironment.This

environmentrequirestheabilitytodissolveorcreateorganizationsrapidly,modify

processes,andinnovateinresponsetomarketstimuli.

Thegovernmentstrataexhibitalowerpresenceofuncertainty.Unlike

private/practitioner,governmentfunctionsareslowtochange.Despitethis,coders

agreethereisvastlymorechange(dynamism)inthegeneralexternalenvironment

acrossallthreestrata.Infact,theamountofchangewasdetectedatfourtimesthe

frequency(seeTable13).

Munificence.

Itisclearfromtheresultsthereisexplanatorypowerandameasurable

degreeofresourcescarcity(munificence)intheenvironment.Thepresenceof

uncertaintyisloweroverallacrossallthreeenvironmentalresourcemeasures.

However,theacademicstrataexhibitsignificantlymoreperceivedresourcescarcity

inthegeneralexternalenvironment.Areasonableexplanationforthedifferenceis

thebreadthanddepthofresearchtheacademicsectordedicatestothiscomplex

area.

40

CoderAnalysis

Figure9clearlydemonstratesthecoderswereconsistentintheircoding

acrossallthreedimensionsofuncertainty.Whilethereisslightdisagreementin

munificence(resource)andcomplexity(amount/connectednessofforces),thereis

generalagreementoverall.

RecommendationsforAction

Understandingtheoutcomespresentedinthisstudy,itwouldbelogicalto

structuregovernmentcyberorganizationsoperatinginthecriticalinfrastructure

environmentinanorganicfashionratherthanthecurrentmechanisticstructure.

Thegovernmentshouldgenerateseparateprocessesinthecreationofthese

Figure9.CoderOverlap

41

organizationstoallowforfastimplementationandfrequentmodification.These

cyberorganizationsshouldhavethefollowingcharacteristicsiftheyaretosucceed:

Peopledonotperformhighlyspecializedtasksbuthaveabroaderview.

Achainofcommandexistsbutismoredecentralizedbecauseoftheneedforshiftingresponsibilities.

Thehighlevelofcomplexityandchangeintheenvironmentwarrantsknowledgeablepersonnelworkinginteamsandcoordinatingfrequentlytomakefastdecisionswhenneeded.

Communicationoftenoccursandatmanylevels.

Ordersanddirectivesdiminishasadviceandinformationsharingincrease.

Knowledgeandexpertiseincreaseindividualstatus.

Oneofthemostappealingaspectsoftheresearchisthepotentialfor

generalizabilitytoothercyberorganizationsoperatingwithintheUnitedStatesand

similarlydevelopedcountries.Onecouldmaketheargumentthatthecyber

environmentsoftheDepartmentofHomelandSecurity,theDepartmentofDefense,

privateutilitycompanies,andhightechnologyfirmshavesignificantsimilarities.

Itisworthmentioningthatsignificantbarriersexisttoimplementingthese

principlesintheDoDandothergovernmentagenciesrangingfromcultureto

strategicdirection.Understandingtheconnectionsbetweenorganizational

performance,structure,andtheenvironmentshouldactasanimpetusforthese

difficultchanges.

42

V.Conclusions

ConclusionsofResearch

Fewtopicswithintheareaofnationalinterestaremoreimportantthanthe

understandingofhowtoorganizeincyberandprotectnationalcritical

infrastructureassetsfromcyberspacethreats.ParticipationattheUnitedStates

ArmyCyberTalksattheNationalDefenseUniversityinSeptemberof2015served

tostrengthentheneedforempiricalanalysisandevidencethatcouldleadto

organizationalstructuringdecisionsandadjustments.Innovationandknowledge

managementweredirectconcernsofattendees,whichrelatedirectlyto

organizationalstructure[40].Severalstructuraldimensionswererepeatedly

discussedasinhibitorstoperformancefurthervalidatingtheneedforthisresearch.

Thethreeresearchquestionsansweredinthisstudywere:

1. Whatisorganizationalstructure?

Answer:Theresearchliteraturedepictsorganizationalstructureintwodimensions:structuralandcontextual.Thecontextualdimensionssignificantlyaffectthestructuraldimensions.

2. Whattheoriescontributetoorganizationalstructure?

Answer:Institutionalisomorphism,resourcedependence,populationecology,andstructuralcontingencyaredominantorganizationaltheoriesthatcontributetotheexplanationoforganizationalstructure.Ofthesefourtheories,structuralcontingencyprovidesapragmaticexplanationofhowtostructureorganizationsbasedoncontextandcontingency.Theenvironmentemergesasaprominentpointoffocusineverydominanttheory.Thelevelofuncertaintywithregardtotheorganization'sgeneralexternalenvironmentshowsastrongconnectiontostructuraltype.

43

3. Howshouldorganizationsstructureincyberenvironmentstodefendcriticalinfrastructure?

Answer:Theperceivedlevelofuncertainty,asmeasuredbythedegreeofcomplexity,dynamism,andmunificenceintheexternalenvironmentofcyberorganizationsrelateswelltothemechanisticandorganicstructuralcontinuum.Cyberorganizationsshouldstructureorganicallyinhighlyuncertainenvironmentsandmechanisticallyinlessuncertainenvironments.

Asitpertainstothecyber‐connectedcriticalinfrastructureenvironment,

forceswithinandacrossstrataareoverwhelminglynumerous,strongand

connecting.Theamountofchangeatpresentisveryhigh.Thespeedofchangeis

fastandresourcesaretypifiedbyanabundanceofinformationtechnologywithlow

barrierstoentrycreatingopportunityandavailabilityforadversaryandallyalike.

Theseelementscreatetheperceptionofahighlyuncertainsituationfor

organizationsoperatinginthecyber‐connectedcriticalinfrastructureenvironment.

Organicstructuringprinciplesallowfortheadaptabilityandflexibilitythis

environmentrequires.Thisresearchindicatesorganizationsshouldfolloworganic

structuringprincipleswhileoperatinginthecyber‐connectedcriticalinfrastructure

environment.

44

RecommendationsforFutureResearch

MeasureGovernmentCyberOrganizations.

Thisresearchapproachedansweringthequestionofhowtostructure

organizationsincyberspacebyfirstanalyzingthecontextualdimensionofexternal

environmentaluncertainty.Itwillnowbeappropriateandhelpfultomeasure

empiricallystructuraldimensionsofgovernmentcyberorganizations(e.g.,DHSICS‐

CERT,USCYBERCOM),tocontributefurthertotheanswer.

ReplicatetheStudy.

ThisresearchfocusedontheU.S.only.HowevertheU.S.isnottheonly

countryinneedofstrategicdirectioninthecreationofcyberorganizationstasked

toprotectcriticalinfrastructure.Areplicativestudyforotheralliednationswho

mutuallysupportcyberalongsidetheU.S.(GreatBritain,Australia,Canada,andNew

Zealand),wouldcontributetotheoverallsecurityofeachnation.

IdentifyDominantFactorsforMunificence.

Munificence(resource)inthisresearchisbroadlydefined.Withtheinsight

gainedfromthisstudy,itisapparentthatresourceincyberwouldbenefitfrom

structuralequationmodeling(e.g.,confirmatoryfactoranalysis).Thisresearchwill

aidintheidentificationofdominantresourcefactorsinthecyber‐connectedcritical

infrastructureenvironment.

45

AppendixA.ArtifactFinalSelection(FrontPageInformation)

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

AppendixB.ArtifactsMeetingSelectionCriteria

AASurveyofSCADAandCriticalInfrastructureIncidentsAATaxonomyofCyberAttacksonSCADASystemsAAWeb‐BasedRemoteLabforSCADAAAdvancedKeyforSecureSCADAACapabilitiesofDynamicReconfigurationMBICSACIDependencyAssessmentACreatingaCyberMovingTargetforCIACriticalInfrastructureDependenciesACyberCIProtectPayloadAnomalyDetectionACyberSecurityRiskAssessmentforSCADAandDCSNetworks2007ISATransactionsADecentralizedRiskManagementCIADetectingIntrusionsinSCADASystemsAEventTriggeredStratICSAFPGAsinIndustrialControlApplicationsAGSMSMSBasedMonitoringControlSystemsAImprovingSecurityforSCADAControlSystemsAIntrusionDetectioninSCADAAMethodologiesandApplicationsforCIANetworkIntrusionDetectionM0DBUSICSANetworkedControlSystemOverviewandResearchTrendsAProbabilisticRiskinCIAPublicPrivateCIARethinkingSecurityPropertiesSCADAASCADASecurityinLightofCyberWarfareASCADATestbedASecuritylssuesinSCADANetworksASecurityRetrofitforSCADAASecurityStrategiesforSCADANetworksAStateoftheArtinCIProtectionAStealthyDeceptionAttacksonWaterSCADASystemsATheCyberThreatLandscapeChallengesandFutureResearchDirectionsComputersSecurityATheSCADAChallengeSecuringCriticalInfrastructure2009NetworkSecurityAWindTurbinesSCADAAWinnHoneypotsPAmericasCIisvulnerabletoCyberForbesPAutomationWorldscada‐attacks‐double‐2014PCrashingtheSystemCITheEconomist

66

PCriticalInfrastructureSecurityVulnerabilityTripwirePCSISInsuringICSSecurityPCyberattacksEscalateCIHomelandSecTodayPDHSPhishingCITheHillPIntheCrossfirePMcAfeeIntheDarkPrivateCIViewPMcAfeeonCIGeneralPProtectingtheNationsCIfromCyberPSANSICSCIResponsePStudyHalfofCIprosAttackSCMagazinePSurveyRevealsCIIssuesPTrendMicro‐ReportonCybersecurityandCriticalInfrastructureintheAmericasPVerizonDataBreachPVerizonEnergyCIGArmyResearchLabICSSecurityGCIAssessmentSmartGridSecurityGCyberThreatsfromCRIProtectingCIGDHSIGSecureICSGDHSStrategyforSecuringControlSystemsGDHSYearEndAssessmentGExecutiveOrderImprovingCICybersecurityGGAOCIProtectObservationsGGAOMaritimeCIProtectionGGAO‐15‐290,High‐RiskSeriesCIGICSSummaryReportGIdentifying,Understanding,andAnalyzingCIInterdependGNISTcybersecurityframeworkGNISTGuidetoICSSecurity2008GNISTGuidetoIndustrialControlSystemsSecurity2011GPPDCISecurityGPresidentialCyberspacePolicyReview

67

AppendixC.RecordingUnitClassificationDiagram

68

AppendixD.CodedArtifactExample

69

70

71

AppendixE.CoderTrainingBriefing

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

Bibliography

1. H.Aldrich,OrganizationsandEnvironments,StanfordUniversityPress,StanfordCA,2008.

2. H.AldrichandD.Herker,Boundaryspanningrolesandorganizationstructure,AcademyofManagementReview,vol.2(2),pp.217‐230,1977.

3. H.AldrichandJ.Pfeffer,Environmentsoforganizations,AnnualReviewofSociology,vol.2,pp.79‐105,1976.

4. T.Barnett,BlueprintforAction:AFutureWorthCreating,BerkleyPublishingGroup,NewYorkNY,2005.

5. C.Bennett,U.S.notpreparedforcyberattacks,ex‐NSAchiefwarns,TheHill,November14,2014.

6. B.Berelson,ContentAnalysisinCommunicationResearch,FreePress,GlencoeIL,1952.

7. A.Bluedorn,Pilgrim’sprogress:Trendsandconvergenceinresearchonorganizationalsizeandenvironments,JournalofManagement,vol.19(2),pp.163‐191,1993.

8. S.Boyer,SCADA:SupervisoryControlandDataAcquisition(4thEdition),TheInstrumentation,Systems,andAutomationSociety,DurhamNC,2010.

9. O.BrafmanandR.Beckstrom,TheStarfishandtheSpider:TheUnstoppablePowerofLeaderlessOrganizations,Penguin,NewYorkNY,2006.

10. E.BumillerandT.Shanker,PanettawarnsofdirethreatofcyberattackonU.S.,NewYorkTimes,October11,2012.

11. T.Burns,andG.Stalker,TheManagementofInnovation,OxfordUniversityPress,NewYorkNY,1961.

12. J.Child,Organizationalstructure,environmentandperformance:Theroleofstrategicchoice,Sociology,vol.1(6),pp.1‐22,1972.

13. R.ClarkeandR.Knake,CyberWar,Harpercollins,NewYorkNY,2014.

88

14. J.Cohen,Acoefficientofagreementfornominalscales,EducationalandPsychologicalMeasurement,vol.20(1),pp.37‐46,1960.

15. S.CollyerandC.Warren,Projectmanagementapproachesfordynamicenvironments,InternationalJournalofProjectManagement,vol.27(4),pp.355‐364,2009.

16. J.Colquitt,J.LepineandM.Wesson,OrganizationalBehavior:ImprovingPerformanceandCommitmentintheWorkplace,McGraw‐Hill,NewYorkNY,2011.

17. R.Daft,J.SormunenandD.Parks,Chiefexecutivescanning,environmentalcharacteristics,andcompanyperformance:Anempiricalstudy,StrategicManagementJournal,vol.9(2),pp.123‐139,1988.

18. G.DessandD.Beard,Dimensionsoforganizationaltaskenvironments,AdministrativeScienceQuarterly,vol.29(1),pp.52‐73,1984.

19. T.DewettandG.Jones,Theroleofinformationtechnologyintheorganization:Areview,model,andassessment,JournalofManagement,vol.27(3),pp.313‐346,2001.

20. P.DiMaggioandW.Powell,Theironcagerevisited:Institutionalisomorphismandcollectiverationalityinorganizationalfields,AmericanSociologicalReview,vol.48(2),pp.143‐166,1983.

21. L.Donaldson,Strategyandstructuraladjustmenttoregainfitandperformance:Indefenceofcontingencytheory,JournalofManagementStudies,vol.24(1),pp.1‐24,1987.

22. L.Donaldson,Thecontingencytheoryoforganizationaldesign:Challengesandopportunities,inOrganizationDesign,R.Burton,B.Eriksen,D.HkonssonandC.Snow(Eds.),Springer,NewYorkNY,pp.19‐40,2006.

23. L.Donaldson,Thenormalscienceofstructuralcontingencytheory,inStudyingOrganizations:TheoryandMethod,S.CleggandC.Hardy(Eds.),Sage,ThousandOaks,California,pp.51‐70,1999.

24. R.Duncan,Characteristicsoforganizationalenvironmentsandperceivedenvironmentaluncertainty,AdministrativeScienceQuarterly,vol.17(3),pp.313‐327,1972.

89

25. P.Fiss,Buildingbettercausaltheories:Afuzzysetapproachtotypologiesinorganizationresearch,AcademyofManagementJournal,vol.54(2),pp.393‐420,2011.

26. R.Flesch,HowtoWritePlainEnglish:ABookforLawyersandConsumers,HarperandRow,NewYorkNY,1979.

27. M.Gladwell,Blink:ThePowerofThinkingWithoutThinking,BackBayBooks,NewYorkNY,2007.

28. R.GoodingandJ.WagnerIII,Ameta‐analyticreviewoftherelationshipbetweensizeandperformance:Theproductivityandefficiencyoforganizationsandtheirsubunits,AdministrativeScienceQuarterly,vol.30(4),pp.462‐481,1985.

29. L.GordonandV.Narayanan,Managementaccountingsystems,perceivedenvironmentaluncertaintyandorganizationstructure:Anempiricalinvestigation,Accounting,OrganizationsandSociety,vol.9(1),pp.33‐47,1984.

30. GovernmentAccountabilityOffice,ContentAnalysis:AMethodologyforStructuringandAnalyzingWrittenMaterial,WashingtonDC,1996.

31. R.Harris,Organizationaltaskenvironments:Anevaluationofconvergentanddiscriminantvalidity,JournalofManagementStudies,vol.41(5),pp.857‐882,2004.

32. A.Ilinitch,R.DAveniandA.Lewin,Neworganizationalformsandstrategiesformanaginginhypercompetitiveenvironments,OrganizationScience,vol.7(3),pp.211‐220,1996.

33. D.Jacobs,Dependencyandvulnerability:Anexchangeapproachtothecontroloforganizations,AdministrativeScienceQuarterly,vol.19(1),pp.45‐59,1974.

34. P.Khandwalla,Environmentanditsimpactontheorganization,InternationalStudiesofManagementandOrganization,vol.2(3),pp.297‐313,1972.

35. J.Kincaid,R.Fishburne,R.RogersandB.Chissom,DerivationofNewReadabilityFormulas(AutomatedReadabilityIndex,FogCountandFleschReadingEaseFormula)forNavyEnlistedPersonnel,NavalTechnicalTrainingCommandMillingtonTNResearchBranch,MillingtonTN,1975.

90

36. T.Koppel,LightsOut:ACyberattack,ANationUnprepared,SurvivingtheAftermath,CrownPublishers,NewYorkNY,2015.

37. K.Krippendorff,ContentAnalysis:AnIntroductiontoitsMethodology,SagePublications,ThousandOaks,California,2013.

38. J.LandisandG.Koch,Themeasurementofobserveragreementforcategoricaldata,Biometrics,vol.33(1),pp.159‐174,1977.

39. P.Lawrence,andJ.Lorsch,Differentiationandintegrationincomplexorganizations,AdministrativeScienceQuarterly,vol.12(1),pp.1‐47,1967.

40. C.Liao,S.ChuangandP.To,Howknowledgemanagementmediatestherelationshipbetweenenvironmentandorganizationalstructure,JournalofBusinessResearch,vol.64(7),pp.728‐736,2011.

41. Z.Liu,D.Yang,D.Wen,W.ZhangandW.Mao,Cyber‐physical‐socialsystemsforcommandandcontrol,IEEEIntelligentSystems,vol.26(4),pp.92‐96,2011.

42. M.Lombard,J.Snyder‐duchandC.Bracken,Contentanalysisinmasscommunication,HumanCommunicationResearch,vol.28(4),pp.587‐604,2002.

43. C.OkoliandS.Pawlowski,TheDelphimethodasaresearchtool:Anexample,designconsiderationsandapplications,InformationandManagement,vol.42(1),pp.15‐29,2004.

44. P.Olson,WeAreAnonymous:InsidetheHackerWorldofLulzSec,Anonymous,andtheGlobalCyberInsurgency,BackBayBooks,NewYorkNY,2012.

45. W.Orlikowski,Thedualityoftechnology:Rethinkingtheconceptoftechnologyinorganizations,OrganizationScience,vol.3(3),pp.398‐427,1992.

46. M.Patten,UnderstandingResearchMethods:AnOverviewoftheEssentials(7thEdition),PyrczakPublishing,GlendaleCA,2009.

47. J.Pfeffer,OrganizationsandOrganizationTheory,Pitman,BostonMA,1982.

48. J.PfefferandH.Leblebici,Theeffectofcompetitiononsomedimensionsoforganizationalstructure,SocialForces,vol.52(2),pp.268‐279,1973.

91

49. J.PfefferandG.Salancik,TheExternalControlofOrganizations:AResourceDependenceApproach,HarperandRow,NewYorkNY,1978.

50. D.Pugh,Themeasurementoforganizationstructures:Doescontextdetermineform?,OrganizationalDynamics,vol.1(4),pp.19‐34,1973.

51. J.Qiu,L.DonaldsonandB.Luo,Thebenefitsofpersistingwithparadigmsinorganizationalresearch,TheAcademyofManagementPerspectives,vol.26(1),pp.93‐104,2012.

52. M.Savin‐BadenandC.Major,QualitativeResearch:TheEssentialGuidetoTheoryandPractice,Routledge,Abingdon,UnitedKingdom,2012.

53. G.Seffers,Cybercommanderexpectsdamagingcriticalinfrastructureattack,Signal,December1,2014.

54. S.Stemler,Anoverviewofcontentanalysis,PracticalAssessment,ResearchandEvaluation,vol.7(17),2001.

55. M.TushmanandR.Nelson,Introduction:Technology,organization,andinnovation,AdministrativeScienceQuarterly,vol.35(1911),pp.18,1990.

56. U.S.Army,ForceDevelopmentandDocumentation,DepartmentoftheArmy,AR71‐32,GovernmentPrintingOffice,WashingtonDC,2013.

57. A.VandeVenandD.Ferry,MeasuringandAssessingOrganizations,JohnWileyandSons,NewYorkNY,1980.

58. R.Weber,BasicContentAnalysis(SecondEdition),SagePublications,ThousandOaksCA,1990.

59. S.Worrall,IstheUnitedStatesPreparedforaMassiveCyberattack?,NationalGeographic,WashingtonDC(news.nationalgeographic.com/2015/11/151108‐cybercrime‐cyberattack‐ted‐koppel‐computers‐hacking‐internet‐ngbooktalk),2015.

60. R.Yin,CaseStudyResearchDesignandMethods,SagePublications,ThousandOaks,California,2014.

REPORTDOCUMENTATIONPAGEFormApprovedOMBNo.074‐0188

Thepublicreportingburdenforthiscollectionofinformationisestimatedtoaverage1hourperresponse,includingthetimeforreviewinginstructions,searchingexistingdatasources,gatheringandmaintainingthedataneeded,andcompletingandreviewingthecollectionofinformation.Sendcommentsregardingthisburdenestimateoranyotheraspectofthecollectionofinformation,includingsuggestionsforreducingthisburdentoDepartmentofDefense,WashingtonHeadquartersServices,DirectorateforInformationOperationsandReports(0704‐0188),1215JeffersonDavisHighway,Suite1204,Arlington,VA22202‐4302.Respondentsshouldbeawarethatnotwithstandinganyotherprovisionoflaw,nopersonshallbesubjecttoanypenaltyforfailingtocomplywithacollectionofinformationifitdoesnotdisplayacurrentlyvalidOMBcontrolnumber.PLEASEDONOTRETURNYOURFORMTOTHEABOVEADDRESS.1.REPORTDATE(DD‐MM‐YYYY)

24‐03‐20162.REPORTTYPE

Master’sThesis3.DATESCOVERED(From–To)

Aug2014‐Mar20164.TITLEANDSUBTITLE

CyberspaceandOrganizationalStructure:AnAnalysisoftheCriticalInfrastructureEnvironment

5a.CONTRACTNUMBER

5b.GRANTNUMBER

5c.PROGRAMELEMENTNUMBER

6.AUTHOR(S)

QuiggII,MichaelD.,Captain,USA

5d.PROJECTNUMBER

JON:15G2645e.TASKNUMBER

5f.WORKUNITNUMBER

7.PERFORMINGORGANIZATIONNAMES(S)ANDADDRESS(S)

AirForceInstituteofTechnologyGraduateSchoolofEngineeringandManagement(AFIT/EN)2950HobsonWay,Building640WPAFBOH45433‐8865

8.PERFORMINGORGANIZATIONREPORTNUMBER

AFIT‐ENV‐MS‐16‐M‐177

9.SPONSORING/MONITORINGAGENCYNAME(S)ANDADDRESS(ES)

DepartmentofHomelandSecurityICS‐CERTPOC:NeilHershfield,DHSICS‐CERTTechnicalLeadATTN:NPPD/CSC/NCSD/US‐CERTMailstop:0635,245MurrayLane,SW,Bldg410,Washington,DC20528Email:ics‐cert@dhs.govphone:1‐877‐776‐7585

10.SPONSOR/MONITOR’SACRONYM(S)

DHS11.SPONSOR/MONITOR’SREPORTNUMBER(S)

12.DISTRIBUTION/AVAILABILITYSTATEMENT

DISTRIBUTIONSTATEMENTA.APPROVEDFORPUBLICRELEASE;DISTRIBUTIONUNLIMITED.

13.SUPPLEMENTARYNOTES

ThismaterialisdeclaredaworkoftheU.S.GovernmentandisnotsubjecttocopyrightprotectionintheUnitedStates.

14.ABSTRACT

Nowmorethanever,organizationsarebeingcreatedtoprotectthecyberspaceenvironment.Thecapabilityofcyberorganizationstaskedtodefendcriticalinfrastructurehasbeencalledintoquestionbynumerouscybersecurityexperts.Organizationaltheorystatesthatorganizationsshouldbeconstructedtofittheiroperatingenvironmentproperly.Littleresearchinthisarealinks existingorganizationaltheorytocyberorganizationalstructure.Becauseofthecyberspaceconnectiontocriticalinfrastructureassets,thefactorsthatinfluencethestructureofcyberorganizationsdesignedtoprotecttheseassetswarrantanalysistoidentifyopportunitiesforimprovement.Thisthesisanalyzesthecyber‐connectedcriticalinfrastructureenvironmentusingthedominantorganizationalstructuretheories.Byusingmultiplecasestudyandcontentanalysis,2,856samplingunitsrelatingtoenvironmentaluncertainty(complexity,dynamism,andmunificence) areanalyzedtoshowthegeneralexternalenvironmentofcyberorganizationstaskedtoprotectcriticalinfrastructureishighlyuncertaintherebymeritingimplementationoforganicstructuringprinciples.15.SUBJECTTERMS

Cyberorganizations,organizationalstructure,criticalinfrastructureprotection,contentanalysis,multiplecasestudy

16.SECURITYCLASSIFICATIONOF: 17.LIMITATIONOFABSTRACT

UU

18.NUMBEROFPAGES

103

19a.NAMEOFRESPONSIBLEPERSON

Rice,Mason,ENG,LTC,Ph.D,USAa.REPORT

U

b.ABSTRACT

U

c.THISPAGE

U19b.TELEPHONENUMBER(Includeareacode)(937)255‐3636x4620(mason.rice@afit.edu)

StandardForm298(Rev.8‐98)PrescribedbyANSIStd.Z39‐18