Skip to content
Electronic Modeling
UKEN
Menu

The Concept of Multidimensional Security Risk in Sociotechnical Systems in Modeling the Processes of Systemic Threats

O. Bakalynskyi

Èlektron. model. 2026, 48(5):03-28

Full text (PDF)

Українська версія

Abstract

A concept of multidimensional security risk in socio-technical systems is proposed as a generalization of the classical two-component risk model. It is shown that an increase in the number of risk components leads to an increase in the dimensionality of the risk space and the formation of new system properties that cannot be explained within the framework of traditional additive approaches. To describe the interaction between risk components, a model of interdependent risks and a matrix of interdependencies have been developed, which allow for the formalization of the nonlinearity of risk formation processes. The emergence of emergent properties and cascading processes as a consequence of interactions between risks is substantiated. It is established that systemic risk arises as a result of the development of multicomponent risk under conditions of interdependencies and cannot be represented by a simple sum of local risks. The scientific novelty is in the formalization of systemic risk as a non-additive property of a system of interacting risks. The practical significance of the obtained results is in the possibility of using them in the analysis of risks in critical infrastructure, the financial sector, payment systems, and other complex socio-technical systems.

Keywords

multidimensional risk, systemic risk, risk interdependencies, emergence, cascading processes, socio-technical systems, critical infrastructure, operational resilience

References

  1. ISO/IEC 27005:2022. Information security, cybersecurity and privacy protection — Guidance on managing information security risks. Geneva : ISO, 2022.
  2. ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Geneva : ISO, 2022.
  3. ISO 31000:2018. Risk Management — Guidelines. Geneva : ISO, 2018.
  4. Mokhor V.V., Bakalynskyi O.V., Bohdanov O.V., Tsurkan V.V. (2017) Interpretuvannia zalezhnosti rivnia prostoho ryzyku vid imovirnosti yoho realizuvannia v terminakh analitychnoi heometrii [Interpretation of the dependence of simple risk level on the probability of its realization in terms of analytical geometry]. Information Technology and Security. Vol. 5, No. 1(8). P. 71—81. (in Ukrainian).
  5. Rinaldi S.M., Peerenboom J.P., Kelly T.K. (2001). Identifying, Understanding and Analyzing Critical Infrastructure Interdependencies. IEEE Control Systems Magazine. Vol. 21, No. 6. P. 11—25.
  6. Ouyang M. (2014) Review on Modeling and Simulation of Interdependent Critical Infrastructure Systems. Reliability Engineering & System Safety. Vol. 121. P. 43—60.
  7. European Central Bank (ECB). Towards a Framework for Assessing Systemic Cyber Risk ECB Financial Stability Review. Frankfurt am Main : ECB, 2022.
  8. European Systemic Risk Board. Systemic Cyber Risk. —Frankfurt am Main : ESRB, 2020.
  9. International Monetary Fund. Global Financial Stability Report. — Washington, DC : IMF, 2024.
  10. Financial Stability Board. Financial Stability Implications of Operational Disruptions : Annual Report. Basel : FSB, 2025.
  11. Basel Committee on Banking Supervision. Principles for Operational Resilience. Basel : Bank for International Settlements, 2021.
  12. Financial Stability Board. Principles for Operational Resilience. Basel : FSB, 2021.
  13. European Banking Authority. Operational Resilience. Paris : EBA, 2025.
  14. Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on Digital Operational Resilience for the Financial Sector (Digital Operational Resilience Act — DORA).
  15. Kaplan S., Garrick B.J. (1981). On the Quantitative Definition of Risk. Risk Analysis. Vol. 1, No. 1. P. 11—27.
  16. Aven T. (2016) Risk Assessment and Risk Management: Review of Recent Advances on Their Foundation. European Journal of Operational Research. Vol. 253, No. 1. P. 1—13.
  17. Haimes Y.Y. (2015) Risk Modeling, Assessment and Management. 5th ed. Hoboken, NJ : Wiley.
  18. Hubbard D.W. (2020) The Failure of Risk Management: Why It’s Broken and How to Fix It. 2nd ed. Hoboken, NJ : Wiley.
  19. Cox L.A. (2008) What’s Wrong with Risk Matrices? Risk Analysis. Vol. 28, No. 2. P. 497—512.
  20. Buldyrev S.V., Parshani R., Paul G., Stanley H.E., Havlin S. (2010) Catastrophic Cascade of Failures in Interdependent Networks. Nature. Vol. 464. P. 1025—1028.
  21. Gao J., Buldyrev S.V., Stanley H.E., Havlin S. (2012) Networks Formed from Interdependent Networks. Nature Physics. Vol. 8. P. 40—48.
  22. Holland J.H. (1998) Emergence: From Chaos to Order. Reading, MA : Addison-Wesley.
  23. Mitchell M. (2009) Complexity: A Guided Tour. Oxford : Oxford University Press.
  24. Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the Resilience of Critical Entities (CER Directive).
  25. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on Measures for a High Common Level of Cybersecurity Across the Union (NIS2 Directive).
  26. European Union Agency for Cybersecurity (ENISA). ENISA Threat Landscape 2024. Heraklion : ENISA, 2024.
  27. European Commission Joint Research Centre. Critical Entities Resilience Framework. Luxembourg : Publications Office of the European Union, 2022.
  28. Honchar S.F., Bakalynskyi O.O., Dybach O.M., Dimitriieva D.O. (2022) Metod ahrehuvannia ryzykiv u razi mnozhyny sumisnykh vypadkovykh podii [Method of risk aggregation under multiple compatible random events]. Yaderna ta Radiatsiina Bezpeka. No. 1(93). P. 46—52. DOI: 10.32918/nrs.2022.1(93).05. (in Ukrainian).

Received 30.06.2026