Gestão de riscos cibernétcos operacionais : uma proposta para o aumento da capacidade cibernética da MB

Abstract

The growing technological dependence of the Brazilian Navy (MB), driven by its strategic projects, such as the Tamandaré Class Frigates, the Conventionally Armed Nuclear Submarine (SNCA) and the Blue Amazon Management System (SisGAAz), has brought operational gains, but has also significantly increased exposure to operational cyber risks. This paper aims to propose the implementation of Operational Risk Management (ORM) in the MB, focusing on operational cyber risk, as an instrument to strengthen cyber capability, protect critical assets and ensure the continuity of operations. The methodology adopted was based on the comparative analysis between the United States Navy (USNAVY) model, consolidated by the OPNAVINST 3500.39D standard, and the current situation of the MB, observing the domains of people, processes, technologies and external events. The diagnosis showed that, while USNAVY applies ORM comprehensively, both in the administrative and operational and cyber environments, the Navy maintains a restricted approach, focused on administrative aspects and with relevant gaps in the protection of Digital Operating Systems (DOS) and critical infrastructures. As a result, structured proposals are presented for the creation of a specific ORM standard, a dedicated organizational structure, the integration of international frameworks (NIST and ABNT) and the implementation of a computerized risk management system, increasing the resilience and cybersecurity of the Navy, in addition to recommending the formalization of the concept of operational risk in the Glossary of the Armed Forces