Computer and information systems are now at the core of numerous critical infrastructures. However, their security management is by far not a trivial issue. Further, these systems, by their very nature, belong to the domain of complex systems, where system dynamics (SD) is an established method, which aims at modelling such systems, their analysis and understanding. Further, on this basis it enables simulation of various policies to properly manage complex systems. More precisely, through understanding of the basic elements of the whole mosaic and their interplay, proper incentives can be tested. And this is important, because proper incentives can lead to the desired patterns of behavior of such systems, which may often be counter-intuitive. Therefore this paper presents a novel approach by using SD for managing critical infrastructures (more precisely the internet) when it comes to security related incentives. Based on already developed archetypes it provides a template model that bridges these conceptual models with concrete models that are suited to particular environments, and enable quantitative simulations.