A capabilities approach to the prioritization of critical infrastructure

As the utilization of cyber systems in the management and operation of critical infrastructures have grown, the cybersecurity threats to critical infrastructure sectors such as energy, healthcare, transportation and water simultaneously increased exponentially. Critical infrastructures in developing countries are particularly vulnerable to growing cybersecurity threats due to limited resources, inadequate cybersecurity policies and a general shortage of skilled cybersecurity specialists. Addressing these vulnerabilities is essential for developing countries to ensure the operational continuity, data protection and public safety associated with functioning critical infrastructures. An explorative literature review identified a number of aspects that can be used to counter the increasing cybersecurity threats to critical infrastructures in developing countries. Literature suggests that although there are defined norms and standards for critical infrastructures in developing countries, there is room for improvement in terms of the contribution that enhanced cybersecurity awareness can accomplish. A good cybersecurity awareness program must include sufficient training that is aligned with an organization’s objectives, focus on raising cybersecurity awareness while performing normal duties whilst creating an interactive cybersecurity communication culture between all stakeholders. This paper presents research that is in progress to develop a functional cybersecurity governance maturity model aimed at capacitating role players responsible for the safeguarding of critical infrastructure systems in developing countries. The primary aim of the evolving Critical Infrastructure Cyber Governance Maturity Model (CICGM²) is to improve the cybersecurity governance of critical infrastructure systems in developing countries. The purpose of the article is to specifically describe how the CICGM² can be used to assess and determine the level of maturity of cybersecurity awareness programs at critical infrastructures in developing countries. The integration of recognized cybersecurity governance frameworks and established cybersecurity maturity models into the CICGM² presents unique opportunities to establish, measure and manage cybersecurity awareness initiatives at critical infrastructure systems in developing countries. This article contributes to the field of cybersecurity governance by offering a non-technical, scalable and adaptable CICGM² for key stakeholders at critical infrastructures in developing countries that can be used to determine the level of the cybersecurity awareness initiatives for the facilities that they are responsible for.

Strengthening Resilience of Electricity Critical Infrastructure in the Context of Railway Transport

The fifteenth volume of a new, well-received and highly acclaimed series on critical infrastructure, Emergency Services Sector Protection and Homeland Security is an eye-opening account which discusses the unique challenges this industry faces and the deadly consequences that could result if there was a failure or disruption in the emergency services sector. The Emergency Services Sector (ESS) is crucial to all critical infrastructure sectors, as well as to the American public. As its operations provide the first line of defense for nearly all critical infrastructure sectors, a failure or disruption of the Emergency Services Sector (ESS) would be devastating. Emergency Services Sector Protection and Homeland Security was written to provide guidelines to improve the protections and resilience of this infrastructure.

When Cyber Threats Loom, What Can State and Local Governments Do? Josephine Wolff (bio) and William Lehr (bio) State and local governments in the United States often struggle to muster sufficient funds and technical expertise to tackle the cybersecurity threats they face. A 2016 survey of 464 state, local, tribal, and territorial government entities conducted by the Multi-State Information Sharing and Analysis Center (MS-ISAC) found that these groups "show slow growth in their cybersecurity maturity" and are hindered primarily by a lack of resources.1 Allocating more resources for cybersecurity is therefore a crucial step for governments, but given the budget constraints public sector institutions face, it is not realistic to expect them to tackle every component of a comprehensive cybersecurity strategy on their own. Ideally, state and local governments would receive support from the federal government and regularly partner with federal agencies to address these threats and augment their limited resources. However, instead of fostering productive partnerships, these different levels of governments have found themselves at odds in the aftermath of serious cybersecurity incidents, hindering the ability to work together toward defending critical cyber infrastructure against attacks and mitigating the impacts of computer security breaches. Nevertheless, local, state, and federal governments should prioritize their strategic strengths when it comes to cybersecurity and invest their resources accordingly, relying on other levels of government to reinforce their weaknesses and provide additional funding and expertise as needed. For instance, in 2012, after the South Carolina Department of Revenue's (SCDOR) [End Page 67] computer systems were breached by intruders who stole 3.5 million tax records containing personal information of more than 75 percent of the population of South Carolina, the state government of South Carolina placed blame for the incident on a federal government agency, the Internal Revenue Service. Then-governor of South Carolina Nikki Haley insisted at the time of the breach, "There wasn't anything where anyone in state government could have done anything to avoid it."2 Instead of taking responsibility on the state government, she faulted the IRS for failing to require state revenue departments to encrypt their sensitive tax records, calling the IRS rules for data protection "archaic."3 The IRS, in turn, lashed out at South Carolina for failing to follow security standards recommended by the National Institute of Standards and Technology (NIST).4 This back-and-forth captures some of the challenges of promoting strong cybersecurity partnerships between the federal government and state or local governments: despite a common goal, they are often suspicious of each other's motives and eager to cast blame for failures and breaches because of both political and liability issues. More recently, this dynamic has given rise to tensions around the protection of voting systems, with some states rejecting the help proffered by federal government agencies such as the Department of Homeland Security (DHS) in 2018 to help assess and secure their voting technology.5 Government officials in several other states expressed suspicion in 2016 when DHS considered reclassifying voting technology as "critical infrastructure" for the purposes of enhanced protection.6 While all levels of government presumably share the goal of administering secure elections, their wariness of any interference and sense of mutual distrust has hindered attempts to partner effectively and pool their resources and expertise. In this paper, we consider how state and local governments can better leverage their particular strengths and capabilities to help mitigate the economic impact of cybersecurity incidents and data breaches. The first section identifies cybersecurity strengths and weaknesses of different levels of government and recommends how they should invest their resources and when they should look to other government entities for assistance. The second section focuses on the emerging classes of threats in cyberspace that state and local governments need to be better prepared to address, especially in light of the weaknesses identified in the first section. We emphasize how criminal business models are changing with the rise of threats such as ran-somware, extortion, and insurance fraud, and the ways in which state and local governments must adapt their policing and defensive efforts to these new types of threats and the associated schemes for monetization of stolen or compromised data...

The attacks of 9/11 highlighted irrefutable vulnerabilities in the US critical infrastructure system and prompted necessary efforts to strengthen defence and resiliency of infrastructure against attack. As critical infrastructures become more dependent on cyber resources, the threat landscape continues to rapidly evolve exposing critical infrastructure to a heightened risk of cyber-attacks. The Department of Homeland Security's Risk Management Framework was developed to guide protection efforts and depends heavily on the ability of the department to effectively identify critical infrastructure assets. However, program audits have reported fundamental flaws in the US identification and prioritisation program. Specifically, there is a need for validation and verification that the right assets are being considered in order to ensure that scarce national resources are not wasted towards protection of the wrong assets. This paper summarises US critical infrastructure identification efforts, ongoing challenges to current programs, and recommendations for moving forward.

By 2030, forecasts suggest that urban areas will house 60 percent of the world’s population and one in every three people will live in cities with at least half a million inhabitants. Within the same time frame, the number of global megacities is expected to jump from 33 today to 43 in 2030 [1]. Underpinning these large urban areas will be an interconnected network of critical physical infrastructures reliant on Internet-connected Industrial Control Systems and susceptible to increasingly sophisticated, e.g., AI-enabled, cyber threats. In hand, the cyber threat landscape is shifting rapidly. We are seeing a sharp rise in the number of cyberattacks on critical infrastructure [2] with significant impacts cascading across multiple sectors and causing disruption to the provisioning of essential goods and services. Security scholars suggest that these impacts are not always equitable and that disruption to critical infrastructure can affect vulnerable groups differently [3], which further emphasizes the need to improve cybersecurity between critical infrastructure sectors [4]. Through structured analysis of city statistics, demographic information, cyber incidents, and current cyber policy, our presentation will articulate potential social implications of megacity growth through the lens of cyber-physical infrastructure disruption. We investigate the largest 15 megacities in the world and find that megacities continue to grow in population but not in cyber policy. We highlight recent examples of cyber-physical disruption in Mumbai and New York City with focus on implications for vulnerable populations. Our work suggests the need for future research on social responsibility regarding security of these critical infrastructure sectors and on the need for technology-focused law, policy, and regulation guidelines.

Rural Alaskan communities rely on critical infrastructure systems (CIS) (e.g., water systems, transportation) for health, safety, and economic opportunity. These critical services are often distributed in a “hub-and-spoke” model, meaning that urban centers provide resources to surrounding hub towns (intermediate hubs) and smaller communities (the spokes), enabling residents of remote villages to access key services. These networks are complex, as they span various geographic hierarchies while interfacing with multiple infrastructure systems. For instance, the transportation network moves essential supplies and resources for operations, maintenance, and construction of other sectors. However, in rural Alaska, the structure of individual CIS across geographical hierarchies (i.e., villages, hub towns, and urban centers) and the types of interdependencies that support this structure are largely unexplored in literature. As these interfaces provide both sources of vulnerability and resilience, an understanding of how services and resources reach small villages is critical for decision-making entities in emergency management, supply chain and logistics, infrastructure provision, and public health. Enabled by semi-structured interview data with key regional infrastructure providers and semi-cognitive systems mapping, this study fills this gap in knowledge by mapping critical infrastructure interdependencies in this context. Findings show that CIS can be described by the level of service available to village residents without leaving the village itself, and advanced service typically requires resources from the hub towns and urban centers. Infrastructure networks rely heavily on transportation and telecommunications, posing significant financial and logistical challenges. Further, environmental variability threatens multi-systemic disruptions. Policy suggestions include flexible federal funds to develop transportation, R&D of emerging technologies in decentralized infrastructure, and relevant policy changes specific to the needs of rural Alaska, such as region-specific operator certifications.

Abstract: The growing scientific interest in the field of critical infrastructure protection has been determined by society's growing dependence on the essential services provided by these infrastructures. Critical infrastructures do not work isolated, they establish complex and dynamic networks of interdependencies. A critical infrastructure is itself a system with its own components and operating principles, a system connected to a system of systems based on multiple determinations. Critical infrastructure systems are built based on interdependent relationships between infrastructures, manifesting itself as an open system that relates to the macro-social system. Critical infrastructure systems behave dynamically and react to external stimuli represented by threats. Interdependencies between critical infrastructures generate new vulnerabilities and threats, based on the spread of effects and consequences. A comprehensive approach for critical infrastructure risks requires a systemic approach, taking into account that the interconnection of critical infrastructure objectives also involves the interconnection of threats and vulnerabilities.

Given the unforeseen events that take continue to place worldwide, cities are experiencing rapid transformations. To maintain their basic functions, cities have to be resilient– possess the ability to bounce back to their original state following extreme events. Unfortunately, the behavior of cities is complex because of the interdependence among their comprising infrastructure systems. The current work presents a critical review of research work pertaining to resilience of cities’ critical infrastructure systems. To conduct such review, meta-research is employed through text analytics, in the form of topic modelling, to quantitatively uncover related latent topics in pertinent literature. Subsequently, the identified topics are qualitatively analyzed in terms of established definitions and metrics for resilience as well as adopted simulation approaches for infrastructure systems interdependence. Accordingly, nine common topics and five major research gaps are identified. This meta-research study is a steppingstone towards better understanding of infrastructure systems interdependence simulation and their resilience quantification approaches.

Space as a critical infrastructure: An in-depth analysis of U.S. and EU approaches

As the climate crisis accelerates, the resilience of Europe's aging critical infrastructure systems shifts more and more into focus. However, the rising interconnectedness of critical infrastructure systems and the dependency of their operation on multiple stakeholders makes approaches that target the resilience of isolated infrastructures insufficient and might even result in a decrease of the resilience of the whole system. This need for more resilience thinking in interconnected infrastructure systems has resulted in advances in risk analyses of supply chains and analyses of interdependencies in infrastructure systems from a Critical Infrastructure Protection/Resilience perspective. However, results from such analyses on the level of interconnected infrastructure systems have seldomly be broken down to the level of individual corporate value chains, a necessity as national/regional resilience efforts need to be supported on the local level. In this paper we therefore propose a novel approach for value chain climate risk and vulnerability analysis that combines a participatory, indicator-based approach with a semi-quantitative risk matrix approach to allow linking analyses from national to local scale and supports economic assessment of climate change impacts for individual businesses. This approach has been developed and prototypically applied in a case study in a German metropolitan area located at the Rhine River. The results allow to identify where along the dependency chains of interconnected infrastructure systems, hazards and impacts might manifest, which cascading (economic) impacts result on the level of individual infrastructure operators, and where resilience measures should be taken to be most effective and (cost) efficient.

The article provides a comprehensive study of theoretical and methodological approaches, as well as practical mechanisms for identifying critical infrastructure facilities in both international and national contexts. The relevance of the topic is driven by the expanding range of hybrid threats, the transformation of the international security environment, and the need to establish a resilient national security architecture for Ukraine under martial law. The authors contend that identifying critical facilities and creating a national registry is a complex task due to the diversity of infrastructure elements, their large scale, and the multidimensional nature of their characteristics. This necessitates the application of a scientifically grounded methodology, an interdisciplinary approach, and systematic updating of the information base. The aim of the study is to synthesize international experience and analyze Ukrainian practices for identifying critical infrastructure assets, determining their categorization and sectoral classification in light of current challenges. The methodological framework includes systemic and comparative analysis, structural-logical generalization, risk-oriented and modeling approaches, as well as the analysis of the EU, NATO, and Ukrainian legal and regulatory acts. The work examines key foreign models: the French model (institutional-organizational, based on the concept of «vital operators»), the British model (sectoral-hierarchical with multi-level criticality assessment), the Dutch model (process-oriented), the German model (integrating technical and socioeconomic components), and the Israeli model (multidimensional, combining cultural-symbolic, functional-economic, and system-structural dimensions). Particular attention is given to the European regulatory framework, represented by Council Directive 2008/114/EC, Directive (EU) 2022/2557, and Commission Delegated Regulation (EU) 2023/2450, which define the modern system of criteria for identifying and categorizing critical infrastructure, including at the cross-border level. The scientific value lies in the substantiation of the classification of Ukraine’s critical infrastructure sectors into four blocks – economic, social, security, and managerial. This systematization allows for the integration of the national protection system into European and international practices, facilitates cross-sectoral analysis of risks and vulnerabilities, creates conditions for conducting LMDI and PSS analyses of the impact of individual sectors on the State resilience, and for developing national security indicators aligned with global standards. Furthermore, the unification of terminology and approaches strengthens the capacity to attract international technical and financial assistance. The summary shows that the Ukrainian model largely mirrors the approaches of the EU and NATO, while also maintaining unique features. First, there is an expanded detailing of the economic sector (notably the inclusion of the agro-industrial complex, the State reserve, and energy engineering). Second, the institutionalization of the electoral process as an element of critical infrastructure, which is almost absent in the EU and NATO classifications. At the same time, international models place greater emphasis on governance continuity and strategic communications, which are only partially integrated into the Ukrainian administrative framework. The practical significance of the results lies in the possibility of using the studied approaches to refine the national legal and regulatory framework, develop comprehensive criticality indicators, improve risk management mechanisms, and harmonize the Ukrainian system with international standards. In the long term, this will facilitate the development of a more resilient, adaptive, and integrated critical infrastructure system, capable of ensuring the continuity of essential societal functions and countering contemporary multidimensional threats.

The complete failure of the power systems infrastructure in Puerto Rico, following Hurricanes Irma and Maria in 2017, severely hampered the recovery efforts of multiple critical infrastructure systems (CIS). Understanding the relationships of infrastructure recovery efforts between power infrastructure systems and the other CIS has the potential to be a key in developing an effective recovery plan leading to resilient infrastructure systems, and thereby a more resilient community. This paper explores the critical interfaces and interdependencies in CIS recovery by examining the disruptions and recovery progress of the CIS, including the power infrastructure systems, in Puerto immediately following the events of Hurricane Maria. This research uncovers that strong CIS recovery interdependency relationships exist between the power infrastructure systems and other CIS in Puerto Rico, and these relationships contribute to the resilience of these CIS. The resultant CIS recovery associations may potentially predict the recovery progress of post-disaster CIS recovery centered on the power infrastructure systems and lay the groundwork for further interdependency analysis of CIS in post-disaster scenarios. The results may also be helpful while designing CIS for resiliency in natural disaster areas.

Computer Security Incident Response Teams (CSIRTs) provide information security incident response services to communities. The South African Cybersecurity Hub (SACH) acts as a national point of contact for the coordination of cybersecurity incidents in South Africa, but to date has only been successful in assisting with the establishment of a finance sector CSIRT. No mention of a transport or critical infrastructure sector CSIRT, under which an aviation CSIRT can report aviation sector cyber-attacks is made. The aviation community is mandated to sustain safety and security of operations and passengers in Southern Africa. Acknowledging the urgency and importance of protecting civil aviation’s critical infrastructure, information and communication technology systems and data against cyber threats this research identifies that there is a need for a CSIRT framework for the Sub-Saharan aviation community. An aviation CSIRT should implement frameworks, programs and international information security standards, and aviation communities need to share cyber information with the CSIRT. To achieve such a framework, globally established CSIRTs are reviewed. Since the aviation sector is complex to manage, there is a need to establish an integrated CSIRT approach that include stakeholders within the ecosystem. A proposed aviation CSIRT requires the adoption of best practice cyber security incident response standards as a practical solution to manage aviation cyberattacks.

The article describes terrorist and sabotage attacks carried out worldwide against two major critical infrastructure (CI) systems: energy supply and public transport. The selection of the events described in the article was subjective. In the section on attacks on the energy sector, the author adopted a geographical division – Middle East, Africa and South America. In the section on attacks on public transport, the division includes land transport and air transport. In the case of terrorist attacks on rail infrastructure, the author mainly used Anneli Botha’s study covering data from 2000 to 2017 and the work of Brian M. Jenkins and Bruce R. Butterworth, and for air transport, the work of Jacques Duchesneau. Not all data on attacks on CI systems has been updated due to the fact that the information contained in the sources is partial. The author draws the conclusion that with the development of modern technology and the escalation of tensions in international relations, the level of threat to CI will increase.