Critical infrastructure asset identification: seemingly simple but frustratingly elusive

Strengthening Resilience of Electricity Critical Infrastructure in the Context of Railway Transport

As a consequence of the U.S. effort to increase infrastructure security and resilience, the Department of Homeland Security (DHS) and other U.S. federal agencies have identified 16 critical infrastructure sectors that are considered vital to the nation’s well-being in terms of economic security, public health, and safety. However, there remains no articulated set of values that justify this particular list of infrastructure systems or how decision-makers might prioritize investments towards one critical sector over another during a crisis. To offer a more integrated and holistic approach to critical infrastructure resilience, this research employs the capabilities approach to human development, which offers an alternative view of critical infrastructure that focuses on the services that infrastructure provides rather than its physical condition or vulnerability to threats. This service-based perspective of infrastructure emphasizes the role of infrastructure in enabling and supporting central human capabilities that build adaptive capacity and improve human well-being. We argue that the most critical infrastructure systems are those that are essential for providing and/or supporting central human capabilities. This paper examines the DHS designation of criticality from a capabilities perspective and argues for a capabilities basis for making distinctions between those systems that should be considered most critical and those that might be temporarily sacrificed. A key implication of this work is that an across sector approach is required to reorganize existing critical infrastructure efforts around the most valuable infrastructure end-services.

Cloud Computing represents a new computing way that increases dynamically capabilities without investing new infrastructure. It become much adopted today thanks to many advantages like distributed computing, scalability and performance, multi-tenancy and pay per use services. However, it poses many serious security issues at all cloud delivery models. Software, Platform, and Infrastructure as a Service are the three main service delivery models for Cloud Computing. Infrastructure as a Service (IaaS) serves as the basis layer for the other delivery models, and a lack of security in this layer will affect the other delivery models. This paper presents a detailed study of IaaS components’ security and determines vulnerabilities and security solutions. Finally, to combat security repose, we present a security risk management framework for Cloud system to threats and vulnerabilities reduction security risks mitigation. The proposed security risk management framework is based on a quantitative security risk assessment model to evaluate risks for this system.

Assessing and strengthening organisational resilience in a critical infrastructure system: Case study of the Slovak Republic

: Among the leading concerns surrounding Homeland Security in the United States is Critical Infrastructure Protection (CIP). Identifying, prioritizing, and providing for the protection of infrastructure so vital to the United States that its incapacity or destruction would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters is one of the most compelling issues facing the Department of Homeland Security, its interagency partners, state and local governments, and the private sector. On 25 May 2004, the Army War College's Center for Strategic Leadership hosted a senior symposium dedicated to examining the United States' evolving strategies for the protection of critical infrastructure and key assets in our country. The forum brought together a distinguished panel of seven retired generals and senior civilian officials, from both the public and private sectors, all actively involved in homeland security issues. The immediate intent of the symposium was to gather insights on the directions taken by these strategies for use in future studies, wargames and syllabus development addressing the changing face of homeland security. At the same time, the Center hoped to use the insights as a springboard for an expanded symposium on CIP, In Support of the Common Defense, which took place at Collins Hall on from 25-26 August. By extension, the War College hoped to contribute in the search for the surest path to the inherently complex end of critical infrastructure protection.

When Cyber Threats Loom, What Can State and Local Governments Do? Josephine Wolff (bio) and William Lehr (bio) State and local governments in the United States often struggle to muster sufficient funds and technical expertise to tackle the cybersecurity threats they face. A 2016 survey of 464 state, local, tribal, and territorial government entities conducted by the Multi-State Information Sharing and Analysis Center (MS-ISAC) found that these groups "show slow growth in their cybersecurity maturity" and are hindered primarily by a lack of resources.1 Allocating more resources for cybersecurity is therefore a crucial step for governments, but given the budget constraints public sector institutions face, it is not realistic to expect them to tackle every component of a comprehensive cybersecurity strategy on their own. Ideally, state and local governments would receive support from the federal government and regularly partner with federal agencies to address these threats and augment their limited resources. However, instead of fostering productive partnerships, these different levels of governments have found themselves at odds in the aftermath of serious cybersecurity incidents, hindering the ability to work together toward defending critical cyber infrastructure against attacks and mitigating the impacts of computer security breaches. Nevertheless, local, state, and federal governments should prioritize their strategic strengths when it comes to cybersecurity and invest their resources accordingly, relying on other levels of government to reinforce their weaknesses and provide additional funding and expertise as needed. For instance, in 2012, after the South Carolina Department of Revenue's (SCDOR) [End Page 67] computer systems were breached by intruders who stole 3.5 million tax records containing personal information of more than 75 percent of the population of South Carolina, the state government of South Carolina placed blame for the incident on a federal government agency, the Internal Revenue Service. Then-governor of South Carolina Nikki Haley insisted at the time of the breach, "There wasn't anything where anyone in state government could have done anything to avoid it."2 Instead of taking responsibility on the state government, she faulted the IRS for failing to require state revenue departments to encrypt their sensitive tax records, calling the IRS rules for data protection "archaic."3 The IRS, in turn, lashed out at South Carolina for failing to follow security standards recommended by the National Institute of Standards and Technology (NIST).4 This back-and-forth captures some of the challenges of promoting strong cybersecurity partnerships between the federal government and state or local governments: despite a common goal, they are often suspicious of each other's motives and eager to cast blame for failures and breaches because of both political and liability issues. More recently, this dynamic has given rise to tensions around the protection of voting systems, with some states rejecting the help proffered by federal government agencies such as the Department of Homeland Security (DHS) in 2018 to help assess and secure their voting technology.5 Government officials in several other states expressed suspicion in 2016 when DHS considered reclassifying voting technology as "critical infrastructure" for the purposes of enhanced protection.6 While all levels of government presumably share the goal of administering secure elections, their wariness of any interference and sense of mutual distrust has hindered attempts to partner effectively and pool their resources and expertise. In this paper, we consider how state and local governments can better leverage their particular strengths and capabilities to help mitigate the economic impact of cybersecurity incidents and data breaches. The first section identifies cybersecurity strengths and weaknesses of different levels of government and recommends how they should invest their resources and when they should look to other government entities for assistance. The second section focuses on the emerging classes of threats in cyberspace that state and local governments need to be better prepared to address, especially in light of the weaknesses identified in the first section. We emphasize how criminal business models are changing with the rise of threats such as ran-somware, extortion, and insurance fraud, and the ways in which state and local governments must adapt their policing and defensive efforts to these new types of threats and the associated schemes for monetization of stolen or compromised data...

As critical infrastructure systems consider whether and how to adapt and build resilience to climate variability and change, more research is needed to holistically explore the dynamics of resilience-building changes over time. We begin to fill this gap with a case study of the Rhode Island public wastewater sector. The Rhode Island Department of Environmental Management has invested significant funding, technical assistance, capacity building, and regulatory pressure to help publicly owned wastewater systems build resilience to climate challenges since 2010. To trace, assess, and understand the dynamics of resilience-building efforts over time, we interviewed wastewater utility and municipal personnel using event history calendars (EHCs). EHCs helped respondents recall details of relevant events, including potentially disruptive storms/incidents, and how they responded, including large- and small-scale adaptations, during the study period (2010-2023). We used EHCs to trace resilience and transformation capacities over time, and to analyze and predict movement toward transformational adaptation. We found that factors that best enable movement from incremental to transformational changes include unlocking capacity, or the organizational cultural value of in-depth learning/change, and a suite of contextual supports - new information, forward-looking collaborators, and stable funding sources - which require buy-in across levels of governance. We also found that, with organizational culture considered, experiencing disruption is not predictive of pursuing transformative adaptation. This suggests decision-making strategies for states, local jurisdictions, and utility managers to support climate adaptation and resilience in critical infrastructure, such as eliminating path-dependencies and silos, lowering thresholds for action, and leveraging networks to support moving toward transformation.

As the utilization of cyber systems in the management and operation of critical infrastructures have grown, the cybersecurity threats to critical infrastructure sectors such as energy, healthcare, transportation and water simultaneously increased exponentially. Critical infrastructures in developing countries are particularly vulnerable to growing cybersecurity threats due to limited resources, inadequate cybersecurity policies and a general shortage of skilled cybersecurity specialists. Addressing these vulnerabilities is essential for developing countries to ensure the operational continuity, data protection and public safety associated with functioning critical infrastructures. An explorative literature review identified a number of aspects that can be used to counter the increasing cybersecurity threats to critical infrastructures in developing countries. Literature suggests that although there are defined norms and standards for critical infrastructures in developing countries, there is room for improvement in terms of the contribution that enhanced cybersecurity awareness can accomplish. A good cybersecurity awareness program must include sufficient training that is aligned with an organization’s objectives, focus on raising cybersecurity awareness while performing normal duties whilst creating an interactive cybersecurity communication culture between all stakeholders. This paper presents research that is in progress to develop a functional cybersecurity governance maturity model aimed at capacitating role players responsible for the safeguarding of critical infrastructure systems in developing countries. The primary aim of the evolving Critical Infrastructure Cyber Governance Maturity Model (CICGM²) is to improve the cybersecurity governance of critical infrastructure systems in developing countries. The purpose of the article is to specifically describe how the CICGM² can be used to assess and determine the level of maturity of cybersecurity awareness programs at critical infrastructures in developing countries. The integration of recognized cybersecurity governance frameworks and established cybersecurity maturity models into the CICGM² presents unique opportunities to establish, measure and manage cybersecurity awareness initiatives at critical infrastructure systems in developing countries. This article contributes to the field of cybersecurity governance by offering a non-technical, scalable and adaptable CICGM² for key stakeholders at critical infrastructures in developing countries that can be used to determine the level of the cybersecurity awareness initiatives for the facilities that they are responsible for.

The homeland security enterprise is entering a new stage in its evolution. Focus is shifting to considerations of all-hazards, while resources are becoming increasingly scarce due to the challenging budget environment. Therefore, partnerships of all types must be leveraged to ensure that resources are used in the most effective ways possible. As the National Coordinator for critical infrastructure protection and resilience activities, the U.S. Department of Homeland Security (DHS), National Protection and Programs Directorate, Office of Infrastructure Protection (NPPD/IP) has addressed this challenge by establishing a Critical Infrastructure Risk Management Enhancement Initiative (CIRMEI) and an associated Regional Initiative. These initiatives ensure that DHS and its partners are identifying risks to critical infrastructure, measuring program effectiveness in managing those risks, and aligning resources to develop and execute the tasks and activities that are most successful in addressing those risks. Through the establishment of a set of desired outcome statements and associated metrics, NPPD/IP is assessing critical infrastructure protection and resilience programs and activities; the results will inform programmatic investments. The Regional Initiative, a public and private sector outreach campaign that is part of CIRMEI, will leverage public-private partnerships to collect information from DHS partners that will be used to enhance delivery of regionally tailored capabilities in each geographic section of the United States. As DHS confronts the dynamic and ever-changing environment facing critical infrastructure, CIRMEI provides a defense for the expenditure of valuable monetary and human resources and strives to close identified gaps in risk management capabilities.

A Decision Support System for the Resilience of Critical Transport Infrastructure to Extreme Weather Events

Given the unforeseen events that take continue to place worldwide, cities are experiencing rapid transformations. To maintain their basic functions, cities have to be resilient– possess the ability to bounce back to their original state following extreme events. Unfortunately, the behavior of cities is complex because of the interdependence among their comprising infrastructure systems. The current work presents a critical review of research work pertaining to resilience of cities’ critical infrastructure systems. To conduct such review, meta-research is employed through text analytics, in the form of topic modelling, to quantitatively uncover related latent topics in pertinent literature. Subsequently, the identified topics are qualitatively analyzed in terms of established definitions and metrics for resilience as well as adopted simulation approaches for infrastructure systems interdependence. Accordingly, nine common topics and five major research gaps are identified. This meta-research study is a steppingstone towards better understanding of infrastructure systems interdependence simulation and their resilience quantification approaches.

Industrial control systems (ICSs) are crucial in managing critical infrastructure, making their security a paramount concern. In recent years, their widespread adoption, together with the overall distance spanned by the critical infrastructure of industrial communication networks, have increased the complexity of the networks’ topological arrangement, increasing their structural vulnerabilities. In this scenario, deep learning models, especially those that incorporate graph-aware mechanisms, have arisen as a promising solution. This paper presents a novel centrality-and graph-aware attack detector (CGAAD) that includes nodes’ significance by centrality measures within a graph convolution network (GCN) framework to provide superior cyberattack detection performance and increase the resilience of critical ICS infrastructure. The proposed CGAAD model is in three parts. First, centrality measures are used as features for each of the nodes in the ICS graph topology. Then, a sparse-autoencoder (sparse-AE) enhances the feature representations to harness the subsequent classification step. Finally, the GCN leverages the graph structure and the enhanced features to classify dataflow between nodes as either normal or attacked. Experimental results demonstrate promising performance, reaching nearly 99% in terms of accuracy and F1-score, reducing misclassifications of both normal and attacked samples, which is crucial in ICS critical infrastructure applications.

In 2009, the US Department of Homeland Security (DHS) began using a targeted questionnaire to produce individual vulnerability/ protective-measure values for high-risk critical infrastructures and key resources. As sites continue to be assessed, the topic of resilience is emerging as a necessary focus in risk management and infrastructure protection. Enhancing the resilience of critical infrastructures requires determining the ability of systems to withstand specific threats and return to normal operations after degradation. Thus, comprehensive consideration of all parts of infrastructure systems, from threats to consequences, is needed. The methodology must generate reproducible results that can support decision-making in risk management, disaster response, and business continuity. Argonne National Laboratory, in collaboration with the DHS Protective Security Coordination Division, has developed a comprehensive methodology that uses uniform and consistent data to develop a resilience index (RI). Using the RI to compare similar facilities can provide vital benefits to owners/operators as well as DHS.

Critical technical infrastructures constitute the backbone of society by providing essential services to vital societal functions and the community at large, hence it is of essence that these are resilient. Critical infrastructures, e.g. power systems, telecommunication systems and railway systems, are designed and operated based on different philosophies of where to put the resilience emphasis, robustness, rapidity of recovery or a combination of the two. Here empirical failure data, such as duration and consequence of disruptions, from several critical infrastructures in Sweden are explored and analysed. To facilitate comparisons, a generic resilience assessment approach is also presented and applied. The results give insight to the resilience level of different infrastructures in Sweden and a basis for an exploration of its reasons, e.g. due to difference in regulatory schemes, design or risk cultures. It is concluded that there exist significant differences of infrastructures resilience levels and the factors shaping the resilience. (Less)

Abstract: The growing scientific interest in the field of critical infrastructure protection has been determined by society's growing dependence on the essential services provided by these infrastructures. Critical infrastructures do not work isolated, they establish complex and dynamic networks of interdependencies. A critical infrastructure is itself a system with its own components and operating principles, a system connected to a system of systems based on multiple determinations. Critical infrastructure systems are built based on interdependent relationships between infrastructures, manifesting itself as an open system that relates to the macro-social system. Critical infrastructure systems behave dynamically and react to external stimuli represented by threats. Interdependencies between critical infrastructures generate new vulnerabilities and threats, based on the spread of effects and consequences. A comprehensive approach for critical infrastructure risks requires a systemic approach, taking into account that the interconnection of critical infrastructure objectives also involves the interconnection of threats and vulnerabilities.