Risk impact pathway analysis (RIPA): A dynamic risk assessment framework for interdependent critical infrastructures

At least 25% of coronary patients have sudden death or nonfatal myocardial infarction without prior symptoms.1 Therefore, the search for coronary patients with subclinical disease who could potentially benefit from intensive primary prevention efforts is critically important. The American Heart Association’s (AHA) Prevention V Conference, “Beyond Secondary Prevention: Identifying the High Risk Patient for Primary Prevention,” addressed ways to identify more patients who are asymptomatic and clinically free of coronary heart disease (CHD) but at sufficiently high risk for a future coronary event to justify more intensive risk reduction efforts.2 In this report, we amplify on key findings and recommendations of the AHA Prevention V conference, highlight new research since the conference, and propose an approach to the use of office-based testing and additional noninvasive procedures in selected patients to better define their coronary event risk. The recommendations are concordant with the recently released approach to risk assessment and management from the third report of the Adult Treatment Panel of the National Cholesterol Education Program (ATP-III).3 Enthusiasm for primary prevention and risk assessment in asymptomatic people has been spurred by recent advances in prevention research. Lipid-lowering trials demonstrated that primary prevention of coronary events is feasible, evidenced by the West of Scotland Coronary Primary Prevention Study (WOSCOPS) trial4 of hypercholesterolemic men and by the Air Force/Texas Coronary Atherosclerosis Prevention Study (AFCAPS/TexCAPS) trial5 in average or typical risk men and women with only moderate lipid abnormalities. Aspirin6 or ACE inhibitors7 can also reduce risk in selected asymptomatic, high-risk people. Emerging coronary risk factors have been described including inflammatory, infectious, and thrombotic markers,8 and there has been a steady flow of reports that focus attention on potential new ways of predicting coronary risk.9 In addition, noninvasive tests for subclinical atherosclerotic disease are available …

Decomposing the Smile: Systematic Credit Risk in Mortgage Portfolios

In traditional risk assessment method, failure of control actions is always neglected due to its low occurrence probability. However, failure of control actions usually leads to power system cascading outages, where severe consequence has an impact on risk assessment results. Hence, it is necessary to consider control actions failure in power system risk assessment. In this paper, relay protection failure is chosen as an example of control actions failure and considered in power system risk assessment. In the risk assessment procedure, the probability evaluation of relay protection failure and system risk computation method are concerned. Firstly, a method for relay protection failure probability evaluation is presented, where intrinsic property and operating state of relay protection devices are combined. Secondly, an improved state space partitioning (SSP) method, suitable for relay protection failure involved power system cascading outages risk assessment, is put forward. The improved SSP method transforms sampling strategy of sampling process in common SSP method, utilizing enumerated state help low-probability event sampling. It enables to avoid the low-efficiency problem caused by extreme low-probability event in common SSP method based risk assessment. Finally, relay protection failure probability evaluation method and the improved SSP method are validated with simulations and results show effectiveness in risk assessment accuracy and efficiency.

The ability to assess and therefore react to risk exposure in critical infrastructures and supply chains environments greatly contributes to reaching suitable protection levels and response mechanisms. Due to the unavoidable interdependencies among those infrastructures, that allow disruptions to spread from one to another and likely cause a great impact on society’s welfare state, risk management might be seen as a common and shared concern. The Comprehensive Risk Management approach tries to face this process by gathering information from a broad range of disciplines (physical and logical security, safety, environmental threats, etc.) while taking into account interdependencies of critical infrastructures and supply chains at different layers, going from critical infrastructure operators point of view, to sectoral, national and finally supranational levels. Besides, risk assessment and management processes rely on accurate and timely information to assist decision making, but this information (security holes, attacks or even disruptions suffered by an infrastructure or supply chain)—due to its sensitiveness—does not easily flow between involved or interested parties. This paper provides an analysis of this situation and suggest future fields of action, supported by conclusions drawn from the FOCUS project.

Over the last few years, the European Union (EU) has placed significant emphasis on the interoperability of critical infrastructures (CIs). One of the main CI transportation infrastructures are ports. The control systems managing such infrastructures are constantly evolving and handle diverse sets of people, data, and processes. Additionally, interdependencies among different infrastructures can lead to discrepancies in data models that propagate and intensify across interconnected systems. This article introduces “BigDaM”, a Big Data Management framework for critical infrastructures. It is a cutting-edge data model that adheres to the latest technological standards and aims to consolidate APIs and services within highly complex CI infrastructures. Our approach takes a bottom-up perspective, treating each service interconnection as an autonomous entity that must align with the proposed common vocabulary and data model. By injecting strict guidelines into the service/component development’s lifecycle, we explicitly promote interoperability among the services within critical infrastructure ecosystems. This approach facilitates the exchange and reuse of data from a shared repository among developers, small and medium-sized enterprises (SMEs), and large vendors. Business challenges have also been taken into account, in order to link the generated data assets of CIs with the business world. The complete framework has been tested in the main EU ports, part of the transportation sector of CIs. Performance evaluation and the aforementioned testing is also being analyzed, highlighting the capabilities of the proposed approach.

In industrialized countries, such facilities are organized into an interconnected system — critical infrastructure in various fields of activity of states, and the information systems and telecommunications networks that support them into a critical information infrastructure. Purpose: The article examines the changing requirements for information security: from the requirements of maximum security to the more "lenient" requirements of the acceptable risk concept. The expediency of returning to the concept of maximizing security for critical information infrastructures is substantiated. Methods: As a model of the objective function of the protection system, the asymptotic information security management is considered, which makes it possible to gradually bring the required security values closer to the "ideal" ones during the operation of the control system. Results: The possibilities of implementing an asymptotic approach to information security management for various management system models developed in different countries are considered. The article analyzes the features of the implementation of the object and subject model of information security management systems in different operating conditions of the CII. The principal difference between the properties of these two models is the possibility of external control, which is typical for strict regulatory management (object model). Another (subject-based) model allows for flexibility and responsiveness in security management. In particular, the ability of the CI subject to promptly make independent decisions and take into account interactions with other CI (the subject model) reduces the response time of the management system to external influences. .When analyzing the prospects for the development of information security requirements, it is proposed to take into account not only national, but also international mechanisms for improving security. It is proposed to take into account for such mechanisms the threats and conditions that arise during hostilities or in the case of a terrorist threat. Practical relevance: The transition to the subject model when changing the target management paradigm within the framework of asymptotic management meets the requirements not only to reduce the hierarchy of management, but also to accelerate responses and. e their duplication.

Cybersecurity social networking is a new scientific and engineering discipline that was interdisciplinary in its early days, but is now transdisciplinary. The issues of reviewing and analyzing of principal tasks related to information collection, monitoring of social networks, assessment methods, and preventing and combating cybersecurity threats are, therefore, essential and pending. There is a need to design certain methods, models, and program complexes aimed at estimating risks related to the cyberspace of social networks and the support of their activities. This study considers a risk to be the combination of consequences of a given event (or incident) with a probable occurrence (likelihood of occurrence) involved, while risk assessment is a general issue of identification, estimation, and evaluation of risk. The findings of the study made it possible to elucidate that the technique of cognitive modeling for risk assessment is part of a comprehensive cybersecurity approach included in the requirements of basic IT standards, including IT security risk management. The study presents a comprehensive approach in the field of cybersecurity in social networks that allows for consideration of all the elements that constitute cybersecurity as a complex, interconnected system. The ultimate goal of this approach to cybersecurity is the organization of an uninterrupted scheme of protection against any impacts related to physical, hardware, software, network, and human objects or resources of the critical infrastructure of social networks, as well as the integration of various levels and means of protection.

The multi-layer network nature of systemic risk and its implications for the costs of financial crises

Critical Infrastructures (CI) are large and complex enterprises, often composed of multiple systems. Organizations seek to establish common frameworks that will allow them to manage the development and evolution of CIs. The enterprise architecture frameworks are templates for the development of enterprise architectures that aim to describe the enterprise structure, goals, processes, resources and organization. We argue that an architecture framework is required for critical infrastructures and that it will facilitate the critical infrastructure protection. In this article we show an approach to the task of deriving an abstracted, domain-specific Enterprise Architecture Framework for Critical Infrastructures from generic Architecture Frameworks and from the emerging standards for security management. We call it CrAF. In CrAF, the emphasis is put on Critical Information Infrastructure that is inherently coupled with Critical Infrastructure. We provide both a review of recent advances in the area of enterprise architectures and the new material resulting from our own research. The work involved in the development of such an AF is underway within the EU FP7 NI2S3 Project and National Research Grant for Polish Ministry of Science and Education.

Purpose: This study develops a novel methodology for measuring systemic risk through a multidimensional approach, focusing on the impact of exogenous factors. By identifying systemic risk and analysing individual risk factors, we aim to provide a more comprehensive understanding of vulnerabilities in the financial sector. Design/methodology/approach: We use econometric models to assess systemic risk, applying our method to eight systemically important financial institutions in Poland between 2005 and 2023. Our analysis covers various risk factors, including climate risk, stock market fluctuations, and interbank liquidity, enabling both isolated and overall assessment of the impact of exogenous shocks on the system. Findings: Our results show that climate risk is becoming increasingly significant, particularly in light of recent crises such as the COVID-19 pandemic and Russia's invasion of Ukraine. We also observe an increase in systemic risk during specific periods (2008-2009 and 2011 2013), with the impact of individual shocks varying. Research limitations/implications: Our results highlight the need for sophisticated, multidimensional analyses of systemic risk to enhance the resilience of financial systems against diverse shocks. Practical implications: This research contributes to the existing literature by offering a universal framework for assessing systemic risk that aggregates multiple exogenous factors, particularly emphasizing the often-overlooked role of climate risk. Social implications: The research provides a framework for identifying systemic risks, including climate-related vulnerabilities, enabling policymakers to enhance the resilience of financial systems and protect societal stability against diverse economic and environmental shocks. Originality/value: Importantly, we are the first to combine transition risk indicated by stranded assets with physical risk, measured by temperature deviations from the multi-year average, in the assessment of Polish systemic climate risk.

Recently, wide concern of extreme risk events in power system has been aroused due to several big blackouts at home and abroad. The present study is designed to assess the extreme risk of power system considering cyber attacks, which can not be reflected by using traditional risk assessment method. Based on the theory of value at risk(VaR) and extreme value theory(EVT) in financial terms, a method to evaluate and quantize extreme risk of power system is proposed to determine the potential risk resulted from extreme events with low probabilities and serious consequences. The method is applied to evaluate the extreme risk of cyber attacks in power system and comparisons between evaluation results of commom risk and extreme risk are conducted. Statistically significant results have justified the validity of extreme risk assessment method, which could be regarded as a complement and improvement to traditional risk assessment. It is recommended that further study is needed to be conducted for risk prevention so as to enhance the operation security and reliability of power system.

Maritime container supply chains (MCSCs) is exposed to various risks arising from both internal operations and the external environment, and the increasing complexity of the modern global logistics system makes the situation even worse, thus causing a significant challenge to the effective risk management of MCSCs. However, systematic studies on this topic are relatively few. In view of this, this study aims to explore and analyse various MCSC risks, develop suitable risk assessment methods, and evaluate the overall performance of MCSCs from a systematic perspective, so as to ensure the safety, reliability, and resilience of MCSCs. This research starts with the identification and classification of all possible risk factors that may be involved in an MCSC based on a comprehensive literature review, and the research results are further validated through a Delphi expert survey. The identified risk factors are then analysed, screened, and assessed in detail. The novelty of this study lies not only on the risk assessment of MCSCs under an uncertain environment from a supply chain level but also on the consideration of the impact of risk condition of each individual MCSC on the overall performance of the entire container supply network. The research results will provide useful insights and valuable information for both researchers and practitioners on the risk analysis and assessment of MCSCs, which is beneficial to different types of stakeholders involved in the maritime shipping industry. The work is also able to provide a theoretical foundation for risk-based decision making and shipping route optimisation in further work. Although the risk assessment methods are presented on the basis of the specific context in MCSCs, it is believed that, with domain-specific knowledge and data, they can also be tailored for a wide range of applications to evaluate the reliability and performance of other supply chain systems, especially where a high level of uncertainty is involved.

A reliability & risk framework for the assessment and management of system risks in critical infrastructures with central control rooms

Use of pressure ulcer risk assessment tools or scales is a component of the assessment process used to identify individuals at risk of developing a pressure ulcer. Indeed, use of a risk assessment tool is recommended by many international pressure ulcer prevention guidelines, however it is not known whether using a risk assessment tool makes a difference to patient outcomes. We conducted a review to provide a summary of the evidence pertaining to pressure ulcer risk assessment in clinical practice. To determine whether using structured, systematic pressure ulcer risk assessment tools, in any health care setting, reduces the incidence of pressure ulcers. In December 2013, for this second update, we searched the Cochrane Wounds Group Specialised Register; The Cochrane Central Register of Controlled Trials (CENTRAL) (The Cochrane Library); Ovid MEDLINE; Ovid EMBASE; and EBSCO CINAHL. Randomised controlled trials (RCTs) comparing the use of structured, systematic, pressure ulcer risk assessment tools with no structured pressure ulcer risk assessment, or with unaided clinical judgement, or RCTs comparing the use of different structured pressure ulcer risk assessment tools. Two review authors independently assessed titles and abstracts of the studies identified by the search strategy for eligibility, obtained full versions of potentially relevant studies and screened these against the inclusion criteria. We included two studies in this review. One small, cluster randomised study found no statistical difference in pressure ulcer incidence in patients who were assessed by nurses using the Braden risk assessment tool (n=74) compared with patients assessed by nurses who had receiving training and then used unstructured risk assessment (n=76) (RR 0.97, 95% CI 0.53 to 1.77) and those patients assessed by nurses using unstructured risk assessment alone (n=106) (RR 1.43, 95% CI 0.77 to 2.68). The second study was a large single blind randomised controlled study which compared the effect of risk assessment on pressure ulcer incidence using the Waterlow risk assessment tool (n=411), the Ramstadius risk screening tool (n=420) and no formal risk assessment (n=420). There was no statistical difference in pressure ulcer incidence between the three groups (Waterlow 7.5% (n=31); Ramstadius 5.4% (n=22); clinical judgement 6.8% (n=28) (RR 1.10, 95% CI 0.68 to 1.81; Waterlow vs no formal risk assessment), (RR 0.79, 95% CI 0.46 to 1.35; Ramstadius vs no formal risk assessment), (RR 1.44, 95% CI 0.85 to 2.44; Waterlow vs Ramstadius). Two studies were identified which evaluated the effect of risk assessment on patient outcomes; In one study, there was no statistically significant difference in pressure ulcer incidence between people who were assessed using the Braden risk assessment tool compared with those receiving unstructured risk assessment. Methodological limitations of this study prevent firm conclusions being drawn. However, a further high quality RCT identified no statistical differences in pressure ulcer incidence when people were assessed using either the Waterlow risk assessment tool, the Ramstadius risk assessment tool, or using clinical judgement alone. There is no reliable evidence to suggest that the use of structured, systematic pressure ulcer risk assessment tools reduces the incidence of pressure ulcers.

Chapter 22 - Critical infrastructure resilience in Eastern Economic Corridor of Thailand—a review