Simulation experiments: the emerging instruments for CIP

The article analyzes the existing legal mechanisms for managing critical information infrastructure in Ukraine. The instruments for their improvement are proposing in this article. An important component of critical infrastructure is its information component – a critical information infrastructure. The sphere of protection of critical information infrastructure in Ukraine is at the initial stage of formation. The current legislation defines only certain objects of socio-economic sphere, in which extraordinary events can lead to socially dangerous consequences. In view of the fact, that the term “critical information infrastructure” does not having a consistent interpretation in different countries, we propose our opinion. “Critical information infrastructure is a system of information management of critical facilities and information and communication networks that provide defense capabilities and security of public and private institutions, whose operation may flow to the national security of Ukraine” (KII). In the KII we can identified information and network components. Information environment of KII is a system for information management of critical objects, including computing and information resources that form automated control systems (ACS). The network component of KII consists of a set of telecommunication devices, communication lines and network equipment, systems of open protocols for the exchange of information between elecommunication devices, global system of digital addresses and digital identifiers, software. The Internet network can be considered as a technological add-on over a telecommunication network that provides the provision of data transmission and processing services (e-mail, teleconferencing, file transfer, access to computing and information systems in local area networks). The main threat to the safety of ACS of critical information infrastructure objects is targeted actions on information systems, information and telecommunication networks by software and hardware. KII legal security include two main components – national and international. The national component may be forming by a set of principles, legal institutions and norms, which are enshrined in the national legislation regulating public relations in Ukraine in the area of counteracting the security threats of the ACS of critical objects. In order to protect the most important objects of KII, it is necessary to identify these objects. The current legislation defines such categories of objects, for which special conditions for ensuring their protection and functioning are established. Some of them, in whole or in part, may be classifying as objects of critical infrastructure. The specificity of providing information security was reflecting in such Ukraine laws like “On the Fundamentals of National Security of Ukraine”, “On the Concept of the National Program of Informatization”, “On the National Program of Informatization”. As well as the Concept of Development of the Security and Defense Sector of Ukraine, the National Security Strategy of Ukraine, the Strategy of Cybersecurity Of Ukraine. The National Security Strategy identifies actual threats to national security and sets priorities for information security, cyber security and security of information resources and critical infrastructure. At the same time, the implementation of the state policy in the field of security of KII requires the further development of legal principles and norms governing the relevant social relations, that is, the national component of the legal security of KII. Ukraine should ensure the establishment of a nationwide system for assessing risks and threats to critical infrastructure, and after the legislative definition of the main terms, the implementation of the Identification of Critical Information Infrastructure objects. Identification of objects of critical information infrastructure can be accomplishing by introducing the certification of objects of critical information infrastructure. Such passports must contain general data about the facility, data on the main sources of danger, data on hazardous natural conditions, technological processes and response to threats. The international component of the legal security of KII provides for the regulation of a set of principles and norms defined by international treaties and recognized by the state, regulating issues of international cooperation in this area. Ukraine has signed the Convention on Cybercrime together with the member states of the Council of Europe and other States. It is aiming at stopping actions against the confidentiality, integrity and availability of computer systems, networks and computer data, as well as abusing such systems, networks and data by installing the criminal responsibility for such behavior, the provision of powers sufficient to combat criminal offenses, and the conclusion of agreements on rapid and reliable international cooperation. In addition, the plan of measures for 2017 on implementation of the Cybersecurity Strategy of Ukraine provides for the implementation of Directive 2008/114/EC on the protection of critical infrastructure, in particular on cybersecurity and cyber defense of critical infrastructure objects. Development of the system of international information security, the following main groups of international relations that requirenormative legal regulation within the framework of the legal security of KII: definition of the boundaries of the national KII in the global information and communication infrastructure and fixing signs of computer incidents in the control system of critical objects information infrastructure. The absence of generally recognized borders of state sovereignty of States in this space is a significant obstacle to the application of international law to the actions of other states. In particular, this impedes the establishment of limits of responsibility of states for violating the security of the KII and organizing international cooperation in the field of countering computer crime. The urgency of the legislative consolidation of signs of computer incidents in the automated control system of critical information infrastructure objects suggests the widespread use of the concept of “incident” in international law. An incident in cyberspace usually associated with a violation of the functioning of the components of cyberspace – an electronic collection environment and automated processing of information that determines the processes of the implementation of these operations, as well as information systems and automated control systems. The essence of the general definition of the “international incident” in the field of KII will be determining, firstly, by the nature of international relations between states that are violating by the “incident”. This event may be the result of unforeseen actions of the state, including actions that harm the interests of public bodies of one or more states, or, conversely, be one of many intentional but minor provocations carried out by agents of one state against another state. Given that international relations in the field of incidents in the field of KII are not regulating by international treaties, the main and, in fact, the only source of international law in this case serves as an international custom, however, its application to the sphere of KII is accompanying by considerable difficulties. For Ukraine, it is possible to introduce the positive experience of other states in the security of the KII. In particular, the problem of security of information technologies has been enshrined in the international standard ISO / IEC 15408 “General criteria for assessing the safety of information technology”.

The article analyzes modern features of state policy in the field of critical infrastructure protection. Attention is focused on the need for institutional transformations in the direction of improving efficiency, transparency, responsibility and responding to new security challenges in the conditions of a hybrid war with the Russian Federation. The practice of protecting critical infrastructure facilities in developed countries has been studied. It was determined that its priority is the actualization of the predicate of stability of critical infrastructure objects. The content of normative and legal acts of Ukraine in this area was analyzed. A number of provisions have been identified that allow the adjustment of the domestic security doctrine to the European vector of stability. Within the perspective of the development of the concept of sustainability, the intention of «critical infrastructure stakeholders» is substantiated. This opens up the prospects of creating transparent conditions for ensuring the annihilation of state institutions of power, state protection systems, the private sector, educational and scientific institutions and other stakeholders of critical infrastructure to the National System of Critical Infrastructure Protection at the next levels of management. The possible levels of such cooperation are determined. Modern scientific works were analyzed, which studied the prospects of changing the paradigm of protection and stability to the paradigm of resilience. The complex of institutional transformations is proposed to be expanded due to the application within the framework of the functioning of the National Critical Infrastructure Protection System of the process of determining and analyzing the range of risks that the country faces in the spheres of critical infrastructure functioning. The transformation of institutional protection systems is considered through the prism of systemic determinants, among which physical protection and defense, cyber protection and defense, preventive measures of protection and defense, and an educational and scientific approach are highlighted. The system of organization at the state level of conducting regular interdisciplinary trainings on the operational response to emergency situations at facilities has been studied. It is proposed to increase clarity in the delineation of responsibility for project threats and to strengthen control over compliance with the systematicity of interdisciplinary training. On the basis of the extrapolations of scientists' hypotheses and the results of the author's research, a proposal was made to systematize the main proposals for institutional transformations in the direction of increasing the effectiveness of the state policy for the protection of critical infrastructure in the form of a Preventive concept of resilience of critical infrastructure objects.

Olena Afanasieva, Oleksii Basmanov, Serhii Novikov FORMATION OF THE CONCEPT OF CRITICAL INFRASTRUCTURE OBJECTS TAKING INTO ACCOUNT THE FEATURES OF POTENTIALLY DANGEROUS OBJECTS OF UKRAINE The paper identifies the main provisions of the methodological apparatus of civil protection in relation to the paradigm - the object of critical infrastructure, taking into account the characteristics of potentially dangerous objects and the regulatory framework of Ukraine. The nature of the origin of the paradigm "object of critical infrastructure" is considered. Global trends in the formation of the paradigm of "critical infrastructure object" in the context of solving problems of civil protection are identified. The existing domestic legislative basis for the formation of a modern type of paradigm "critical infrastructure object" in the context of solving problems of civil protection is analyzed. The latter made it possible to determine the following - to date, and in the European Union has formed a definition of critical infrastructure, which includes physical objects, resources, services and information technology, networks and other infrastructure assets, violation or destruction of which leads to serious consequences for the health, safety and economic well-being of citizens and to the disruption of the effective functioning of government. Ukraine has passed and is in force laws that to some extent provide for measures to prevent emergencies caused by accidents and catastrophes at protected potentially dangerous facilities, the consequences of which can lead to infection, disease and death. Therefore, as a definition of critical infrastructure in the work, it is proposed to identify a set of enterprises, networks, systems, failure or disruption of which can cause loss of management and cause serious damage at the national, regional or local level. It includes nuclear and hydroelectric power plants, chemical and petrochemical plants, metallurgical plants and many other state-owned enterprises and private strategic institutions, which are not only protected, but also have special organizational and technical systems of physical protection. At the next stage of the work, the authors plan to join the development of the State system of critical infrastructure protection, which should include: creation of a state system of critical infrastructure protection; to determine the state structure responsible for the coordination of activities for the protection of critical infrastructure; to form the basis of public-private partnership and resource provision in the field of critical infrastructure protection; to promote the development of international cooperation in the field of critical infrastructure protection. Key words: emergency situation, object of critical infrastructure, civil protection, normative-legal basis

Modern society cannot evolve and operate without critical infrastructures, most of which have become dependent of internet connectivity for a variety of information management, communications, and control functions. In many cases, information and communications technology has become all-embracing, connecting other infrastructures referred to as critical information infrastructure. The increased interdependency has made critical infrastructure particularly vulnerable to natural hazards, technical problems, cyber-attacks, and terrorism. The topic of critical information infrastructure protection thus is attracting increasing attention and is progressively considered to be an integral part of national sustainability strategies. This publication delivers best practices on this topic derived from case studies and the status quo in the region and proposes recommendations for the further development of a delineated framework.

In 2008, a new principle of spatial planning was added to the German Federal Spatial Planning Act. It demands critical infrastructure protection (CIP) be taken into account in all spatial planning activities. Since the term 'critical infrastructure' is quite young, this problem has not yet been explicitly treated in spatial planning activities. This paper presents results from a qualitative analysis of available regional spatial structure plans and from a survey of all regional spatial planning authorities in Germany. It shows that regional spatial planning has marginally dealt with CIP related questions like infrastructure reliability and spatial exposure in the past. However, the CIP concept, in addition to regional spatial planning methods and procedures, needs comprehensive efforts to approach and synchronise both public functions.

Abstract: The growing scientific interest in the field of critical infrastructure protection has been determined by society's growing dependence on the essential services provided by these infrastructures. Critical infrastructures do not work isolated, they establish complex and dynamic networks of interdependencies. A critical infrastructure is itself a system with its own components and operating principles, a system connected to a system of systems based on multiple determinations. Critical infrastructure systems are built based on interdependent relationships between infrastructures, manifesting itself as an open system that relates to the macro-social system. Critical infrastructure systems behave dynamically and react to external stimuli represented by threats. Interdependencies between critical infrastructures generate new vulnerabilities and threats, based on the spread of effects and consequences. A comprehensive approach for critical infrastructure risks requires a systemic approach, taking into account that the interconnection of critical infrastructure objectives also involves the interconnection of threats and vulnerabilities.

A special legislation on criminal liability for offences against critical infrastructure objects is currently under development in Ukraine. The Cabinet of Ministers of Ukraine adopted the Concept for the development of a state system for critical infrastructure protection. The paper considers this legal area with regard to objects in the nuclear industry in the general context of critical infrastructure protection. It provides the current state in the legal regulation of fundamentals of criminal liability for offences against the critical infrastructure objects in the nuclear industry. The issue on the sufficiency and appropriateness of the existing level of such a liability is discussed further. The paper presents the list of some main critical infrastructure objects in accordance with the regulatory documents in the sphere of critical infrastructure protection and their classification. In addition, such concepts as “critical infrastructure” (relatively new notion in the national legislation), “unlawful intrusion”, “computer crimes”, “critical information infrastructure” and other concepts important to the nuclear industry were considered in this research. The notions presented in different regulatory documents were analyzed. The paper emphasizes that the legislation of Ukraine does not currently present special (separate) standards on the criminal liability for offences against critical infrastructure objects. Some promising issues related to fundamentals of the criminal liability and protection of critical infrastructure objects in the nuclear industry were also considered. The research involves the prospect of further development of a special law to define the area for improving relevant legislation on general regulation of these issues. The paper also stresses on the need to introduce some changes to the Criminal Code of Ukraine with respect to certain articles of section XIV.

Nearly 2 decades ago, James Woolsey ~later to become Director of the CIA! and Robert Kupperman ~then Senior Advisor to the Center for Strategic and International Studies—CSIS! warned that this nation’s infrastructures were unexpectedly and alarmingly vulnerable to terrorist attack, and they suggested efforts to protect them. Although their main focus was on the electric power infrastructure, their work and conclusions were of broader scope. However, no one paid much attention. In the mid 1990s, President Bill Clinton established the President’s Commission on Critical Infrastructure Protection ~PCCIP! under the chairmanship of retired Air Force General Robert T. Marsh. In its 15 months of work, the PCCIP examined threats to eight critical infrastructures, examined their vulnerabilities, designed a national strategy for critical infrastructure assurance, and developed a plan to implement the strategy. This time the Administration was listening. Clinton signed Presidential Decision Directive 63 ~PDD 63! in May, 1998, which set in motion an extensive multiagency program, coordinated by the White House, to pursue PCCIP’s recommended actions, but Congress failed to see the urgency and funded only bits and pieces of the program. September 11, 2001 focused everyone’s attention on critical infrastructure. We now have a bevy of presidential decisions and orders, as well as several key pieces of legislation dealing at least in part with our critical infrastructures. Most recently, we have a new Department of Homeland Security, although its name may change, and the commitment of substantial budgetary resources. The stage is now set for actually improving the security of these critical infrastructures. The PCCIP had identified a set of objectives to be met in protecting our critical infrastructures. The Administration accepted them. Congress also has, at least implicitly, accepted them. Are we achieving them? Here’s a summary of where we stand on some of the most important elements, as of this writing. There is no attempt at complete and comprehensive coverage. Many important efforts are not mentioned, simply to keep the paper within manageable proportions.

Simulation and test: Instruments for Critical Infrastructure Protection (CIP)

Lithuania’s national security and economic stability rely on the resilience of its critical infrastructures (CIs), which face increasing threats from hybrid warfare and technological complexity. The article analyses Lithuania’s evolving approach to strengthening critical infrastructure (CI), shifting from traditional Critical Infrastructure Protection (CIP) to Critical Infrastructure Resilience (CIR). While CIP focuses on preventing risks and safeguarding assets, CIR emphasizes the ability of systems to anticipate, absorb, and recover from disruptions—especially in the face of hybrid threats and increasing technological complexity. This transition involves proactive policies, integrated risk assessments, and resilience-by-design principles in infrastructure planning. The article points out the foundational role of CI in national security. These systems—ranging from energy and transport to health and ICT—are essential for public safety, economic stability, and societal well-being. Their interdependence with national security sectors underlines the importance of robust protection and resilience frameworks. The article discusses key megatrends impacting CIP in Lithuania, including digital transformation, regulatory shifts, and growing system interconnectivity. These trends necessitate more dynamic and adaptive strategies as infrastructures face both traditional and emerging threats. The author of the article proposes the roadmap that includes seven key steps: adopting a resilience mindset, conducting comprehensive risk assessments, embedding resilience in infrastructure development, enhancing cybersecurity, fostering public–private collaboration, engaging communities, and implementing continuous monitoring and improvement mechanisms. The article concludes by recommending initiatives for further enhancement of the resilience of critical infrastructure.

One of the key concepts of Construction 4.0 is cyber-physical systems. The construction industry is increasingly creating valuable digital assets, but it is also gradually using digital technology to plan, design, build, monitor, and control the physical ones. This makes construction sites and operations vulnerable to cyber-attacks. While the damage to digital assets can have financial implications, attacks on digitally-controlled physical assets may impact people’s well-being and, in worst-case scenarios, result in casualties. The problem is amplified by the emerging cyber-physical nature of the systems, where the human checks may be left out. The construction industry could draw inspiration from the work done in critical infrastructures (CI). Construction is the prelude of any socio-technical asset tagged as a CI. While most assets may not be critical in the CI sense, they are essential to a business’ operations and the people directly or indirectly associated with them. This study presents a literature review on the previous CI protection (CIP) efforts and construction cybersecurity studies to show their synergy. Recommendations based on well-established CIP processes to make construction more cyber-secure are provided. It is expected that this study will create awareness about cybersecurity practices within the construction industry. Ongoing work includes understanding where construction stands and developing a framework to address cybersecurity throughout the different project phases.

Besides its function to maintain the social and economic well-being of a nation, operating critical infrastructure serves as a proof of the ability of the state to provide protection to its citizens. Hence, a successful terrorist attack targeting critical infrastructure - in addition to generating fear and panic in the ranks of society undermines the operational character of the state. In recent years, several terrorist incidents in Europe have highlighted the vulnerability of critical infrastructure and, consequently, the importance of protecting it. Bearing this in mind, the protection of critical infrastructure has become a high priority for Western states, in parallel with the growing trend of risks, challenges and threats posed by international terrorism. Recently Europe has seen an increase in terrorist attacks against members of law enforcement as well as the armed forces. This paper argues that such attacks should also be considered as attacks on critical infrastructure, as it is ultimately the human resources being responsible for the well-functioning of those agencies. Further, the paper aims to examine the religious justification of Jihadist terrorist attacks against critical infrastructure.

Critical Infrastructure (CI) is the term used to describe assets that are of utmost importance, or in other words, essential in the functioning of an environment. Societies depend on their critical infrastructure in order to maintain and continuously improve on their standards of living. As these systems increasingly depend on cyber-technology, their security on networked environments become crucial. The modern smart grid has become part of CI through the enhancement it provides to regular electricity grid infrastructure. The application of biologically inspired systems to ensure security in aspects such as intrusion detection, access control, anomaly detection and others has become a widely researched field in when dealing with networked computing systems. This paper discusses the importance of CI, the application of artificial immune systems in the protection of CI information systems and proposes a new model for smart grid protection using biologically inspired concepts.

Private security is increasingly a key element in modern society, as it faces challenges that include growing threats to the security of individuals, organizations and property. In a world that is increasingly connected by technology in which violence, theft and other types of crime are increasingly common, the role of private security services is becoming increasingly important. Private security encompasses a wide range of services, from the physical security of facilities to the application of advanced technologies for the protection of data and systems. In addition, private security agencies often play a key role in the protection of prominent figures, organizations and specialized facilities, and after the adoption of the law on critical infrastructure, and the protection of critical infrastructure by providing a safe environment in which people can do business and live without hindrance. As a special security activity of the state, and through a possible public-private partnership, the protection of critical infrastructure appears. Critical infrastructure consists of various facilities and spaces without which the normal functioning of state bodies, the process of agricultural and industrial production and the lives of citizens is unthinkable

The article examines approaches to solving the terminological problem of defining the concept and content of “countering criminal offenses”, which is used in the context of the activities of the Security Service of Ukraine at critical infrastructure facilities. According to the results of the analysis of the scientific achievements related to the author’s subject, based on fundamental developments, the laws of logic and methods of cognition, the concept of the term and its meaning are formulated, the ways of solving the specified problem are determined, and the directions of further investigations are also proposed. The author, in particular, proved that the terms “fighting criminal offenses”, “crime”, “criminal misdemeanor”, “fighting crime”, “fighting crime”, “fighting crimes” are dialectically interrelated, but they are not identical its essence The fight against crime at the objects of critical infrastructure of Ukraine is a type of social activity, one of the main tasks of which is to combat criminal offenses. It is proposed to consolidate the definition of the term “counteraction to criminal offenses” in the context of the activity of the Security Service of Ukraine at critical infrastructure objects, as an object of social management, which is a specific activity of the special service in interaction and coordination with other subjects of the national system of critical infrastructure protection in Ukraine with the use of special forces, means, types, forms and methods of activity provided for by the legislation, which is organized on the basis, within the limits of authority, competence and in the manner provided for by the Constitution and laws of Ukraine, in the form of a task performance system: warning; detection; termination; disclosure of criminal offenses aimed at finding ways, means and other possibilities of effective influence on criminal offenses in order to reduce the intensity of the processes of their determination at all levels and stages, as well as to neutralize the effect of their consequences, while ensuring the protection of critical infrastructure. It is indicated that the content of the counteraction of the Security Service of Ukraine to criminal offenses at critical infrastructure facilities is the activity of the special service regulated by law with the use of special forces, means, types, forms and methods, which is aimed at the fulfillment of tasks: prevention, detection, termination and disclosure of criminal offenses at critical infrastructure projects of Ukraine, in order to ensure the protection of critical infrastructure.