Security and Protection of Critical Infrastructures: A Conceptual and Regulatory Overview for Network and Information Security in the European Framework, also focusing upon the Cloud Perspective

In the concept of the present work we intend to identify the importance for the promotion, the establishment and the effective development of suitable measures towards protecting and supporting modern critical infrastructures (CIs), as the latter compose essential parts of our modern societies and economies. Thus, we first discuss and analyze, in depth, the necessary conceptual definitions together with all related policy initiatives and other potential corresponding approaches globally, but by putting particular emphasis upon the actual European environment. As CIs are fundamental elements -or modules- for growth and development, the modern European strategy framework implicates for suitable measures to be applied to adequately fulfil that purpose, in particular for assessing any potential risks that may be harmful for the proper functioning -or even for the viability- of such important infrastructures. Then, we focus our concerns upon the exact context implicated by the present multi-faced challenges for ensuring an appropriate level of network and information security (NIS) and protection within the broader CI environment. In fact, we discuss in detail and also we assess a wide variety of issues affecting the proper role of IT tools and of related facilities, in general, as an indispensable part of the CI protection in the modern EU policy. Then, we concentrate upon the option of properly considering the cloud as a means for supporting IT relevant to serve CI protection. Under the innovative features introduced by the innovations promoted by cloud computing, related opportunities are also discussed, together with associated threats. Critical infrastructure providers have stringent security assurance and resilience requirements that reflect business, regulatory and legal obligations. To ensure these are properly met when providers use the cloud, techniques for assurance evaluation have to be produced. In this context we also refer to the specific initiatives structured and developed within the scope of the EU-funded SECCRIT research program that promote a first significant attempt to deal with that major challenge.