Critical infrastructure protection

Critical Infrastructure (CI) failures are aggravated by cascading effects due to interdependencies between
different infrastructure systems and with emergency management. Findings of the German, BMBF-funded
research project “CIRMin” highlight needs for concrete assessments of such interdependencies. Driven by
challenges of limited data and knowledge accessibility, the developed approach integrates qualitative
information from expert interviews and discussions with quantitative, place-based analyses in three selected
German cities and an adjacent county.
This paper particularly discusses how the mixed methods approach has been operationalized. Based on
anonymized findings, it provides a comprehensive guidance to interdependency analysis, from survey and
categorization of system elements and interrelations, their possible mutual impacts, to zooming into selected
dependencies through GIS mapping. This facilitates reliably assessing the need for maintenance of critical
functionalities in crisis situations, available resources, auxiliary powers, and optimization of response time.

In recent years, the dynamics of international cooperation and conflict in the cyber domain have become the focus of intense interest on the part of national governments and expert communities around the world.  Russia and the United States have often been at odds even in defining the nature of the problem: Russia emphasizes “international information security,” whereas the United States believes that cybercrime, cyberespionage, and cyberterrorism are the main threats in this domain and so prefers the term “cybersecurity” and a focus on the protection of computer networks and resources. It is encouraging, therefore, that the two countries reached agreement in June 2013 on the need for cooperation over “threats to or in the use of ICTs [Information Communications Technologies] in the context of international security.” Subsequent events have inhibited further progress toward cooperation.

In this working paper, we seek to outline some of the challenges as well as the opportunities for bilateral U.S.-Russia cooperation in the sphere of cybersecurity. Cybersecurity poses certain unique difficulties where cooperation is  concerned. Theories of strategic conflict and security drawn from the nuclear arms race do not carry over readily into the cyber domain. Some experts, for example, question whether doctrines of deterrence and verification of compliance with agreements are applicable to the cyber domain. The problem of attributing an attack to its source is far greater. An attack can be nearly instantaneous and without warning.

Moreover, the Russian and U.S. sides tend to approach the problem of cybersecurity from different perspectives. The Russian government generally emphasizes the principle of sovereign control over the entire information and communications domain. Russia regards cyberweapons as inherently first-strike weapons, useless if they are not used in the early stages of a conflict. The United States, in contrast, rejects “information security” as a foundational principle and champions the idea that the Internet should be “open, secure, interoperable, and reliable.” The United States distinguishes between legitimate and illegitimate operations in the cyber domain; forms it considers illegitimate include espionage by governments and corporations to obtain commercial secrets and efforts by criminal (including terrorist) organizations to damage ICT infrastructure. It accepts that governments will conduct espionage in the interest of national security as well as operations to influence public opinion in target countries, even to the point of attempting to overthrow those countries’ regimes. The United States, which favors international cooperation to prevent and defend against criminal attacks on critical ICT infrastructure and to ban commercially motivated espionage, has found common ground with Russia and other states in reaching agreements in these areas.

Both countries recognize the potential danger posed by cyberattacks to national infrastructure, such as electric power grids, dams, water supply, sanitation, oil and gas extraction equipment, and telecommunications networks. The dangers of a large-scale and effective attack on critical infrastructure are thus extremely severe. For this reason, the cyber domain is not entirely virtual; it includes the physical and human infrastructure linked to it.

The Russian government is also concerned about the possibility that the U.S. government could interfere with the management of the core infrastructure of the Internet, even to the point of disrupting Russia’s access to it. Although the reform of the ICANN (Internet Corporation for Assigned Names and Numbers) to take effect in mid-2016 will move ICANN’s technical functions away from the U.S. government’s stewardship and to a selfregulating, independent international body, Russia’s concerns about the governance of the Internet may not be entirely allayed.

We believe that these characteristics of the cyber domain should be addressed both bilaterally and multilaterally. We offer six recommendations for bilateral U.S.-Russia cooperation in the sphere of cybersecurity:

a. agreement on an explicit definition of the thresholds for attacks on critical infrastructure such that an attack would trigger a counterattack using either cyber or other types of weapons;
b. agreement on the types of information that would be shared in the event of a cyberattack, for example along the lines of a response to a bio-weapons attack;
c. prohibition of automatic retaliation in cases of cyberattacks;
d. prohibition of attacks on elements of another nation’s core Internet
infrastructure;
e. joint evaluation of the Internet Core Governance (UIS, IANA, DNS RZM)
infrastructure to assess whether stakeholders feel that their interests and contributions are being given adequate consideration following the reform of ICANN’s governance; and
f. broader international discussion of cybersecurity beyond the bilateral U.S.- Russia framework, for example under the auspices of the UN Group of Government Experts on Developments in the Field of Information and
Telecommunications in the Context of International Security (UNGGE).

For the longer-term future, we believe a formal, binding international treaty is needed to ensure full compliance with these norms. The bilateral norms we propose can serve as a model for such a multilateral agreement.

This chapter provides a political and philosophical analysis of the values at stake in ensuring cyber-security for critical infrastructures. It presents a review of the boundaries of cybersecurity in nation-al security, with a focus on the ethics of surveillance for protecting critical infrastructures and the use of AI. A bibliographic analysis of the literature is applied until 2016 to identify and discuss the cybersecurity value conflicts and ethical issues in national security. This is integrated with an analy-sis of the most recent literature on cyber-threats to national infrastructure and the role of AI. This chapter demonstrates that the increased connectedness of digital and non-digital infrastructure en-hances the trade-offs between values identified in the literature of the past years, and supports this finding with the analysis of four case studies.

Nigeria is a West African country, often referred to as the "Giant of Africa" due to its population of over 177 million and an estimated GDP of over US$587 billion; abundant natural resources including one of the largest natural gas and crude oil reserves. Despite these strong fundamentals, Nigeria has found it difficult to convert her unique advantages into economic and social benefits for the country. This necessitates diversification of the economy which will require huge investments in infrastructure. In China, Nigeria has found a partner and financier. Despite the importance of Chinese finance for African infrastructure, relatively little is known and or ascertain about its socioeconomic value and impacts. The aim of this research work is to identify and discuss the socioeconomic impacts of Chinese Government Finances in Infrastructural Development Projects in Nigeria. Secondary sources of data were used to review literature. The result shows that Infrastructural Development Projects in the long run have direct influence on socioeconomic development, and the majority of economic activities depend one way or the other on road networks, airports, railway transportation systems and power generation projects.

Purpose – This study aims to investigate the impact of Hurricane Sandy from the perspective of interdependence among different sectors of critical infrastructure in New York City and to assess the interconnected nature of risks posed by such a hurricane.

Design/methodology/approach – This study uses indirect damages of each sector to estimate the degree of functional interdependence among the sectors. The study examines the impact of the hurricane on different critical infrastructures by combining hazard maps of actual inundation areas with maps of critical infrastructure. The direct damages of each sector are calculated from the inundation areas in the flood map. The indirect damages are estimated by considering the areas that were not inundated but affected by Sandy through the interconnected infrastructure.

Findings – The electricity sector was the key sector to propagate risks to other sectors. The examination of new initiatives to increase the resilience of critical infrastructures in New York City after Sandy reveals that these initiatives focus primarily on building hard infrastructures to decrease direct damages. They understate the importance of interdependent risk across sectors. Future disaster risk reduction strategies must address interdependent infrastructures to reduce indirect damages.

Originality/value – This paper focuses on estimating the direct and indirect damages caused by Hurricane Sandy in each critical infrastructure sector, using GIS mapping techniques. It also introduces a Bayesian network as a tool to analyze critical infrastructure interdependence.

This Green Paper raises issues related to the establishment of a critical infrastructure protection system in Ukraine. It formulates strategic objectives of the public policy in the area of critical infrastructure protection in Ukraine, principles for the establishment of a critical infrastructure protection system and tasks for this system. Prior steps toward establishment of a state-level critical infrastructure system in Ukraine are formulated. These were drawn based on the analysis of experience of EU and NATO member states, contemporary security environment in Ukraine, and the priorities  of the national security and defense sector reform.

In an ever-evolving technological industry, the oil and gas sector is already moving forward through the adaptation of Industry 4.0 and the adaptation of advanced cyber technologies through Oil and Gas 4.0. As IT/OT (information technology/operational technology) systems are evolving technologically, so are the cyber security threats faced by the offshore oil and gas assets. This paper aims to raise the awareness of cyber security threats and the organizational and technical measures
that need to be adopted by the oil and gas industry for remote and complex assets in the upstream sector. A comprehensive literature review covering the areas of new IT/OT systems integration and cyber security risk analysis and management is presented. The results of a survey on the subject of cyber security for offshore oil and gas assets are also presented, and they provide valuable insight into the current industry culture and the perception of cyber security concepts. The importance of organizational culture, personnel training and involvement, as well as corporate engagement and support in the subject of cyber security is highlighted.

The term critical infrastructure (CI) derives from a series of Presidential Executive Orders and Policy Directives which evolved from July 1996 as a systematic way of defining the Nation's public and private infrastructures and protecting them from failure. The current iteration of those initiatives, titled as Presidential Policy Directive #21 (PPD-21), identifies the components of the Nation's 16 CI sectors, but does little to identify tools, techniques, or measures for implementing actionable protection for those infrastructures. The purpose of this paper was to survey the literature using a systematic review to determine whether sufficient guidance exists to manage the emerging CI domain. The survey found that governmental sources provided significant definitional information and general guidance, but provided little which would direct actual protection. In contrast, however, academic and practitioner evidence did suggest implementation strategies and tactics. Although never formally validated, High Reliability Theory (HRT) has been suggested as an implementation approach to CI protection (CIP). Resilience, one of the five hallmarks of HRT, was found to be the most frequently recommended mechanism, while the remaining four hallmarks were also frequently found, although described with varying semantic language. The contribution of this paper consists of showing that the progress of the work toward defining CI protection has validated HRT, and suggests that the separate research streams and independent progress toward defining HRT and CI have converged into a single construct which can be generalized to guide practitioners in developing and managing strategies, tools, and implementation techniques in either domain.

This document contains the summary tables focused on the challenges and suggested solutions for emergency response preparedness related to fire safety in critical infrastructure sectors. Additionally, the conclusions, areas for future research and bibliography are provided for reference and inclusion is future literature reviews. The full paper (available on the authors’ project pages) contains a brief comparison of emergency fire and disaster preparedness systems in the United States of America with other geographic regions. The outcome reveals the superiority of the US Command System over individually operated critical infrastructure sectors systems in other regions. The main advantage in the US system lies in its ability to bring together all resources, manpower, equipment, and information to be distributed or shared from the center of command. The US system has also moved towards uniform equipment and procedures so that an assisting fire unit can operate outside its own district. Covid-19 has disrupted training and strategic planning in the Middle East, such as the UAE. The dissertation makes some recommendations which if applied, can vastly improve fire departments, especially those tasked to protect the oil and gas terminals.

The research project “Critical Infrastructures Resilience as a Minimum Supply Concept” (CIRmin) examines which requirements and possibilities exist on municipal level to overcome and to be prepared for large-scale and long-lasting outages of electric power and water supply systems. A prolonged power outage can have cascading and far-reaching effects on other critical infrastructures. One is for instance the supply of drinking water, which can become a problem despite existing legal requirements for drinking water supply in crisis situations. Both, electric energy and water are among the key infrastructure services and stand out due to a high degree of criticality as their incapacitation or destruction would have a severe effect on (economic) security and public health and safety. Generally, fire brigades, rescue services and other public safety authorities are well trained and experienced with extraordinary emergencies. However, some important stakeholders might not be familiar with such incidents. Since long-term outages rarely occur, there is limited exchange and planning between different crisis and risk management actors on how to collaboratively act in such situations. Moreover, the vulnerabilities and capacities of the population regarding such outages are often rather neglected and remain unclear.

Every passenger who travels by air is exposed to security screening. As part of this procedure, the passenger typically is screened by a walk-through metal detector. Such a device should effectively detect prohibited metal items while simultaneously ensuring adequate throughput at the security screening checkpoint. Therefore, it is necessary to evaluate both these factors when selecting an appropriate walk-through metal detector and its parameters. However, while it is easy to measure passenger throughput, it is much more difficult to determine the effectiveness of a detector, which is a subjective concept. This paper presents a quantitative method for evaluating the effectiveness of walk-through metal detectors. Since the evaluation is subjective and based on incomplete and imprecise input information, a fuzzy inference method is used, where the input values are expressed as linguistic variables. The research presented in this paper involved field measurements of the sensitivity of walk-through metal detectors and a survey of experts in order to correctly determine the detector sensitivity values. The model for evaluating walk-through metal detectors is implemented in FUGAS (Fuzzy Gate Assessment System), which was tested at the Katowice-Pyrzowice Airport in Poland. The experimental results demonstrate that a fuzzy inference system can be very effective at assisting airport managers in selecting and configuring the equipment used at airport security screening checkpoints.