Issuu

ISSN 2516-0087 (Print) ISSN 2516-0095 (Online)

Critical Infrastructure Protection Review Autumn 2017

SYSTEM TRANSFORMATION: THE ANALYSIS OF SMART SYSTEMS IN THE INTEGRATIVE CONTEXT OF RISK, RESILIENCE, AND SUSTAINABILITY ENHANCEMENT OF PUBLIC-PRIVATE PARTNERSHIPS WITHIN CRITICAL INFRASTRUCTURE PROTECTION PROGRAMS RISK MANAGEMENT AND BUSINESS CONTINUITY ASSESSMENT: IMPORTANCE OF CONSIDERING LOGICAL INTERDEPENDENCIES SECURITY CHALLENGES IN THE NHS INDIAâ€™S CRITICAL INFRASTRUCTURE PROTECTION FOR AN INTEGRATED NATIONAL PLAN DEVELOPING SMART CITY RESILIENCE THROUGH CRITICAL FACTORS ANALYSIS CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

Global Visitors

S : r IS M te r M RO is T F in P te Nâ€™ TE y M e M oun ce DO NO urit llac l C eren Y c a ba f KE Se n W Glo Con UK Be ne ism y O ror Da Ter

10,000+

250+ 100+ High-End Countries Exhibitors

Represented

LONDON HOSTS WORLD CLASS INTERNATIONAL SECURITY EVENT TOPICS COVERED: Global Counter Terrorism Protecting Crowded Places Critical National Infrastructure Cyber Security Designing Out Terrorism Major Events & Stadiums Building & Facilities Management Aviation & Borders Transport Security

250+ High-End Exhibitors, 200+ Speakers, 250+ Sessions!

GOVERNMENT AGENCIES & DEPARTMENT ZONE

LIVE DEMONSTRATIONS

NEW CYBER INTELLIGENCE ZONE

Featuring

In association with:

Alternatively register a delegate pass to access the high-level Global Counter Terrorism Conference. Readers can save 15% on published rates with discount code UKSEC15

www.uksecurityexpo.com/cipr

EDITORIAL CONTRIBUTORS

Critical Infrastructure Protection Review Published by Delta Business Media Limited 3rd floor, 207 Regent Street London, W1B 3HH United Kingdom Tel: +44 (0) 20 7193 2303 Fax: +44 (0) 20 3014 7659 info@deltabusinessmedia.com www.deltabusinessmedia.com www.criticalinfrastructureprotectionreview.com

ISSN 2516-0087 (Print) ISSN ISSN 2516-0095 (Online)

UPCOMING EVENTS

The opinions and views expressed in the editorial content in this publication are those of the authors alone and do not necessarily represent the views of any organisation with which they may be associated. Material in advertisements and promotional features may be considered to represent the views of the advertisers and promoters. The views and opinions expressed in this publication do not necessarily express the views of the publisher. While every care has been taken in the preparation of this edition, the publisher is not responsible for such opinions and views or for any inaccuracies in the articles. ÂŠ 2017. The entire contents of this publication are protected by copyright. Full details are available from the publisher. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical photocopying, recording or otherwise, without the prior permission of the copyright owner. criticalinfrastructureprotectionreview.com

CONTENTS

IFC UK SECURITY EXPO 2017 6 FOREWORD

By Ian Fletcher

CRITICAL INFRASTRUCTURE PROTECTION AND RESILIENCE AMERICAS 2017

SYSTEM TRANSFORMATION: THE ANALYSIS OF SMART SYSTEMS IN THE INTEGRATIVE CONTEXT OF RISK, RESILIENCE, AND SUSTAINABILITY

SECURITY & COUNTER TERROR EXPO 2018

ENHANCEMENT OF PUBLIC-PRIVATE PARTNERSHIPS WITHIN CRITICAL INFRASTRUCTURE PROTECTION PROGRAMS

BEHAVIOURAL ANALYSIS 2018

RISK MANAGEMENT AND BUSINESS CONTINUITY ASSESSMENT: IMPORTANCE OF CONSIDERING LOGICAL INTERDEPENDENCIES

ENFORCE TAC 2018

DO SMART TECHNOLOGIES IMPROVE RESILIENCE OF CRITICAL INFRASTRUCTURES? CHALLENGES, OPPORTUNITIES, PRACTICAL APPLICATIONS

By Merja Hoppe and Ralf Mock, Institute of Sustainable Development, Zurich University of Applied Sciences

By Pepijn Vos, researcher and consultant at TNO, Brian Tjemkes, associate professor of Strategy and Organization at VU University Amsterdam, Marieke Klaver, researcher and project manager at TNO, and Duane R. Verner, AICP, program manager within the Global Security Sciences Division at Argonne National Laboratory

By Frédéric Petit, Research Scientist, Risk and Infrastructure Science Center, Global Security Sciences Division, Argonne National Laboratory; Computation Institute, University of Chicago and Lawrence Paul Lewis, Technical Programs Attorney, Risk and Infrastructure Science Center, Global Security Sciences Division, Argonne National Laboratory; Lecturer, Threat and Response Management Program, University of Chicago

By Aleksandar Jovanović, Steinbeis Advanced Risk Technologies & EU-VRi, Stuttgart, Germany and Maike Vollmer, Fraunhofer Institute for Technological Trend Analysis – INT, Euskirchen, Germany

Critical Infrastructure Protection Review - Autumn 2017

CONTENTS

EUROSATORY 2018

SECURITY CHALLENGES IN THE NHS

NATSEC ASIA 2018 - DSA 2018

INDIA’S CRITICAL INFRASTRUCTURE PROTECTION – FOR AN INTEGRATED NATIONAL PLAN

COUNTER-IED REPORT

TRANSPORT SECURITY & SAFETY EXPO 2018

DEVELOPING SMART CITY RESILIENCE THROUGH CRITICAL FACTORS ANALYSIS

CYBER SECURITY REVIEW

ISNR 2018 - INTERNATIONAL EXHIBITION FOR NATIONAL SECURITY & RESILIENCE

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

DELTA BUSINESS MEDIA - PRINT AND ONLINE SPECIALIST PUBLISHER

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS: RESPONSIBILITY AND DIFFERENT REFLECTIONS ON THE SUBJECT

CALL FOR PAPERS - CRITICAL INFRASTRUCTURE PROTECTION REVIEW

By Mike Lees MSc DipHEP CSyP FSyI FBCI, Head of Business Security, Barnsley Hospital NHS Foundation Trust

By Colonel H R Naidu Gade - Indian Army Veteran

By Victor R. Morris, civilian contractor and instructor at the U.S. Army Europe’s Joint Multinational Readiness Center (JMRC) in Germany

By Louisa Marie Shakou, Research Associate, Centre for Risk, Safety and Environment, European University of Cyprus

By Rogério Winter, Colonel, Brazilian Army and Rodrigo Ruiz, researcher, CTI - Information Technology Center Renato Archer

criticalinfrastructureprotectionreview.com

FOREWORD

FOREWORD By Ian Fletcher

he inaugural issue of Critical Infrastructure Protection Review comes at an important time. Recent months have seen a growing awareness of three convergent trends which are sharpening the challenges facing those of us charged with identifying and protecting against the risks and threats facing critical infrastructure around the world. The first of these is the growing awareness of the threat to infrastructure from natural hazards, as weather events grow more extreme, and affect especially the low lying and coastal areas where a large portion of the world’s population lives. The second trend has been convergence among systems, often using the internet as the backbone for system integration, remote management and a kind of operator disintermediation – for example, taking drivers out of cars and miners out of mines, courtesy of as combination of remote control, automation and artificial intelligence. It’s happening in transport, in many services, now retailing, and may extend even to food production in future. The internet and the data ecology and economy it supports is becoming the single ‘system of systems’, providing vital linkages, feedback and control to other, critical infrastructures. 6

Critical Infrastructure Protection Review - Autumn 2017

The third trend is the realisation at a social and political level that these risks are serious, and may well be beyond governments alone to manage. Much of this realisation is focused on cyber and data risks, where ordinary people find themselves exposed, and where governments may be especially ill-equipped to respond effectively. Helpfully, one of the papers in this issue of Critical Infrastructure Protection Review looks at the way public-private partnership arrangements can be organised to help manage risks. It’s an important contribution. There is a human dimension to all this too. I urge you to read the paper in this edition on security provision at Barnsley NHS Hospital for a genuinely moving insight to the human frailties and needs that often depend on critical infrastructures to survive and to thrive. This is an important lesson: protecting critical infrastructures is an intellectually demanding and conceptually challenging task, but it is ultimately a human story, where ordinary people’s needs, and aspirations depend on the systems we describe as critical. The papers in this edition each makes an important, and – taken overall - a balanced contribution to the painstaking task of mapping the way critical infrastructures operate, interact,

FOREWORD

and sometimes fail. Each paper helps fill in some important gap in our knowledge, our thinking and our understanding. Looking ahead, there are some emerging themes which arise from these papers, and which seem likely to shape future analytical work in this field. The first is the consistent application of systems theory and systems thinking to the analyses which underpin work to protect crucial infrastructures. Applying these established tools in a consistent, yet exploratory way is likely to yield very big insights, especially when some of the delayed and non-linear feedback systems being analysed come to be fully appreciated. The second, related theme must be the development of a coherent framework for looking and describing the timescales in critical infrastructure protection. Some systems can fail instantly; others have sufficient built in resilience, or capacity, or physical attributes, to fail over a period of time, or to contain incidents within part of the relevant system. As we come to study the interaction of systems, and the role of the internet as a connective system, a whole-of-discipline framework for considering, and even describing timescales will be a powerful tool. And the final theme is about our ability to respond: the whole study of critical infrastructure protection is purposive: we want the protection we describe to be effective, so the lights stay on, the water works, and ICT systems continue to function. Increasingly, I consider that we will want to develop models to test reaction, response and recovery over complex, interconnected systems. Building the analytical frameworks for such simulations, tests and exercises will be an important step, building on the careful and painstaking work you see in this edition. Let me end by thanking each of the contributors to what is an extremely thoughtful edition. Each of them has put significant time and effort into their papers. ■

ABOUT IAN FLETCHER Ian Fletcher is widely known for his role as Director of the GCSB, where he led the organization through great change between 2012 and 2015, including transforming its legislation and core focus to support for cyber defence initiatives. He is an experienced organizational leader and diplomat, highly regarded for his organizational change management work. Among other roles, Ian is a partner of cyber and physical security consultancy InPhySec. From 2002 to 2004 he was Principal Private Secretary (PPS) to the UK Cabinet Secretary and managed his office. The Cabinet Secretary is Head of the UK Civil Service as well as the Senior Adviser to the Prime Minister and UK Cabinet; Ian’s time there included the Iraq War and its aftermath. Before joining the GCSB Ian was Director General of the Queensland Department of Employment, Economic Development and Innovation from 2009 to 2012. Before this he spent three years as CEO and Comptroller-General of the UK Intellectual Property Office, (ie, the Patent Office). In this capacity he chaired the G8 Group on Intellectual Property and Innovation and established the ‘Vancouver Group’ of UK, US, Canadian and Australian patent offices. Ian Fletcher spent seven years with UK Trade & Investment (UKTI), in two separate periods between 1998 and 2009, culminating in his appointment as Managing Director, International, in 2005. He came to the Cabinet Office after a UN posting in Kosovo, where he managed the Customs Service and established a nascent Department of Trade and Industry, complete with a body of company and insolvency law. Ian joined the UN team in Kosovo from a series of assignments in the UK government and the European Commission working on trade policy, trade promotion and utility regulation. His early career was spent in the New Zealand Diplomatic Service. criticalinfrastructureprotectionreview.com

December 5-7, 2017

Kennedy Space Center Florida www.ciprna-expo.com

ONLINE REGISTRATION NOW OPEN www.ciprna-expo.com for further details

Collaborating and Cooperating for Greater Security The ever changing nature of threats, whether natural through climate change, or man-made through terrorism activities, either physical or cyber attacks, means the need to continually review and update policies, practices and technologies to meet these growing demands. The Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure. There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety.

Conference Programme Includes: FEMA Half Day Workshop – “Long Term Power Failure” Further details and Registration at www.ciprna-expo.com/registration

Critical Infrastructure Protection and Resilience North America will bring together leading stakeholders from industry, operators, agencies and governments to debate and collaborate on securing America’s critical infrastructure. For further details and to register visit www.ciprna-expo.com

Current confirmed speakers include: • Bryan Koon, Director, Florida Division of Emergency Management • Matt Conner, Chief Information Security Officer, National Geo-Spacial Intelligence Agency • Joseph Wassel, Director, C4 Resilience & Mission Assurance, US Department of Defence • David Fortino, Regional Continuity Manager, Federal Emergency Management Agency (FEMA) • Fred Ruonavar, Chief of DISA/DODIN Critical Infrastructure Program • Senior Representative, Office of Infrastructure Protection, U.S. Department of Homeland Security • Michael Lowder, Director – Office of Intelligence, Security & Emergency Response, US Dept of Transportation • Frederic Petit, Research Scientist, Argonne National Laboratory & Regional Director, International Association of CIP Professionals • Victoria Sherazi, Project Lead “Mitigating Risks in the Innovation Economy”, World Economic Forum • Stacey Stanchfield, Lead Cybersecurity Engineer, MITRE • Nathaniel Evans, Cyber Operations, Analysis and Research Lead, Argonne National Laboratory

Leading the debate for securing Amercia’s critical infrastructure Platinum Sponsor:

Gold Sponsor:

Supporting Organisations: Chief DISA/DoDIN Critical Infrastructure Protection (CIP) Program

Media Partners:

SMART SYSTEMS

SYSTEM TRANSFORMATION:

THE ANALYSIS OF SMART SYSTEMS IN THE INTEGRATIVE CONTEXT OF RISK, RESILIENCE, AND SUSTAINABILITY By Merja Hoppe and Ralf Mock, Institute of Sustainable Development Zurich University of Applied Sciences merja.hoppe@zhaw.ch and ralf.mock@zhaw.ch INTRODUCTION Smartness of technical and other complex systems has recently become a major topic in R&D in academia as well as in enterprises and other organisations. Manifestations of such systems are concepts of smart manufacturing (or industry 4.0), smart buildings, smart cities, smart regions, smart transport/mobility and energy systems, among others. The transformation towards such smart systems is intertwined with novel system characteristics and extended expectations on technical as well as non-technical levels. The operation of smart systems takes place in a socio-technological context along with a systemic change as already experienced by the operation of the Internet and other

infrastructural systems. Requirements of these smart systems are expressed by resiliency and sustainability, which are considered to provide system stability in a changing environment, ensure safe operation (e.g. against malfunction of technical system components) and provide solutions to problems caused by unsustainable developments (e.g. overconsumption of resources and related emissions). To provide a basis to design and assess (smart) systems concerning their resilience and sustainability, methods for systemic analysis are needed. As a consequence of the different requirements of resilience and sustainability, such smart system analyses need to cover a broad spectrum from small-scale technical criticalinfrastructureprotectionreview.com

SMART SYSTEMS

system entities right up to large-scale environmental and societal systems, in order to assess the ability of the systems to run in the long term. This working paper aims to provide basic conceptual ideas on how to integrate the different approaches of risk, resilience and sustainability. It also aims to suggest an approach for smart system analysis by integrating resilience and sustainability as main principles stabilising systems by allowing for flexible reactions to changes. The results of such an integrated system analysis should provide a basis for designing and operating smart systems. The question arises whether an established concept of system analysis, e.g., in risk engineering, is still methodologically sound and efficient enough to cover the operation of smart systems, including the requirements resulting from the need to ensure resilience and sustainability. Thus, based on given methods and definitions, the appropriateness of recent practice and indicators is questioned. The paper identifies interfaces of methods covering different aspects important for smart system analysis. For this, the discussion starts by defining the terms risk, smart systems, resilience, and sustainability as main principles of system analysis (Chapter 2). This differentiated definition of terms gives a first idea of the different concepts in use when analysing common and

entity. This description of ‘smart systems’ as an integrating overall concept again shows the relatedness of the two notions sustainability and resilience. When it comes to putting smart systems into practice, “information and communication technology (ICT) is an enabler but not a precondition for achieving smart community infrastructures”, according to ISO-37151[1]. However, nowadays it is hard to imagine finding enhanced technological performance which is not based on some kind of telecommunication, computing platforms, or ICT services. Furthermore, smart manufacturing and smart buildings are areas expected to rely on the Internet of Things (IoT). Such systems communicate Machine-to-Machine (M2M) and are able to make decisions without the help of humans. With this in mind the authors understand ICT as a key characteristic of smart systems. In order to understand how risk, resilience and sustainability principles can contribute to meeting the needs of smart systems and how they can be used as a method to analyse and design such systems, the main characteristics of the three notions are described in the following.

smart systems for which a description of approaches and main aspects is presented in Chapter 3. Based on this, we identify interfaces among the basic principles of risk, resilience and sustainability and suggest an integrated approach for the analysis related to smart systems in Chapter 4.

risk” following ISO/IEC-Guide 51:2012[2]. Risk is also defined by some ISO standards: ISO Guide 73 on “Risk Management – Vocabulary”[3] gives the generalpurpose definition, namely “effect of uncertainty on objectives”. It has been noted there that “an effect is a deviation from the expected – positive and/or negative”. However, in risk engineering, the term risk is a function of likelihood of occurrence of an (undesired) event and the associated consequences. This understanding of risk is also mentioned and specified in[4] where[2] emphasises the risk engineering approach towards hazardous situations and events and harm, i.e.:

MAIN PRINCIPLES Smart Systems The definition of smart already provides hints for further analysis goals. By slightly generalising the ISO-37151 on “Smart community infrastructures”[1] towards smart systems in general, the following definition is given: Smart: characterises a system “[…] with enhanced technological performance that is designed, operated, and maintained to contribute to sustainable development and resilience […]” of the organisational 10 Critical Infrastructure Protection Review - Autumn 2017

Risk The ISO-37151[1] mentions risk in the context of safety where it is defined as “freedom from unacceptable

Risk: combination of the probability of occurrence of harm and the severity of that harm

SMART SYSTEMS

Following this definition of risk, risk management implies the identification, analysis, evaluation and handling of undesired events in the course of system operation. Thus, the measurement of safety also becomes a quantity of risk associated with improbability and/or harmlessness of undesired events.

Resilience Resilience is also (roughly) defined by ISO-37151[1], which is helpful again to generalise the major aspects of terms: Resilience: “This means that […] systems are designed to continue providing services in emergencies and to quickly recover from damage and suspension of services. This definition reflects the common understanding of resilience as an inherent system property which is linked with (dynamic) stability or robustness characteristics and gives preference to the analysis of system availability. Note that emergency is strictly related to crisis risk engineering. However, in the context of this paper, the term should be replaced by undesired event which also covers undesired overfulfilment of specifications.

Sustainability Finally, smart systems raise the expectation of sustainability, which is expressed within an extended, non-technical framework of terms. The sustainability definition as given ISO-37151[1] is used in this paper: Sustainability: “state of the global system, including environmental, social and economic aspects, in which the needs of the present are met without compromising the ability of future generations to meet their own needs”. This definition of sustainable development as published in the Brundtland Report[5] spans a broad socio-technological framework: “The environmental, social, and economic aspects interact, are interdependent and are often referred to as the three dimensions of sustainability”[1]. In summary, this introduction to smart systems and

definitions of related principles already outlines the major working areas of smart system analysis as well as different perspectives on their analysis.

APPROACHES FOR SYSTEM ANALYSIS Risk vs. Resilience Analysis As the major parameters of smart technology are resilience and sustainability, the nature of resilience should be explained in contrast to the notion of risk underlying many system analyses in the past. It is worth mentioning that risk engineering and its understanding of risk can be traced back to the late 1940s. For instance, the first report MIL-P-1629, which defines procedures for Failure Mode Effect and Critical Analysis (FMECA), was published in 1949 by the U.S. Department of Defense (DoD) and is still one of the most popular risk management and assessment tools in industry and organisations. Other major developments can be traced back to the 1960s (e.g. table-based HAZOP, Hazard and Operability Study) and 1970s (Probabilistic Safety Analysis, PSA). Details can be found in [6-8]. It is not surprising that the common risk analysis approaches in risk engineering show difficulties in considering smart systems and other infrastructural entities which largely depend on the Internet and other newly-emerging technologies (e.g. related to the Internet of Things). There are many risk analysis approaches (the ISO 31010 lists 31 tools used for risk assessment) which can be roughly structured in qualitative, semiquantifiable and quantifiable approaches. Qualitative approaches are, at a brainstorming level, mainly used for fast system screening. They do not provide any risk figures. Semi-quantifiable approaches result in risk figures partially based on expert judgements. Quantifiable methods give risk figures, based on statistics and formal system models. Table 1 shows common approaches following this classification scheme. In the context of risk engineering, a technical system can quit normal operation mode, e.g. specified in Best Practices and standards. The resulting modes are generally characterised as dangerous and nondangerous. For resilience analysis, positive as well as recovery modes are of importance. criticalinfrastructureprotectionreview.com

SMART SYSTEMS

Table 1: Major characteristics of analysis goals of most common approaches in risk engineering and resilience analysis. Approach

Characteristics Risk engineering Dangerous

Resilience

non-dangerous

Positive

recovery

Qualitative Fishbone-Diagram

Yes

HAZOP

Yes

yes

Yes

yes

Fault Tree Analysis

Yes

Event Tree Analysis

Yes

Markovian Process

Yes

yes

Semi-quantifiable FMEA, FMECA Quantifiable

HAZOP: Hazard and Operability Study; FMEA: Failure Mode and Effects Analysis; FMECA: Failure Mode Effect and Critical Analysis. For instance, the system of four traffic lights at a junction fails: If then all signals are switched to green light, the system mode is dangerous as all road users are given priority in traffic. On the other hand, the switch to red lights immediately stops

are able to cover any system states in state diagrams. However, this system modelling approach requires much more effort than, e.g., table-based FMEA.

cars, which is then a non-dangerous system mode (fail-safe). Following the definition of resilience, any recovery back to the specified system operation would need to be considered in resilience analysis, including recovery from undesired positive modes. This indicates that resilience has its focus on system operation and availability instead of system failure as in risk analysis. Hence, Table 1 also lists which approaches are able to encompass recovery actions either qualitatively or formally. A Resilience analysis would need to cover all characteristics. In summary, most of the most common approaches in risk engineering are unable or not designed to deal with positive system characteristics and recovery actions, making them unappealing for resilience analysts. Markovian processes are the solitary exception and

Sustainability analysis of systems largely depends on objects and objectives, and thus uses a variety of methods and sustainability indicators. The methodological focus is not predefined as sustainability analysis relies heavily on consensus among all participants, i.e., indicators to assess sustainability and definition of goals for monitoring depend on stakeholder participation and agreements and varies case by case. A common basis of approaches within sustainability analysis is to consider and balance sustainability requirements coming from the three fields of society, environment and economy, which are combined as circles, triangles or pillars differing in their relevance according to the particular theoretical model. Methods like Sustainability Assessment, Multi-Criteria Assessment or Life Cycle Analysis are used to assess extended socio-technical systems concerning

12 Critical Infrastructure Protection Review - Autumn 2017

Sustainability Analysis vs. Resilience Analysis

SMART SYSTEMS

various aspects of sustainability and especially to support decision-making during system planning and development, although these approaches are not specifically designed to assess systems, but mainly to analyse products, projects or planning, policies and strategies in different contexts [e.g. 9]. Methods and indicators vary from very specific measurable databased indicators (e.g. CO2 emissions) to qualitative descriptive estimation-based assessments (e.g. expert ratings on social effects). In summary, sustainability analysis allows us to follow an extended understanding of systems considering their relations with their environment, e.g., input as well as output of materials and resources, impacts, meaning for stakeholders, etc. Thus, similar to resilience, sustainability analysis takes place at the interface of a system and its environment by assessing the system in a broader context. Approaches in sustainability analysis vary concerning their achievable accuracy and measurability of aspects through appropriate indicators – depending on the subject. Despite the lack of standards and fixed indicators of what can be considered ‘sustainable’, they nevertheless provide a basis to compare options or trends over time in of terms of characterising relative sustainability of an entity rather than its absolute sustainability concerning its effects, use of resources etc.

role for smart system operators. It has to be stated that information security is about “preservation of confidentiality, integrity and availability of information”[10]. One step further, IT security aims to identify system vulnerabilities which might be exploited by threats. (The framework of information security risk management is defined, e.g., in [11]). New challenges due to smart systems arise as smart technology includes software, control and physical levels of system operation. Risk engineering usually covers the latter level to ensure safe operation of pumps, valves and other system components (hardware). The virtual world of informatics now has effects on hardware which might create additional sources of hazards, e.g., release of toxic substances because of cyber-attacks on industrial control systems (ICS) or systems, like Intelligent Transport Systems[12]. This already needs attention, as highlighted by the U.S. Industrial Control Systems Cyber Emergency Response Team ICS-CERT. In [13], it identifies 97 out of a total of 295 incidents in critical manufacturing in 2015 (other major affected sectors are energy (46), water (25), transportation systems (23), and unknown (27)). Hence, many industrial systems that have already become smart can be, and are, affected by cyber-crimes. Although IT and software engineers successfully

When it comes to the question of how to combine the concepts of sustainability and resilience, both seem to be complementary: both aim to ensure system operation and to outlast system damage. While resilience analysis aims to assess capacity for systemic self-regulation, sustainability analysis allows us to check whether the (resilient) system compromises the environment it is embedded in and depends on. This is where the extended understanding of system boundaries in sustainability analysis comes into effect.

use approaches for IT security purposes and system analysis, these methods need to be adapted for risk engineering purposes in order to analyse, design and operate safe smart systems. Another consequence of IT in terms of basic system analysis is that release management of software eliminates the concept of learning by experience, namely in building up a quality knowledge base through statistics of component operation in order to improve the prediction of their operation modes and trends. Software patches and updates, e.g., of firmware, are activities that eliminate vulnerabilities or totally change the entity under observation. In any case, in this continously changing system, building up statistics becomes questionable and undermines the established frequentist (i.e. probabilistic) approach in general.

Smart System Analysis As stated above, smart systems are infrastructural systems making extended use of information technology. Thus, it is an immediate consequence that IT or information security plays an important

criticalinfrastructureprotectionreview.com

SMART SYSTEMS

Smart systems are highly interwoven with other systems offsite and onsite. As mentioned above, they are infrastructural systems, or if interconnected with the Internet, parts of an extended TelCom, service and power infrastructure. Furthermore, smart systems analyses need to be appropriate to deal with highly dynamic, interconnected and boundless systems or components. The high complexity of smart systems gives room for a broad range of novel risks. Thus, resilience engineering will have to provide solutions for manifold potential undesired system modes, which can only be provided by integrating additional stabilising/reacting mechanisms and components within the system – which in turn increases systems complexity, again. In summary, the approaches of risk engineering are not well-suited to the analysis and assessment of smart systems. The problem is intensified as risk analysis concentrates on identifying and managing failures and harm, whereas resilience also includes aspects of system operability. For this, there is the danger of oversimplification of risk and resilience analyses of smart systems in practice where table-based, linear and “quick and dirty” methodologies are preferred. Moreover, sustainability analysis requires additional resources, e.g. when single system components would need to be analysed concerning their effect on the environmental, economic and social side. As the level of interdependencies increases with smartness, system-boundaries, number of system characteristics and indicators to be considered, smart system analysis is a strong candidate for dynamic system analyses and computer simulations. Related to the characteristics of smart systems described above, demands on the methods for smart systems analysis in order to design and operate these systems arise: • Methodological approaches must be capable of dealing with high systemic complexity • Resilience-engineering has to support self-

sustaining systems capable of recovering from undesired modes as a reaction to external impact or internal events • Solutions for undesired system modes must cover a broad range of risks, and thus many potential undesired system modes have to be considered in resilience-engineering • Due to the complexity of systems sustainability, standards would need to be simplified and integrated from the very beginning.

AN INTEGRATED APPROACH As mentioned in the previous chapters, the concepts of risk, resilience and sustainability and their associated systemic analysis approaches address many aspects based on their specific perspectives. However, these concepts can be considered as interwoven on superior systemic micro, meso- and macro levels. This arrangement is used afterwards to introduce a general integrated systemic analysis approach. While risk analysis aims to identify threats in order to enable the design of risk avoiding mechanisms within the system, resilience analysis should help to develop a system which is capable of recovering from a deviation of a state within defined boundaries after a destabilising external impact or an internal dysfunction. Both concepts focus on a type of system which is mainly of technical and/or socio-technical nature and which can clearly be defined by identifying systems boundaries. With rather small- or medium size systems the micro or meso level is addressed here. The focus is on the system itself, including internal mechanisms and operational capability, while also considering external developments with their impact on the defined system. Sustainability, in contrast, analyses the conditions and consequences of a system’s in- and out-put within a broad context: its social, ecological and economic environment. Thus, sustainability refers to a sociotechnical or social system1. Related to the context perspective, the focus is rather on meso- and macro

1 Although the concepts of risk, resilience and sustainability can be characterized by the above described differences the different dimensions are to be understood as a continuum rather then a binary aspect. Thus, e.g. concerning type of system sustainability is meant to rather focus on socio-technical systems.

14 Critical Infrastructure Protection Review - Autumn 2017

SMART SYSTEMS

size systems – these upper scale levels are considered even when micro scale systems are assessed for their sustainability. An example from the field of transport is used to illustrate the differences between the perspectives of risk, resilience and sustainability with their relevance on the micro-, meso- and macro-level: an autonomous vehicle – representing the micro level and the risk perspective – could be designed as a smart element in the future, able to operate independently, including energy recharging, collecting passengers, driving and communicating with other street vehicles. Systemic assessment would need to identify risks, e.g., technical failures leading to accidents or unavailability, or terrorist attacks using the vehicle as a weapon. Mainly technical issues have to be integrated into the risk analysis as a basis for systems design on this level. On the meso-level, a transportation hub or a cities transport network – with autonomous vehicles included – would be analysed in order to ensure the resilience of the system. Related to the example, despite the malfunction caused by a terrorist attack, a breakdown of the cities transport network would need to be avoided. The system design would need to include mechanisms and activities to be (automatically) activated in order to keep the uninvolved transport modes running, under increased security efforts. This would require

Finally, the macro-level, linked with the sustainability perspective, is different from the micro- and the mesolevel. Related to the example, the risk of a terror attack and the resilient system response, ensuring sustainability would mean that actions taken on the meso level would help to recover the system and to sustain it in the end. This would support social and economic sustainability – as the transport network could recover in the short-term and continue its function as a basis for economy and society. When it comes to sustainability in the long-term and when the ecological dimension is included, the micro and mesolevel components such as the autonomous vehicle and the cities transport network would need to be designed and built according to sustainability standards from the beginning in order to prevent long term risks for the system which arise from unsustainable overuse of resources or harmful effects on the environment such as climate change and lost biodiversity or impacts on human health, e.g. through mitigation. Figure 1 summarises the context of system level and assessments. The different characteristics and related analytical approaches of risk, resilience and sustainability are necessary to design smart systems. The integration of the different perspectives provides synergies, but also creates challenges – e.g. the fact that risk, resilience

a combination of mechanisms on the technical and social level.

and sustainability operate on different system levels and address different systemic contexts.

Figure 1: Addressing system analysis for different system levels. criticalinfrastructureprotectionreview.com

SMART SYSTEMS

For an integrated approach, which is necessary to fullfill the requirement of sustainability and resilience for smart systems, sustainability would have to serve as an overall principle as it takes the environment every system is embedded in into account and thus prevents from risks arising if the systems’ basis is impaired.

extended understanding of system functionality: design principles of how to build a system able to selfregulate after impacts. Finally, sustainability analysis closes the gap to the overall socio-technical system by ensuring that systems at all levels are designed without compromising resource basis and functionality in general and in the long-term. ■

CONCLUSION

REFERENCES

The increasing complexity of smart systems as well as the demand to consider more all-encompassing system boundaries and associated parameters and indicators leads to unmanageable system analyses. From a sustainability perspective, detailed multicriteria assessment or life cycle analysis for every single component of such complex systems would be far too extensive in practice. This also complicates the design of smart and resilient systems. As a consequence, the analysis of smart and sustainable systems needs to be simplified and structured as much as possible. Instead of providing detailed multi-criteria-assessment for different options and scenarios for the development of a smart system, rather simple but fundamental and validated principles should be defined and applied consistently. Such principles could provide guidelines to serve as imperatives underlying every single decision, e.g.: all

[1] ISO-37151,

materials used to build the system would need to be reusable or recyclable; energy to operate the system would need to be provided by renewables solely, and used materials would need to come from the closest location where they are available (regional materials in order to decrease transport distance and related energy resources and emissions). When it becomes clear that there are different system levels with specific goals for the analysis of smart systems, a staggered approach is necessary in order to integrate risk, resilience and sustainability. Initially, an established risk assessment approach is useful to identify major flaws and vulnerabilities of single sub-systems and entities; the needs of IT security risk assessments need to be incorporated in this stage. Resilience analysis then becomes a complementing element as it encompasses an 16 Critical Infrastructure Protection Review - Autumn 2017

“Smart

community

infrastructures

Principles and requirements for performance metrics,” International Organization for Standardization (ISO), Geneva 2015. [2] ISO/IEC-Guide51, “Safety aspects — Guidelines for their inclusion in standards “ ISO/IEO, Geneva July, 05 2012. [3] ISO/IEC-Guide73, “Risk Management —Vocabulary (ISO/IEC GUIDE 73:2009(E/F)),” ISO/IEO, Geneva 2009. [4] ISO-31000,

“Risk

management

Principles

and

guidelines (ISO 31000:2009),” International Organization for Standardization (ISO), Geneva 2009. [5] G. H. Brundtland, “Report of the World Commission on Environment and Development: Our Common Future (Brundtland Report),” United Nations March 20 1987. [6] R. Mock and J. van Mahnen, “Risk Analysis Methods in Processing Industry: A Swiss -German Survey,” in Society for Risk Analysis-Europe (SRA-E), 8th Conference, Paris, 1998, pp. 1145-1156. [7] A. Gheorghe and R. Mock, Risk engineering: bridging risk analysis with stakeholders values. Dordrecht: Kluwer Academic Publishers, 1999. [8] R. Mock, O. Stern, R. Knaack, and E. Kollmann, “Higher Education in Informatics – Concepts and Lessons Learnt,” presented at the Probabilistic Safety Assessment and Management 11 & Annual European Safety and Reliability Conference 2012 Conference. Proceedings of PSAM 11 & ESREL, Helsinki, 2012. [9] M. Hoppe, “Transformation towards sustainable mobility: Putting principles of sustainability into practice of policy and planning,” Compendium of Papers of the 93rd Annual Meeting of the Transportation Research Board, 12-16 January 2014, Washington, D.C., USA pp 1-11, 2014.

SMART SYSTEMS

[10] ISO/IEC-27002, “Information Technology -- Security Techniques -- Code of Practice for Information Security Management,” First Edition ed. Geneva: ISO/IEO, 2005, pp. 1-136. [11] ISO/IEC-27005,

Information

technology

Security

techniques - Information security risk management vol. ISO/IEC 27005. Geneva: ISO/IEC, 2011. [12] M. Hoppe, A. Hauptmann and Y. Raban, “Wildcards in Transport,” in European Journal of Futures Research 3, 1, pp. 1-24. [13] ICS-CERT,

“NCCIC/ICS-CERT

Year

Review,”

Homeland Security 2015.

ABOUT THE AUTHORS Dr Merja L Hoppe works in research for the Institute for Sustainable Development at

Dr.-Ing. Ralf Mock is senior lecturer at the Institute for Sustainable Development INE

the Zurich University of Applied Sciences ZHAW in Switzerland. Her field of research is Sustainable Development with special focus on Sustainable Transport Systems, where she is heading a research team at her institute since 2010. Besides research also teaching and advice for policy and planning within the mentioned fields are part of her and the teams work. Before joining ZHAW she worked in the financial sector as a senior economist at the Economic Research department of Credit Suisse in Zurich. Merja holds a PhD in Geography with focus on regional economy, while she did her master with focus on natural sciences of Geoecology.

at Zurich University of Applied Sciences ZHAW in Switzerland. His major field of interest in R&D are methodologies of risk and resilience assessment and engineering and how to integrate the associated processes in an integrated risk management process. He is a qualified safety engineer where his professional background covers activities at the Swiss Federal Institute of Technology Zurich (ETH Zurich) at the Laboratory of Safety Analysis (Senior Scientist), BKW Energy AG (Head of Probabilistic Safety Analysis Level 1) and the Institute of Applied Information Technology (Research Associate, ZHAW). The latter includes R&D in IT security risk assessment. Ralf Mock holds a doctoral degree in engineering with focus on reliability analysis of valves in nuclear power generation. criticalinfrastructureprotectionreview.com

PART OF

SCT

FREE PASS AT

WWW.SCTX.CO.UK

SECURITY & COUNTER

TERROR EXPO

CNI PROTECTION | BORDER SECURITY

6-7 March 2018 Olympia, London

OFFENDER MANAGEMENT | SERVICES

MAJOR EVENT SECURITY | CYBER SECURITY POLICING AND COUNTER TERRORISM

PROTECT | PREVENT | PREPARE 100+ free-to-attend conferences and seminars

Network with 10,000+ senior security professionals

50+ live demonstrations of the latest technology

Connect with 350+ global solution providers

WHATâ€™S NEW IN 2018: Security Leaders Programme | Integrated Security Showcase | Counter Terror Awards | People Movement & Management Show

WORLD COUNTER TERROR CONGRESS

Ambition THE EPRR EXPO

Organised by

@SCTX18 FORENSICS EUROPE EXPO

sctx.co.uk/linkedin

PUBLIC-PRIVATE PARTNERSHIPS

ENHANCEMENT OF PUBLIC-PRIVATE PARTNERSHIPS WITHIN CRITICAL INFRASTRUCTURE PROTECTION PROGRAMS By Pepijn Vos, researcher and consultant at TNO, Brian Tjemkes, associate professor of Strategy and Organization at VU University Amsterdam, Marieke Klaver, researcher and project manager at TNO, and Duane R. Verner, AICP, program manager within the Global Security Sciences Division at Argonne National Laboratory. INTRODUCTION The complex nature of the critical infrastructure risk environment precludes any one entity from effectively managing risks entirely on its own. To advance critical infrastructure protection (CIP) programs, CI operators (both public and private) and government agencies form voluntary collaborations to achieve mutual and individual objectives such as improved societal resilience or business continuity1. While such public-private partnerships (PPPs) are a popular form of collaboration, in practice we see that they often lead to less than satisfactory results. Although the precise failure rate of PPPs in CIP is unknown, in the context of business-to-business partnerships, failure rates of 30% up to 80% have been reported2, 3. This paper explores the challenges inherent to establishing successful partnerships and proposes a framework for enhancing PPPs in CIP.

BACKGROUND The importance of PPP in the assessment of critical infrastructure can be found in CIP4 program guides and policy documents from both the U.S. and EU. For example, PPPs are integral to the U.S. National

Plan to manage risk to CI. The most recent National Infrastructure Protection Plan (NIPP) is appropriately titled NIPP 2013: Partnering for Critical Infrastructure Security and Resilience. The NIPP is a strategic document that addresses national and sector-level goals; it concludes with a â€˜call to actionâ€™ targeting the CIP community composed of partnerships among critical infrastructure owners and operators; all levels of government; regional entities; non-profit organisations; and academia5. In the EU, PPPs are seen as essential to enhancing CI protection and resilience, as shown, for example, by assessments of CIP across Europe6, 7 and initiatives in the domain of cyber security8. These initiatives have in common that they view PPPs as an integral part of the solution to contemporary challenges in the CIP field. PPPs enable governmental bodies to develop and implement CIP policies. In response to privatisation and deregulation of many parts of the public sectors9, the state has become incapable of providing the public good of security on its own. For governmental organisations an overly intrusive market intervention is not a valid option10; since the same infrastructures that the state aims to protect due to security and broader societal criticalinfrastructureprotectionreview.com

PUBLIC-PRIVATE PARTNERSHIPS

resilience considerations are also the foundation of the competitiveness and prosperity of the nation. In contrast, whereas owners and operators of private CI are ultimately concerned with the ‘bottom line’, there is wide recognition that continuity of operations (COOP) is integral to a successful business. Therefore, investment in CIP is in the interest of private organisations and should be part of a well-designed strategy to enhance a business’s ability to withstand various shocks — for example, natural and man-made disasters, supplier outages, industrial accidents, or economic shocks — and thus enhance the business’s competitive position11. Despite their salience, in practice PPP initiatives depict a paradoxical conundrum. On the one hand, we see an increase in PPP initiatives and much attention is focused on the advantages of PPP in CIP, for example reducing duplication of effort, enhancing public-private sector communication, increasing efficiency, and ultimately achieving objectives better than government and businesses acting independently12, 13. On the other hand, it is difficult to translate the national level goals from the NIPP or policy objectives from the EU into successful partnerships that drive actual change at the national, regional, city, CI system or asset-level.

Figure 1: Prototypical alliance model PPP. 20 Critical Infrastructure Protection Review - Autumn 2017

To resolve this conundrum a PPP framework that is implementable at the local level is required.

ALLIANCE-BASED PPP To provide a coherent set of managerial guidelines, we focus on the alliance model for PPP14. This model is becoming increasingly popular and successful. In contrast to traditional PPPs which are hierarchicalbased (i.e. customer-supplier) the alliance model presumes that partner organisations collaborate on an equal basis, mutual trust is central and that parties develop plans together and share resources, risks and responsibilities. That is, no partner possesses full control and strategic and operational decisions are made together. Figure 1 visualises a prototypical alliance model PPP within the CIP sector. To ensure success, PPP governance entails the use of balancing-mechanisms to resolve three tensions inherently part of such partnerships. Specifically, we propose that (1) promoting collective sense-making resolves the cross-organisation tension, (2) that creating goal alignment resolves the cooperation-competition tension, and that (3) enforcing joint management resolves the rigidity-flexibility tension. These three tensions and proposed solutions are described below.

PUBLIC-PRIVATE PARTNERSHIPS

Within a PPP, mismanagement of the crossorganisation tension generates miscommunication, triggers work conflicts, promotes distrust and stimulates divergent perceptions about what a PPP is and how it should operate. This tension is inherently part of PPPs, as partners fulfill different societal functions, have different objectives (i.e. social vs profit), are held accountable by different parties (e.g. stakeholders vs. shareholders), and bring different organisation designs, cultures, incentive systems and resources to the collaboration. For example, whereas governmental bodies are focused on the security of CI, the companies that operate them are driven by market forces and are concerned about the value of their brand, their responsibility to their shareholders, and regulatory compliance. Local governments intrinsically want to focus on CIP for the local infrastructures and threats, while a multinational utility may choose to focus on national or international CI. If the cross-organisation tension is not controlled, it will negatively affect the partners’ ability to realise their PPP-objectives. We suggest that to deal with this tension partners create collective awareness of the PPP position in relation to their own organisations and the environment, and identify cross-organisation differences that need to be overcome for the partnership to be successful.

of infrastructure and systems, the companies that operate them are driven by market forces. To attain these goals, both governments and owners/operators may act in their own self-interests and not share relevant information, misuse a power advantage, and neglect to make resource contributions. Such acts raise coordination costs decreasing the value of the collaboration. To make a PPP work, and even if differences in interest do not always imply conflicts of interests, partners should become aware, explicate, share and align individual and joint interests. Due to the unique nature of a PPP, the rigidityflexibility tension is likely to emerge. Adopting a rigidity view on governance suggests that PPPs can be designed and managed purposively. Partners can impose controls on and generate predictable patterns of behaviors and actions: they can formulate a PPP strategy and then develop a plan to execute it. Yet unforeseen events within the PPP or changes by one of the partners (e.g. policy/strategy, priorities, staff and needs) or events in the environment (e.g. accidents, increase of threats, stakeholder pressure) may affect the partners and or PPP. This often prompts learning and requires changes and adaptation. A focus on rigidity thus suggests that decision makers have a mechanistic understanding of alliance management,

Not dealing with the cooperation-competition tension – the tension between the pursuit of joint and individual objectives – will steer a PPP towards failure. In a PPP, partners become dependent on each other’s resources, share control and management, accept overlapping roles and responsibilities, engage in adaptation through mutual cooperation, install internal and proactive monitoring mechanisms and develop long-term incentive systems. In doing so, an over-emphasis on joint goal attainment (e.g. building infrastructure or sharing security information) may come at the expense of individual goals (e.g. safety and profit). In contrast, even if all partners agree that CIP is important, their individual ambitions and priorities can have negative implications for partnership progress15. For example, whereas governments are focused on the security and resilience

which conflicts with the inherently unstable nature of PPPs. A focus on emergent forces instead implies a reactive approach to alliance management, which is likely to result in under-performance due to a lack of direction. To resolve this tension, it is imperative that partners jointly focus on the interrelatedness between deliberate and emergent forces. To achieve shortterm results, they should set milestones and execute a straightforward project plan, while they also consider their formulated long-term objectives. As the alliance progresses, they use their new insights to jointly deal with emergent circumstances. In sum, to increase the chance of success, partners should enforce joint management and appoint skilful, experienced managers to reconcile the tension between deliberate ‘stick to the plan’ and emergent ‘open to adaptation’ approaches. criticalinfrastructureprotectionreview.com

PUBLIC-PRIVATE PARTNERSHIPS

PPP performance pertains to: (1) the degree of achievement of individual and shared goals, (2) the mode of functioning of the collaboration, and (3) the extent to which the PPP generates societal impact. Building on this definition of PPP performance, we present a framework for developing and managing successful PPPs. The framework is based on four alliance development stages16 and consists of (1) exploring, (2) forming, (3) executing, and (4) terminating (see Figure 2, Table 1). Each phase is characterised by specific results, activities and decisions,

associated with forging PPPs. Awareness reduces the likelihood that crossorganisation differences will emerge once the partnership becomes a viable alternative. For example, governments need to accept that control needs to be shared, whereas private organisations need to understand that their counterparts are held accountable by multiple stakeholders. Preparing staff to deal with prejudice and look for opportunities will ease progress during the forming and execution stages. To deal with the cooperation-competition tension it is critical that organisations explicate their individual CIP ambitions and how PPP may play a role in fulfilling their ambition. This will prepare the organisation to create alignment with ambitions and goals put forward by potential partners. As part of exploration, organisations need to consider how PPPs fit or misfit with their internal organisations. This is critical as to avoid the negative repercussions of the rigidity-flexibility tension. For example, private organisations tend to organise

which we discuss while taking into account the three PPP-tensions. Although, the activities, results and decisions in one stage directly affect the next stage(s), partnership development is iterative in nature, which means that insights and experiences can be used in previous stages. Exploring stage. When formulating a PPP strategy, it is important to pay specific attention to the nature of the societal contribution, internal and external conditions, and interests and objectives of the internal and external stakeholders. An organisation should critically exam whether the CIP problem requires a PPP. Whether it is possible to divide the CIP-issue into minor problems and is it possible to resolve (each divided) CIP issues without the input of other organisations. During this exploring state, it is imperative that internal awareness is created about the challenges

around opportunities with decentralised decision-making whereas governments are designed for compliance and accountability with centralised decision-making. Pre-emptively preparing for these differences will ease partnership negotiation and execution. The NIST Community Resilience Planning Guide suggests linking a communityâ€™s social functions to CI and the built environment as an integral part of its six-step planning process. While laudable, in practice this comprehensive approach to resilience planning is likely to result in tension between long-term social goals of the community and short-term performance goals of CI owners and operators17. For this example, during the exploring stage it would be important to consider dividing the CIP issues into minor problems and identify those that can be resolved without the input of other organisations.

Figure 2: PPP-development framework.

A FRAMEWORK FOR SUCCESFULL PPPâ€™S IN CIP

22 Critical Infrastructure Protection Review - Autumn 2017

PUBLIC-PRIVATE PARTNERSHIPS

Forming stage. During the forming stage the partners develop a foundation for executing, developing and terminating the collaborative activities of the PPP. This consists of the composition of partners, expectation about PPP ambitions, scope and conditions of participating and a PPP governance structure (e.g. organisation structure, staffing, behavioural rules, legal entity, contract). This is also the stage where other parties, such as lawyers, financial advisors, and third-party mediators may become involved. From the first interaction during the forming stage up until alliance execution the partners lay the basis for PPP success. Encounters during partner selection, negotiation, and launch preparation determine whether the partners are able to generate ongoing and constructive collective sense-making processes. For example, as outcomes during the forming stage transfer to the execution stage, hostile negotiations undermine partnership progress, whereas constructive dialogues promote close collaboration. Joint sensemaking is enhanced by developing together behavioural guidelines, determining how to implement and to monitor this and if needed how to develop it through the collaboration. Developing a joint communication plan to inform internal and external stakeholders and about the meaning of the PPP for the partner and the society is also instrumental to overcome the cross-

time period), it is better to design adaptable contractual clauses (e.g. combination of fixed and variable contributions based on circumstances). Furthermore, decisions about tasks, responsibilities, staffing and communication should be made with a clear focus on joint management. For example, the Lower Manhattan Security Initiative (LMSI) is designed to detect threats and perform surveillance south of Canal Street in Lower Manhattan, New York City. LMSI combines an increased police presence with technology to accomplish its mission18. The LMSI’s integrated approach to security provides critical supplemental assistance to NYPD’s ongoing security and public safety efforts, and also enhances the collaborative nature of those efforts by leveraging the resources of the private sector and other City agencies. Guidelines establishing policies and procedures for the LMSI include technical, operational, legal, policy, and oversight safeguards and a specific task to conduct periodic reviews to ensure full compliance with these Guidelines19. Having such an agreement between public and private sector partners provides an excellent opportunity to evaluate the partnership on a regular basis and take corrective actions as appropriate. Executing stage. During this stage, the partners bring the PPP alive, execute the (initial) PPP plans and continue their commitment to develop the

organisation tension. To deal with the cooperationcompetition tension it is critical that organisations invest in aligning individual goals, explicate and align common goals, and if needed formulate societal goals. To attain this, partners preferably interact in an open, flexible and creative manner. Also, the outcomes of this exercise are championed by the partners and communicated to all internal and external stakeholders. During the forming stage, the partners develop a blueprint for the PPP governance structure. Establishing joint management is the primary focus when partners decide on goals, scope, and other contractual stipulations. It is, however, imperative that the governance structure provides sufficient focus and direction, yet also allows for flexibility in dealing with unforeseen circumstances. Thus, instead of having detailed and fixed contractual clauses (e.g. specified contributions for a specified

PPP. The partners transition from ‘drawing board’ to ‘day-to-day’ operations. Partners deploy their resource contributions, implement coordination mechanisms, act on expressed commitments and begin to execute the tasks assigned to them. During the initial launch period, partners need to strengthen strategic and operational commitment, resolve emerging (goal) conflicts, test the viability of the new organisation, and build collaborative and meaningful relations. As the partnership evolves, uncertainties and ambiguities arise, emerging from both internal and external contingencies. Therefore day-to-day management focuses on coordinating and monitoring to the purpose of creating value-creating conditions and mitigating the potential threat of adversities. By evaluating systematically, management gets insight into the progress of the process and, if necessary, can follow adjustments and/or interim results. criticalinfrastructureprotectionreview.com

PUBLIC-PRIVATE PARTNERSHIPS

All participants should understand the meaning and position of the PPP for each partner. For instance, this could be realized by organising a kick-off meeting with support of top management, following training together, implementing the rules of engagement, visiting each other’s organisation and stimulating informal communication. To prevent a ‘we-versus-us’ culture as opposed to collective sense-making, it is important to monitor potential conflict, miscommunication and trust and take steps for trust building. During the kick off, all participants should also be aware of the shared and aligned individual and joint interests, why combining resources is needed, and the associated implications for working together. While during the day-to-day PPP operation, management should monitor conflicts and regularly evaluate and communicate progress made towards realisation of the individual and common goals. Systematic evaluation of PPPs is, however, complex because of the combination of intentional vs. emergent goals, process vs. result-related indicators, individual vs. joint vs. societal goals, short vs. long-term effects and tangible vs. non-tangible results. It is the responsibility of managers to develop and deploy a tailor-made, yet comprehensive performance metric system. Such a system allows them to obtain early information about lack of progress and develop appropriate corrective measures. To ensure the legitimacy of the PPP,

an ISAC, not only public knowledge is being shared, but also sensitive (business) information. In support of this sharing of sensitive information, clear rules are established for ensuring the confidentiality of this information. Those who contribute the information indicate the degree of confidentiality themselves. In this way, it is clear to every member how they are to deal with this information. In order to ensure that the rules are also complied with, the chairman asks to actively monitor this and if any unwanted behaviour is displayed that should also be corrected. Terminating stage. The decision to terminate the PPP could be individual or joint. Irrespective, it means making agreements about how to dissolve the relationship and about how and what to communicate to internal and external stakeholders. Policymakers and managers are often focused on shaping and managing the PPP, yet thinking about termination is part of the partnership negotiations. How to dissolve the relationship is preferably specified in contractual provisions. The objective is to withdraw from the PPP in a manner in which the financial, relational and possible legal cooperation organisation is neatly dismantled, tangible and results are distributed and communicated internally and externally without reputation damage. Mismanagement of PPP termination can create tensions and conflicts which may result in financial

it is important that assessments are documented and communicated both internally and externally. To accomplish these, and other, execution tasks successfully, it is imperative that all partners are equally represented in a joint partnership management team. Shared decision-making about communication with internal and external stakeholders, the development, use and change of monitoring mechanisms, and joint decisions about how to deal with internal and external contingencies enables the team to resolve the rigidityflexibility tension in support of partnership progress. For example, membership of an Information Sharing and Analysis Centre (ISAC) in the Netherlands, comes with clearly defined rules for trust building and the use of the exchanged information20. Respecting mutual agreements is the key to success or failure, like, for example, the confidentiality of shared information. In

losses, reputational and relational damage. It is important that the partners create a shared understanding of how to terminate the PPP in a favorable way. This termination should be communicated to internal and external stakeholders in order to create a mutual understanding of the motives for and consequences of ending the PPP. To prevent unwanted termination of the PPP as a consequence of too much rigidity or flexibility, it is important to evaluate the partnership on a regular basis and take corrective actions as needed; including making changes in the partnership roles, the staffing and management, and the structures used for joint decision-making and communication. For example, PPPs are essential to the U.S. Department of Homeland Security’s (DHS) Regional Resiliency Assessment Program (RRAP). The goal of the RRAP is to improve the resilience of a region’s

24 Critical Infrastructure Protection Review - Autumn 2017

PUBLIC-PRIVATE PARTNERSHIPS

PPP-tension Cross-organisation tension Promote collective sense-making Development stage

Cooperationcompetition tension Create goal alignment

Flexibility-rigidity tension Install joint management

Exploring Formulate CIPambition and develop PPP strategy

• Explicate what the role and importance of PPPs is for your organisation • Create awareness about differences between partners about the meaning and the role of PPP • Select staff with an ability to create dialogues and forge bridges between different worlds

• Explicate and align individual PPP goals with the organisation’s long term CIP ambition and plans • Allocate sufficient resources to forge and manage PPPs • Ensure support and commitment from internal and external stakeholders

• Assess which projects require a PPP and which activities can be developed independently • Explicate what internal governance requirements exist and how they can be matched with a PPP • Create awareness about differences in governance requirements between partners

Forming Assess potential partners and commence negotiation about partnership goals and governance with final partners

• Extend generic partner selection criteria to include prior PPP experience and successes • Create a shared understanding about the meaning and importance of the PPP • Set up a constructive dialogue so that possible pre-justices, assumptions, concerns and interests can be explicated, where necessary, corrected

• Select partners based on the uniqueness of their contribution to avoid post-formation conflicts • As PPP goals between partners are different, act creatively to develop win-win solutions • Invest in a constructive dialogue to enable information sharing and to create short-term and long-term incentives

• Assess organisation structure (mis)fit as well as the willingness of partners to adapt • Adapt negotiation strategies and tactics to the counterpart’s and promote focus and creativity • Design governance structure which aligns processes and structures and offer opportunities to learn from one another

Executing Organise partnership launch followed by to day-to-day coordination, monitoring, and evaluation

• Organise a collective kick off meeting, organise learning sessions, and have introduction programs for new people • Proactively deal with work, communication, and decision-making conflicts to avoid escalation • Monitor the extent to which internal and external stakeholders remain committed, if required take corrective measures

• Ensure that all involved know how they add to individual, joint, and societal goal attainment • Develop a performance metric system to assess partnership functioning and outcomes, as well as societal impact • Reassess the viability of the incentive scheme, if (structural) changes occur that affect the PPP’s goal structure

• Set-up a joint management team with sufficient responsibility and authority to enforce the partners and partnership interests • Ensure that all involved know why certain ‘governance’ is needed; pre-emptively deal with potential and emerging coordination conflicts • Monitor how changes affect the partnership and take corrective measures if required

Terminating Organise favorable dismantling of the partnership

• Create a shared understanding about how to dismantle the PPP in a favorable way for all partners involved • Communicate the decision to terminate timely to external and internal stakeholders, as to protect future PPP initiatives

• Remain available to find a win-win solution with your partners, in case relationship repair remains a viable alternative • Ensure that resources are recuperated and If individual goals are not realized, formulate alternative plans to realize these goals

• Dismantling joint management (governance) should occur in an amicable and friendly manner; consider reputation and future encounters • Document and review the termination process, as to use best and worst practices for future PPP endeavors

Table 1: Managerial implications. criticalinfrastructureprotectionreview.com

PUBLIC-PRIVATE PARTNERSHIPS

critical infrastructure through generation of greater understanding and action among public and private sector partners21. From the beginning of each RRAP project, there is a shared understanding that full staffing and management support from DHS is only available for a limited time (typically three years). However, key partnerships established during the RRAP often continue well beyond termination of the project through implementation of project recommendations and forming the nucleus for additional resilience building initiatives.

TO CONCLUDE To build successful alliance-based PPPs in CIP communities, we suggest that PPP managers focus their effort on three balancing mechanisms to deal with the three tensions inherently tied to these partnerships: promote collective sense-making to resolve the crossorganisation tension, create goal alignment to resolve the cooperation-competition tension, and install joint management to resolve the rigidity-flexibility tension. As these tensions permeate PPP development, we also explicated how managers may use these balancingmechanisms during the exploring, forming, executing, and terminating development stages. While each PPP will undoubtedly present its own set of unique challenges, we proffer that if decision-makers adhere to the core logic of the proposed alliance-based framework, the success rate of their PPP will increase substantially. ■

REFERENCES

1 Tjemkes, B, Vos, P, and Burgers, K. (2017) ‘Strategic Alliance Management’, Routledge, Abingdon, second edition. 2 de Man, A.P. (2005) ‘Alliance capability: A comparison of the strength of European and American companies’. European Management Journal, 23: 315–323. 3 Duysters, G, A.P. de Man, D. Luvison and Krijnen A. (2012) ‘The state of alliance management: Past, present, Future’. Association of Strategic Alliance Professionals. 4 CIP is currently seen as an essential part of national security in numerous countries around the world. Critical infrastructure (CI) has been defined in various ways

over time, but generally consist of a set of services and products that are considered essential to the functioning of our modern economies and societies. CI-sectors consist of several key processes, assets and or systems and most countries have their own list of CI-sectors. Examples of CI-sectors are telecommunications, energy, banking and finance, transportation, water supply systems, emergency services and continuity of government. 5 https://www.dhs.gov/sites/default/files/publications/ NIPP%202013_Partnering%20for%20Critical%20 Infrastructure%20Security%20and%20Resilience_508_0.pdf 6 https://www.ceps.eu/system/files/book/2010/12/Critical %20Infrastructure%20Protection%20Final%20A4.pdf 7 https://www.tno.nl/en/focus-areas/defence-safetysecurity/national-security/critical-infrastructure-protectioncip-policies-in-europe/ 8 https://www.enisa.europa.eu/topics/national-cybersecurity-strategies/ppps/public-private-partnership 9 For example in a policy note on the Dutch CIP-effort that was sent to the parliament plan it is estimated that as much as 70-80% is owned by market parties*. In the U.S., private industry involvement in critical infrastructures is assessed to hover somewhere around 85 percent (e.g.**). 10 Anderson, R. and Moore, T (2006) ‘The economics of information security’, Science, 314: 610-623. 11 http://www.ipd.anl.gov/anlpubs/2012/02/72218.pdf 12 See ENISA: Cooperative Models for Effective Public Private Partnerships, Desktop Research Report, 2011 13 See the examples in Klaver, M.H.A., Luiijf, H.A.M. and Nieuwenhuijs, A.H. (2011) ’RECIPE Good Practices Manual for CIP Policies’, The Hague, 92 pages. On-line: http://www.tno.nl/recipereport 14 Two prototypical PPP exist: the concession model and the alliance model. These models both organise collaboration between cross-sector partners to develop CIP. However, they are different with regard to equality and equity. 15 Hardin, G. (1968)’The tragedy of the commons’, Science, 13: 1243-1248. 16 Tjemkes, B, Vos, P.M. and Burgers, K. (2017) ‘Strategic Alliance Management’, Routledge, Abingdon, second edition.’. 17 https://www.nist.gov/topics/community-resilience/ community-resilience-planning-guide 18 http://www1.nyc.gov/site/nypd/bureaus/investigative/ counterterrorism.page 19 http://www.nyc.gov/html/nypd/downloads/pdf/crime_ prevention/public_security_privacy_guidelines.pdf 20 h t t p s : / / w w w. n c s c . n l / e n g l i s h / C o o p e r a t i o n / i s a c s / participation-in-an-isac.html 21 https://www.dhs.gov/regional-resiliency-assessmentprogram

* Ministry of the Interior and Kingdom Relations (2005) ‘Report Vital Infrastructure Protection’: (In Dutch: ‘Rapport Bescherming Vitale Infrastructuur’), The Hague. ** Robinson, P. and Woodard, J.B. (1998) ‘Critical Infrastructure: Interlinked and Vulnerable’, in: Issues in Science and Technology Online, Fall.

26 Critical Infrastructure Protection Review - Autumn 2017

PUBLIC-PRIVATE PARTNERSHIPS

ABOUT THE AUTHORS Pepijn Vos works at the Netherlands Organisation for Applied Scientific Research (TNO) in the field of managing strategic alliances, public-private partnerships and open innovation. He joined TNO as a researcher and consultant in 2008. He works on projects in the field alliance management, public-private partnerships and open innovation in different domains, for instance Safety, Security and Defense. He is co-author of the book Strategic Alliance Management. At the moment he is working in a project to enhance public private partnership in the field of CIP. His main interests is how form and manage multi-partner alliances in a public-private context. He may be reached at Pepijn.Vos@tno.nl.

Brian Tjemkes holds a Ph.D. from Radboud University Nijmegen and is currently employed as associate professor at the VU University Amsterdam. His research interests center on strategic alliances, alliance portfolios, public-private partnerships, and cross-cultural research. His work has been disseminated through various academic and professional conferences and publications in among other Journal of Management Studies, Management Decision, Journal of International Management, and Journal of CrossCultural Psychology. He is co-author of the book Strategic Alliance Management. He may be reached at b.v.tjemkes@vu.nl.

Marieke Klaver works as a program manager and senior researcher at the Netherlands Organisation for Applied Scientific Research (TNO). Mariekeâ€™s main areas of scientific research are Critical Infrastructure Protection and Cyber security.

Duane R Verner is the Resilience Analysis Group Leader within the Global Security Sciences Division at Argonne National Laboratory. He oversees staffing and technical assignments, including critical infrastructure vulnerability

She has been involved in many national and European Union Critical (Information) Infrastructure Protection studies. Examples of projects are the policy studies on the vulnerability of the Dutch Internet (KWINT), the Quick-Scan on the Dutch Critical Infrastructure, the development of a Good Practice book for CIP Policy-makers (RECIPE), and several EU research projects on CIP (ACIP, VITA, CI2RCO, IRRIIS, DIESIS, CIPRNet). She is also a guest lecturer at the Cyber Security Academy in a course on Cyber security for Critical Infrastructure. She may be reached at Marieke.Klaver@tno.nl.

assessments, modeling, and dependency analyses. He has provided methodology development and project implementation support to the U.S. Department of Homeland Security Regional Resiliency Assessment Program since its inception in 2009. Duane regularly contributes to the international resilience research community through publications and trans-Atlantic collaboration. Prior to his position with Argonne, he was a project manager for a private sector engineering firm in New York City, working in the transportation, homeland security, and defense sectors. He may be reached at dverner@anl.gov.

Disclaimer This article does not represent the point of view of any national or multinational organisation. Its content should only be considered as the authorâ€™s opinion. criticalinfrastructureprotectionreview.com

PRINCIPALITY STADIUM CARDIFF

14-15 MARCH 2018 BEHAVIOURALANALYSIS.COM

A TWO-DAY SECURITY CONFERENCE EXPLORING NON-RACIAL PROFILING, STRESS RESPONSES, BEHAVIOURAL INDICATORS AND TACTICAL RISK ANALYSIS TECHNIQUES TO IDENTIFY HOSTILE OR CRIMINAL INTENT

TOPICS INCLUDED: PROFILING TECHNIQUES

CROWD DYNAMICS

PHYSIOLOGICAL STRESS INDICATORS

SUICIDAL TERRORISM FIXATED THREATS

SYMPATHETIC & PARASYMPATHETIC NERVOUS SYSTEM

TECHNOLOGYâ€™S ROLE IN THREAT DETECTION QUESTIONING TECHNIQUES & DECEPTION

STEREOTYPICAL BEHAVIOURS INFLUENCES ON PERCEPTION PREVENTION OF RACIAL PROFILING SECURITY & CUSTOMER EXPERIENCE

SPORT S STAD IA ENTER TAINM ENT VE NUES

INSIDER THREAT IDENTIFICATION SUICIDE BOMBER INTERVENTION CASE STUDIES

WWW.BEHAVIOURALANALYSIS.COM OUTDO OR FES TIVALS & EVEN TS

AIRPOR TS

A MUST ATTEND CONFERENCE FOR ALL THOSE RESPONSIBLE FOR THE SECURITY OF:

MASS T RANSP ORT HU BS

TOURIS T ATTR ACTION S SHOPP ING CE NTRES

GOVER NMEN TAL IN STITUT IONS

RISK MANAGEMENT AND BUSINESS CONTINUITY

RISK MANAGEMENT AND BUSINESS CONTINUITY ASSESSMENT:

IMPORTANCE OF CONSIDERING LOGICAL INTERDEPENDENCIES By Frédéric Petit, Research Scientist, Risk and Infrastructure Science Center, Global Security Sciences Division, Argonne National Laboratory; Computation Institute, University of Chicago and Lawrence Paul Lewis, Technical Programs Attorney, Risk and Infrastructure Science Center, Global Security Sciences Division, Argonne National Laboratory; Lecturer, Threat and Response Management Program, University of Chicago. Abstract

Logical interdependencies encompass the interconnected “human” influences, decision-making processes, and effects of choices between organisations that operate in related geographic areas, infrastructure sectors, or business spheres. These are a fundamental consideration when assessing the resilience of an organisation and, ultimately, its ability to support the wider activity or supply chains to which its operations contribute. Upstream disruptions in the critical services or resources that an organisation depends upon can have severe impacts on not only its internal business continuity, but also on that of downstream organisations and individuals that depend upon it. It is essential for risk managers and organizational leadership to thoroughly characterise logical interdependencies when seeking to reduce the extent to which their organisation could be directly or indirectly affected by disruptions to the missions, functions, and operations of other organisations. The proposed protocol for addressing logical interdependencies as a matter of risk management involves several collaborative steps between logically-interdependent organisations, including: a) identification of the most critical services and resources needed for sector or supply chain operations; b) information sharing between upstream and downstream partners on how operations may be impacted by a disruption; c) development of redundant services, protective measures, or alternative arrangements to maintain services or supply chains; and d) coordination around sensible prioritisation policies for operational restoration to support the most critical business continuity targets across the geographic area, infrastructure sector, or business sphere. Keywords: risk management, business continuity, logical interdependency, organisational resilience

NTRODUCTION

The resilience of an organisation – its ability to anticipate, resist, absorb, respond to, adapt to, or recover from a disturbance1 – is, in part, a function of the dependencies and interdependencies it shares with other organisations across common geographic areas, connected infrastructure sectors, or related business spheres. These relationships pose unique challenges for risk management; dependencies and interdependencies have the potential to act as risk multipliers, exposing an organisation to indirect

vulnerabilities and increasing the potential for cascading and escalating impacts. Logical interdependencies in particular, which encompass the interconnected “human” elements within and between organisations, are a fundamental consideration in organisational risk management. Which upstream and downstream partners’ operations are critical to the organisation? What would be the effect of a disruption or degradation in their operations? What is the most effective and efficient approach to reduce risk and uncertainty in complex, multi-organisational decision-making? criticalinfrastructureprotectionreview.com

RISK MANAGEMENT AND BUSINESS CONTINUITY

Business continuity depends on expanding our understanding of how logical interdependencies informs the answers to these questions and, ultimately, affects organisations’ resilience posture in an increasingly interconnected world.

FOUNDATIONS OF ORGANISATIONS’ DEPENDENCY AND INTERDEPENDENCY

Numerous industry standards require the consideration of dependencies and interdependencies in their risk management and business continuity practices. Such standards often include identifying internal and external dependencies and interdependencies: • National Fire Protection Association (NFPA) 1600 Standard on Disaster/Emergency Management and Business Continuity Programs recommends that emergency planners “identify dependencies and interdependencies across functions, processes, and applications to determine the potential for compounding impact in the event of an interruption or disruption.”2 • American National Standards Institute/American Society for Industrial Security (ANSI/ASI) SPC.12009 Standard on Organizational Resilience stipulates that “the risk assessment and impact analysis should consider its dependencies on others and others’ dependencies on the organization, including critical infrastructure and

The seminal work by Rinaldi, Peerenboom, and Kelly proposed a foundational conceptualisation of dependency and interdependency, and the dimensions in which these relationships operate to define risk and influence resilience.5 Although this research focused on infrastructure science in particular, the concepts have found wider applicability for any organisation seeking to bolster its risk management profile and ensure business continuity. Dependency can be defined as a “[l]inkage or connection between two infrastructures, by which the state of one infrastructure influences or is reliant upon the state of the other.”5 Interdependency can be defined as a “[b]idirectional relationship between two infrastructures in which the state of each infrastructure influences or is reliant upon the state of the other.”6 The authors also provided a framework for organising dependencies into four classes (i.e., physical, cyber, geographic, and logical), and set forth five dimensions with which to characterise dependencies (i.e., operating environment, coupling and response behaviour, type of failure, infrastructure characteristics, and state of operation). Each of these elements is further defined in Tables 1 and 2. This taxonomy has been expanded upon in research

supply chain dependencies and obligations.”3 • International Organization for Standards (ISO) 22301 Societal Security – Business Continuity Management Systems – Requirements 06-152012 specifies that “business impact analysis shall identify dependencies and supporting resources for these activities, including suppliers, outsource partners and other relevant interested parties.”4 All of these standards require the consideration of dependencies and interdependencies that can exist among organisations and affect how these manage risks that may affect business continuity. However, none of these standards define what constitutes a dependency or interdependency, and how these should be integrated into risk management processes.

conducted at Argonne National Laboratory to further define each of the elements and refine the concepts of upstream, internal, and downstream dependencies (Table 3). These categories complement the concepts of classes and dimensions by characterising the interactions of an organisation with its environment (socio-technical and ecological) and thereby enabling a better understanding of how failures can cascade and escalate across systems. A richer understanding of interactions allows for integration of the characteristics (i.e., categories, classes, and dimensions) of critical infrastructure interdependencies in risk management approaches. Integrating the concepts of interdependencies into an organisation’s risk management process enables an understanding of how they influence all components of risk.

RISK MANAGEMENT GUIDANCE

30 Critical Infrastructure Protection Review - Autumn 2017

RISK MANAGEMENT AND BUSINESS CONTINUITY

CLASSES

DEFINITION

Physical

Operations depend on material output(s) of other infrastructure through a functional and structural linkage between the inputs and outputs of two assets

Cyber

Operations depend on information and data transmitted through the information infrastructure via electronic or informational links

Geographic

Operations depend on the local environment, where an event can trigger changes in the state of operations in multiple infrastructures

Logical

Operations depend on the state of other infrastructure via connections other than physical, cyber, or geographical. Logical dependency is attributable to human decisions and actions, and is not the result of physical or cyber processes

Table 1: Dependencies and Interdependencies Classes7.

DIMENSIONS

DEFINITION

Operating Environment

Characterise how external factors can influence infrastructure operations and connections

Coupling and Response Behaviour

Characterise how an infrastructure would react to infrastructure connection disruptions or changes

Type of Failure

Characterise the propagation of consequences resulting from a disruption

Infrastructure Characteristics

Characterise the infrastructure organization and operation

State of Operation

Characterise the critical infrastructure state of operations

Table 2:Dependencies and Interdependencies Dimensions8.

CATEGORIES

DEFINITION

Upstream

Products or services provided to one infrastructure by another external infrastructure that are necessary to support its operations and functions.

Internal

Interactions among internal operations, functions, and missions of the infrastructure.

Downstream

Consequences to a critical infrastructureâ€™s consumers or recipients from the degradation of the resources provided by a critical infrastructure.

Table 3: Dependencies Categories9. criticalinfrastructureprotectionreview.com

RISK MANAGEMENT AND BUSINESS CONTINUITY

One approach to the characterisation of an organisation

functions are preponderant for the greatest number of missions. It is clear that the importance of the mission(s) to the organisation must also be considered. By conducting a functional analysis combined with technical organisation charts, an assessment could build an understanding of the organisation’s structure and determine its critical components. For example, the mission of a water treatment plant is to produce a certain volume of potable water in compliance with pressure and quality requirements. Several functions (e.g., coagulation and flocculation, sedimentation, filtration, and disinfection) support the treatment process. These functions require several assets (e.g., gas or chemical liquid feeders, chemical scales, and emergency shutoff valves) and critical resources (e.g., chlorine, electric power) to operate correctly. The tasks necessary to operate these assets and use these resources in order to accomplish the functions and missions of the organisation involve a complex hierarchy of internal decision-making. The external needs of and demands upon the organisation to procure upstream raw critical resource materials and to satisfy downstream water customers involves

is to focus on its mission(s); that is, the purpose(s) for which it was developed. Fundamentally, each organisation exists to meet specific needs. To fulfil its mission(s), an organisation is usually structured in a system of functions and operations. To be realised, these functions and operations require the use of assets (e.g. buildings, equipment). To be performed, a mission requires a network of functions and assets. Figure 1 represents the structure of an organisation as a matrix. Mission 1 to be filled requires the realisation of Functions 2 and n. The Function 2 requires only the performance of Asset n, whereas the Function n needs Assets 2 and n. This mode of representation provides a rapid view of how an organisation is structured and the relative importance of the organisation’s components. Figure 1 shows what assets and

a complex network of multi-organisational decisionmaking. These internal and organisational decisionmaking processes represent the water treatment plant’s logical interdependencies. Therefore, an organisation is part of a “system of systems” and cannot be considered independently of its operating environment. As described by Rinaldi, Peerenboom, and Kelly: “it is clearly impossible to adequately analyze or understand the behavior of a given infrastructure [organisation] in isolation from the environment or other infrastructures”.15 An organisation is thus in constant interaction with its environment, using and transforming inputs (i.e., critical services and resources) from the environment in order to provide outputs to the same environment (Figure 2). Several elements of its environment may directly affect the operations of an organisation, including

Figure 1: Systemic structure of an organisation. Most risk assessment methodologies are developed by industrial or system engineers with a more specific focus on physical and cyber interdependencies. Logical interdependencies, on the other hand, are less tangible and quantifiable than physical interconnections and have therefore received less attention in the assessments. Furthermore, analysing logical interdependencies would involve anticipating decisions made by dependent organisations and forecasting what could be the organisation’s future managerial decisions.

INTEGRATING LOGICAL INTERDEPENDENCIES INTO RISK MANAGEMENT APPROACHES

32 Critical Infrastructure Protection Review - Autumn 2017

RISK MANAGEMENT AND BUSINESS CONTINUITY

Figure 2: Integration of an organisation in its environment. economic and business opportunities and concerns; public policy; government investment decisions; legal and regulatory concerns; technical and security issues; social and political concerns; and public health and safety.15 Other elements can be added to this list such as natural (e.g., floods, earthquakes, hurricanes) and manmade (e.g., terrorism) events that could have an impact on the organisation’s operations. Considering our water treatment plant, which requires chlorine for its disinfection function, the chlorine constitutes an input to the water treatment plant and the potable

interdependencies to anticipate first-order cascading failures. Understanding logical interdependencies and escalating failures is still a challenge. Comprehensive business continuity processes require collaborative and multidisciplinary approaches to consider all types of interdependencies and combine social, economic, and technical points of view to fully elucidate the full range of influences acting upon an organisation, from the individual asset to the system level.10 This requires combining top-down and bottom-up social and system engineering methodologies to develop a “system

water constitutes the output. The variation of the inputs and of the organisation’s components (i.e., assets, functions, and missions) has a direct effect on the characteristics of the outputs, which are the inputs of other organisations. As a consequence, the relationship of dependencies and interdependencies existing within the organisation, among its components, and between the organisation and its environment must be characterised to anticipate how a change in these connections could affect the operations of the organisation (i.e., negative internal consequences) and generate negative external consequences.

of systems” approach.11 12 Leveraging this “system of systems” approach into multi-organisational decision-making involves several simple yet crucial activities to be taken between logically-interdependent organisations: • Identification of the most critical services and resources needed for sector or supply chain operations. Organisations should determine which of their missions, functions, and assets are critically dependent or interdependent on the services or resources provided by other organisations. These findings should also form the basis for outreach and partnership between directly- and indirectlylinked organisations. • Information sharing between upstream and downstream partners on how operations may be impacted by a disruption. Organisations should

BASIS FOR ACTION ACROSS COMPLEX ENVIRONMENTS Currently, risk and resilience assessments primarily focus on physical, cyber, and geographic

criticalinfrastructureprotectionreview.com

RISK MANAGEMENT AND BUSINESS CONTINUITY

determine how they align with other organisations in service and supply chains, and organise collaborative and secure exchanges with these direct and indirect partners. These interactions should also form the basis for potential coordination on policies that address shared concerns. • Development of redundant services, protective measures, or alternative arrangements to maintain services or supply chains. Organisations should determine which individual and concerted efforts would reduce risks to these service and supply chains. This coordination should also identify how degradation in normal business operations that could continue to support minimally-acceptable needs could be incorporated into partner organisations’ business continuity plans. • Coordination around sensible prioritization policies for operational restoration to support the widest or most critical business continuity opportunities across the geographic area, infrastructure sector, or business sphere. Organisations should build a consensus around which organisations within a shared geographic area, connected infrastructure sectors, or related business sphere will be priority restoration customers of the further upstream organisations.

generators, fuel storage, and refuelling priority to prepare for a power outage. Enhancing the protection and resilience of an organisation’s assets requires the promotion of regional coordination, the definition of restoration priority, and the reallocation of resources to limit negative consequencess and channel potential cascading failures.

The variable of consequence in risk management should drive the determination of how coordinated decision-making could achieve the greatest benefit for the most critical needs.

to the missions, functions, and assets of other organisations. ■

CONCLUSION Logical interdependencies encompass the interconnected “human” influences, decisionmaking processes, and effects of choices between organisations that operate in related geographic areas, infrastructure sectors, or business spheres. These are a fundamental consideration when assessing the resilience of an organisation and, ultimately, its ability to support the wider activity or supply chains to which its operations contribute. Upstream disruptions in the critical services or resources that an organisation depends upon can have severe impacts on not only its internal business continuity, but also on that of downstream organisations and individuals that depend upon it. It is essential for risk managers and organisational leadership to thoroughly characterise logical interdependencies when seeking to reduce the extent to which their organisation could be directly or indirectly affected by disruptions

REFERENCES 1 Argonne National Laboratory, 2012, Resilience: Theory

The next generation of risk assessment and business continuity methodologies needs to be developed at a regional level. The tendency for organisations to be managed and regulated in isolation from one another hampers the understanding of challenges arising from interdependencies. Organisations need to move beyond developing risk management and business continuity plans that focus mainly on facilities and assets, to developing plans that consider regional resilience management capabilities and integrate elements that may be outside of one organisation’s control. It is not sufficient to have 34 Critical Infrastructure Protection Review - Autumn 2017

and Application, Decision and Information Sciences Division, ANL/DIS 12-1, Argonne, Illinois, available at https://www.osti.gov/scitech/biblio/1044521, accessed on October 11, 2017. 2 NFPA, “NFPA® 1600 – Standard on Disaster/Emergency Management and Business Continuity Programs 2013 Edition,” NFPA, Quincy, MA, USA, (2013). 3 ASIS, “The Organizational Resilience Standard [ASIS SPC.1-2009],”

available

https://www.ndsu.edu/

fileadmin/emgt/ASIS_SPC.1-2009_Item_No._1842.pdf, accessed on October 11, 2017. 4 ISO, “ISO 22301:2012 – Societal Security – Business Continuity Management Systems – Requirements,” (2012).

RISK MANAGEMENT AND BUSINESS CONTINUITY

5 Rinaldi, S.M., J. P. Peerenboom, and T. K. Kelly, “Identifying, Understanding, and Analyzing Critical Infrastructure Interdependencies,” IEEE Control Systems Magazine, December 2001, available at http://www. ce.cmu.edu/~hsm/im2004/readings/CII-Rinaldi.pdf, accessed 10 July 2017, accessed on October 11, 2017. 6 Ibid 7 Ibid. 8 Ibid. 9 Petit, Frederic, Duane Verner, David Brannegan, William Buehring, David Dickinson, Karen Guziel, Rebecca Haffenden, Julia Philips, and James Peerenboom, “Analysis of Critical Infrastructure Dependencies and Interdependencies,” Argonne National Laboratory (June 2015), available at https://www.osti.gov/ scitech/biblio/1184636-analysis-critical-infrastructuredependencies-interdependencies, accessed on October 11, 2017. 10 Petit, F., and L. P. Lewis, Incorporating Logical Dependencies and Interdependencies into Infrastructure Analyses, The CIP Report, Center for Infrastructure Protection and Homeland Security, George Mason University School of Law, Washington, DC, USA, January-February 2016, available at https://cip.gmu. edu/2016/02/17/incorporating-logical-dependenciesand-interdependencies-into-infrastructure-analyses/, accessed on October, 11, 2017. 11 Carlson, L, Bassett, G, Buehring, W, Collins, M, Folga, S, Haffenden, B, Petit, F, Phillips, J, Verner, D, & Whitfield, R 2012, “Resilience theory and applications,” ANL/DIS12-1, Argonne National Laboratory, Argonne, IL, available at http://www.ipd.anl.gov/anlpubs/2012/02/72218.pdf, accessed on October 11, 2017. 12 Petit, F., and D. Verner, Critical Infrastructure Interdependencies Assessment, World Security Report, KNM Media and Torch Marketing, December 2016.

Acknowledgement

The submitted paper has been created by UChicago Argonne, LLC, Operator of Argonne National Laboratory (‘Argonne’). Argonne, a US Department of Energy Office of Science laboratory, is operated under Contract No. DE-AC0206CH11357. The US Government retains for itself, and others acting on its behalf, a paid-up non-exclusive, irrevocable worldwide licence in said paper to reproduce, prepare derivative works, distribute copies to the public and perform publicly and display publicly, by or on behalf of the Government. This work is partially supported by the US Department of Energy, Office of Science, Basic Energy Sciences under contract # DE-AC0206CH11357.

ABOUT THE AUTHORS Frédéric Petit is a research scientist specialising in critical infrastructure interdependencies and resilience at Argonne National Laboratory. Dr Petit leads the development of methodologies for the assessment of preparedness, mitigation, response, recovery and overall resilience capabilities of facilities, communities and regions. He also lends his expertise to work on risk, vulnerability and threat analysis of critical infrastructure. Dr Petit received his PhD from the École Polytechnique de Montreal in Civil Engineering, where he focused on vulnerability analysis techniques for critical infrastructure and dependencies on cybernetics. Dr Petit has specialised in risk management and business continuity since 2002. Contact: fpetit@anl.gov Lawrence Paul Lewis is a technical programs attorney specialising in community resilience analysis and decision support software development at Argonne National Laboratory. Mr Lewis leads several Regional Resiliency Assessment Program (RRAP) projects for the U.S. Department of Homeland Security Office of Infrastructure Protection, and has developed novel analytical tools for infrastructure owners and operators across the United States. Mr Lewis is also a lecturer at the University of Chicago, where he teaches on emergency management law, policy-making, and ethics. Mr Lewis received his JD from Tulane University School of Law in New Orleans and his MS from the University of Chicago, focusing on the system dynamics of critical resource management during emergencies. Contact: plewis@anl.gov

criticalinfrastructureprotectionreview.com

The special forces trade fair enforcetac.com

Conference partner

Information Overseas Trade Show Agencies Ltd. T + 44 (0) 20.7886 3102 | F + 44 (0) 20.7886 3101 | otsa@otsa.net

CRITICAL INFRASTRUCTURES RESILIENCE

DO SMART TECHNOLOGIES IMPROVE RESILIENCE OF CRITICAL INFRASTRUCTURES? CHALLENGES, OPPORTUNITIES, PRACTICAL APPLICATIONS

By Aleksandar Jovanović, Steinbeis Advanced Risk Technologies & EU-VRi, Stuttgart, Germany and Maike Vollmer, Fraunhofer Institute for Technological Trend Analysis – INT, Euskirchen, Germany Abstract The paper addresses the impacts that an increased “smartness” of critical infrastructures can have on their resilience towards natural and man-made hazards. Smart technologies, i.e. technologies that are integrated, interconnected, intelligent, and autonomous, usually make a normal operation more adaptive and efficient. However, due to their highly complex architecture, it is not clear if a smart system also behaves smartly when exposed to extreme threats. This question is also focus of the EU project SmartResilience, which develops a respective methodology to measure resilience of smart critical infrastructures. Resilience of an infrastructure is thereby understood as “the ability to understand risks, anticipate, prepare for, and adapt to changing conditions and withstand, respond to, and recover rapidly from disruption”. A maturity model is proposed, which encompasses five levels of critical infrastructure “smartness”, ranging from “non-existent” to “automated/ predictive”. The paper addresses six main challenges that operators of critical infrastructure can face due to the application of smart technologies: “compromise of individual privacy”, “governance related challenges”, and “inconsistent adoption” are in the first place seen as intrinsic challenges of systems becoming smarter; and “vulnerability due to interconnectedness”, “vulnerability due to centralization”, and “increased automation” are crucial challenges especially in the context of natural and man-made threats. While the paper elaborates on challenges that operators of critical infrastructures using smart systems can face, it will be necessary to analyze specifically for each smart critical infrastructure, if and in how far advantages such as being more efficient and adaptive are outweighed by related risks. criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURES RESILIENCE

NTRODUCTION

Living organisms are resilient in their ability to persevere through injuries, infections or trauma. Even through severe disease, critical life functions are sustained and the body recovers, often adapting by developing immunity to further attacks of the same type. Modern critical infrastructures (CIs), e.g. cyber, energy, water, transportation and communication, generally lack the same degree of natural resilience, typically losing essential functionality following adverse events. The society, therefore, needs a system of resilience governance and resilience management going beyond conventional risk governance/management in order to address the complexities of large integrated systems and the uncertainty of future threats, especially those associated with climate change or adverse human actions. The way to reach this goal is to provide a new holistic approach to resilience, addressing a broad variety of issues including human factors, security, geo-politics, sociology, legislation, economy, etc. and increased vulnerability due to changing threats. This holistic approach has to be based on new metrics and validated indicators that could be applied to systems in order to assess their level of resilience. This is of particular interest for the so-called smart infrastructures i.e. the infrastructures which are becoming increasingly smarter through application of smart technologies (e.g. smart cities, smart energy supply, smart production). In the short-term, making the infrastructures smarter usually means making them smart in the normal operation and use: more adaptive, more intelligent etc. But would the infrastructures enhanced by the smart systems behave more smartly and react more smartly in the case of exposure to extreme threats? This is not sure because, in the long-term, the increased smartness usually makes these infrastructures also more complex and, being more complex they generally tend to become also more vulnerable. Especially to the poorly known, unknown and/or emerging risks. In addition, when a smart infrastructure becomes a part of a network where nodes are other smart CIs the issue can become even more complex. In such a networked system, the disruption in IT of one smart CI can potentially disrupt the functionality of other CIs. Furthermore, both the 38 Critical Infrastructure Protection Review - Autumn 2017

network of the CIs and the underlying IT is in itself a CI. These issues, tackled in the paper are also in the focus of the EU project SmartResilience, currently searching a way to “measure” the resilience of smart infrastructures by means of (resilience) indicators. The solutions proposed and developed in the project and described in this paper will help assess the effects of making existing infrastructure smarter and find answers to the questions such as would it also make the CI more vulnerable, would this improve the ability to anticipate, prepare for, adapt and withstand an adverse event, or what are the resilience indicators which one has to look at. These are the main questions tackled by the SmartResilience project [1] [2]. Hence, for a CI, it is at first important to define: 1. What makes a smart critical infrastructure “smart” and how do we assess the level of its “smartness”? 2. What are the challenges originating from the application of new technologies when enhancing the “smartness” of a critical infrastructure? Further, in order to analyze resilience of a system (smart CIs, in this case), it has to be clear what one actually talks about. This is not trivial, due to the tremendous amount of different approaches, definitions, and concepts of the term, also resulting from diverse history of using the term in different disciplines. Initial working steps in SmartResilience thus included a review - actually, a “review of reviews” - on relevant research results addressing the issue, identifying aspects of resilience that most approaches agree on, as well as aspects that are understood in different ways [3]. For example, one of the aspects, on which there is no consensus among the diverse understandings of resilience, is the question if being resilient means being able to “bounce back” to a state prior to a shock, or also to be able to transform into a new, adapted and more resilient state. Especially in the context of smart systems, the latter seems more applicable, because technologies and processes are developing and changing quickly, which implies a constant need for adaptation. This also relates to the conclusion that in contrast to traditional risk management, being resilient also means being able to deal with new, unknown and foreseeable threats.

CRITICAL INFRASTRUCTURES RESILIENCE

Figure 1: Characteristics of smart systems and underlying smart technologies [5]. Following the derived working definition of resilience for the SmartResilience project, resilience of an infrastructure is “the ability to understand risks, anticipate, prepare for, and adapt to changing conditions and withstand, respond to, and recover rapidly from disruption” [3].

SMARTNESS OF AN INFRASTRUCTURE According to the strategic agenda of the European Technology Platform on Smart Systems Integration (EPoSS), smart systems, are “self-sufficient intelligent technical systems or subsystems with advanced functionality, enabled by underlying micro-, nano- and bio-systems and other components. They are able to sense, diagnose, describe, qualify and manage a given situation, their operation being further enhanced by their ability to mutually address, identify and work in consort with each other. They are highly reliable, often miniaturized, networked, predictive and energy autonomous” [4]. The paper suggests that the smart systems used in the CIs have three key main characteristics. They are (Figure 1):

1. Integrated and interconnected; 2. Intelligent; 3. Autonomous. Most of the existent research on smart systems is focused on smart cities and on the factors that contribute to their smartness. Smart cities are composed of CIs, such as smart airports, smart manufacturing, smart healthcare system, smart water supply systems, etc. These cities are also referred to as CI of CIs. Recently, the focus has been shifting from city to CIs [4] [6] [7] [8], and is considered useful in this task. For example, the EPoSS definition of smart systems as quoted above seems directly applicable to the context of CIs. Consequently, in the SmartResilience project, smart critical infrastructure is a critical infrastructure (in the sense of the European Council Directive 2008/114/ EC on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection [9]), which is efficient and able to maximize the service it provides by the use of intelligent systems, such as Internet of Things, artificial criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURES RESILIENCE

TYPE OF SMART TECHNOLOGY

BRIEF DESCRIPTION

SMARTNESS CHARACTERISTICS

Artificial intelligence

The goal of artificial intelligence as a science is to make machines do things that would require intelligence if done by human e. g. reduced operator distraction and error [4], or optimisation of vehicle control, navigation and logistics [4]. It can also work autonomously or through networking, safeguard and optimise every aspect of the critical, and it is able to sense, diagnose, describe, qualify and manage a given situation.

Intelligent

Integrated systems

Smart systems integrate all the systems into one and centralise the operations. These systems help in efficient monitoring and control of the operations.

Integrative and interconnected

Big/Open data producing

Smart systems are informed by the effective use of data assets to secure better outcomes. They invest in system-wide data (big and open) capture, integration and analytics capabilities. Open data supports their commitments to transparency and innovation[18].

Integrative and interconnected; intelligent

Micro-sensors, micro-actuators

Micro-sensors gather data and micro-actuators and convert energy into motion[2]. They are enabled by MicroElectro-Mechanical Systems(MEMS), Micro-Opto-ElectroMechanical Systems (MOEMS), and Microfluidics

Intelligent; autonomous

Combinational sensing

Human skin is a good example of combinational sensing, as it combines sensitivities to heat and pressure (touch). Combinational sensing provides similar, engineered, solutions in two ways: (1) combining discrete sensors, or (2) using one sensor structure to measure several things.

Integrative & interconnected; intelligent

Energy management & scavenging

Energy management & Scavenging technologies allow smart systems to make the most efficient use of resources and to gain their operating power from their surroundings.

Integrative & interconnected; intelligent

Machine cognition & Human Machine Interfaces (HMIs)

As systems increase in complexity, human limits may constrain their use. Advances in HMIs will relieve this situation, and devices that better â€œunderstandâ€? the user will provide major advantages in ease and accuracy of operation.

Integrative & interconnected; intelligent

NR.

Table 1: Technologies in smart CIs adapted from EPoSS SRA [4]. 40 Critical Infrastructure Protection Review - Autumn 2017

CRITICAL INFRASTRUCTURES RESILIENCE

Figure 2: Example of the smartness maturity model applied to an airport [13]. intelligence, sensors, actuators and smart computing within an integrative and interconnected network [10] [11]. Smart CIs are also self-sufficient adaptive intelligent technical systems with advanced functionality,

base for developing the link between the smartness characteristics and technologies applicable to the CIs in the SmartResilience project. An adapted list of characteristics and type of (underlying) smart and new

enabled by underlying micro-nano-systems and other components. In order to meet respective challenges, a “better understanding of the critical infrastructure architecture is necessary for defining measures to achieve a better resilience against threat in an integrated manner including natural and human threats”; and in order to achieve a better understanding, “impacts and potential challenges of new technologies have to be integrated into case studies” [1]. The strategic research agenda (SRA) by EPoSS [12] provides a comprehensive overview of the current and future prospects of underlying smart technologies used in Europe within various sectors such as energy, aerospace, health, transport, etc. It recognizes the link between the smart systems and their application in different sectors. The underlying technologies in SRA are taken as a

technologies is presented in Table 1. Incorporation of these types of technologies into the modern critical infrastructure makes them smarter in normal operation and use: more adaptive and more intelligent [12]. Based on existent work on maturity models, SmartResilience proposes a maturity model for smart critical infrastructure. Applying the smartness maturity model to an airport (Figure 2, the example from the “DELTA Airport” case study in SmartResilience), the DELTA airport can be classified as a smart infrastructure of level 2 in this model. The airport integrates sensors for signal acquisition, elements transmitting information to the ´Command and Control´ unit that takes decisions and provides instructions based on available information, components transmitting decisions and instructions, as well as actuators that perform or trigger the required actions. criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURES RESILIENCE

CHALLENGES OF SMART CRITICAL INFRASTRUCTURES The paper suggests to look at the following main challenges posed by the use of smart and new technologies: 1. Vulnerability due to interconnectedness; 2. Vulnerability due to centralization; 3. Compromise of individual privacy; 4. Governance related challenges; 5. Inconsistent adoption; 6. Increased automation. The challenges of compromise of individual privacy, governance related challenges, and inconsistent adoption are in the first place seen as intrinsic challenges of systems becoming smarter, while the vulnerabilities due to interconnectedness and centralization, as well as increased automation are crucial challenges especially in the context of natural and man-made threats.

Vulnerability due to interconnectedness The risks related to the interconnectedness constantly change as new threats and vulnerabilities surface along with ever-changing technology implementations [6]. Hacking of connected objects is a common example. With the Internet of Things, all kinds of machines become connected to the Internet and the role of humans diminishes, even to the point they are removed from the equation. This will generate huge increases in productivity. The dark side is that these connected objects are vulnerable to hacking. For many objects connected with internet, the risks associated with becoming hacked are limited. However, as the objects within the smart CIs become connected, their risk surface to threat such as hacking increases tremendously. Cybercriminals spy on the security gaps in IT of smart CI to manipulate them. Hacking the control system of planes, energy plants, self- driving cars, surveillance cameras and many other connected machines can disrupt vital systems. This may have impact far beyond the type of hacking resulting in embarrassing privacy leaks, as real threat to life. Hence, the adoption and increased reliance on smart technologies such as Internet of Things may be done for example for surveillance and safety purpose, but in parallel may create or increase challenges for the smart CIsâ€™ resilience by making them more vulnerable [14].

Vulnerability due to centralization

Figure 3: Centralization of information processing in smart systems (adapted from [15]). 42 Critical Infrastructure Protection Review - Autumn 2017

Marchese and Linkov [15] argue that the smart systems have a â€œpyramid-like structure with centralized information processingâ€? to ensure performance efficiency and fast operations, Figure 3. Data is aggregated within a central operating node (e.g. a sensor network reporting the events in an industrial plant) which then signal the operators for action, thereby increasing the dependency on one node. The centralization of data may have a larger impact of an event compared to a system,

CRITICAL INFRASTRUCTURES RESILIENCE

Figure 4: Governance related challenges of increasing smartness of CI, adapted from [17]. which is designed for resilience with layers of â€œredundancy and modularityâ€? [15]. Coupled with the inherent level of automation and controllability of systems makes vulnerabilities particularly dangerous if a malicious actor

collection and processing of all this data has significant impact on the privacy and personal data protection. Such surveillance can erode social freedoms and public goods such as privacy, to ensure precautionary

can exploit them[14], meaning that if the attack is targeted at those central and autonomous nodes, it may lead to the complete inoperability of critical functions [15].

or mitigation measures of an unknown event to avoid damage to people, public goods and service, etc. [16].

Compromise of individual privacy

Governance related challenges are associated with the implementation of rules, processes, practices, norms and actions. The smart systems are complex in nature, while a user such as a policy maker or CI operator seeks simplicity of information in the decision making process. This leads to a gap in understanding a complex system, thereby creating a hurdle in decision-making. Moreover, on one side the use of smart systems suggests enhancing the participation of the stakeholders and on the other side, different governance related challenges arise such as compliance issues, complexity in understanding the system, uncertainty and ambiguity [17], Figure 4.

Furthermore, according to results of the EU CRISP (Evaluation and Certification Schemes for Security Products) project, social aspect such as the rights and freedoms of the individuals may be compromised to ensure the safety and security goals by means of smart systems [16]. For example, increased collection of video surveillance cameras nowadays detects and recognizes individuals, relate the images to other databases and uniquely identifies a person. These systems are in extensive use in most public areas in EU countries, public means of transport, CIs, hospitals, private houses, and aerial vehicles such as drones. The

Governance related challenges

criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURES RESILIENCE

CHALLENGE

DESCRIPTION

Scientific unknowns

Dealing with emerging risks requires dealing with scientific unknowns. These unknowns, can be tractable or intractable, and contribute to risks by being, e.g. unanticipated, unnoticed, and over- or underestimated.

Loss of safety margins

The level of connectivity in many social and technical systems is greater than in the past and the interconnections are increasing. The pace at which these systems operate is becoming faster and many are operating under higher levels of stress. This can lead to tight-coupling of components within systems and to loss of safety margins - a loss of slack or buffering capacity that leaves systems more vulnerable to disruption and thus increases the likelihood that new risks will emerge

Varying susceptibilities to risk

The consequences of an emerging risk may be different from one context (situation/ system/population) to another. Geography, genetics, experience and wealth are just some of the possible contextual differences that create varying susceptibilities to risk.

Conflicts about interests, values and science

Public debates about emerging risks seldom witness a clear separation between science, values, and interests. The conflicts that result have the potential to contribute to fertile ground for risk emergence or amplification. For e.g. emerging risks may be amplified when efforts to assess them and take early management measures encounter opposition on the grounds of contested science or incompatible values.

Social dynamics

Social change can lead to potential harm, or it can attenuate it. It is therefore important for risk managers to identify, analyse and understand changing social dynamics.

Communication and information asymmetries

Information asymmetries fall under the umbrella of communication related challenges and occur when some stakeholders hold key information about a risk that is not available to others. These asymmetries may be created intentionally or accidentally. In some cases, the maintenance of asymmetries can reduce risk, but in others, it can be the source of risk or the amplification of risk by creating mistrust and fostering non-cooperative behaviors.

Perverse incentives

Perverse incentives are those that induce counterproductive or undesirable behaviors, which lead to negative, unintended consequences. Such incentives may lead to the emergence of risks, either by fostering overly risk-prone behaviors or by discouraging risk prevention efforts.

Malicious motives and acts

Malicious motives give rise to emerging risks and therefore practitioners need to consider intentional as well as unintentional causes of risk. Malicious motives and acts are not new, but in a globalised world with highly interconnected infrastructures (e.g., trade agreements and information and communication systems) they can have much broader-reaching effects than in the past.

Table 2: Identified challenges (examples, adapted from [19]). 44 Critical Infrastructure Protection Review - Autumn 2017

CRITICAL INFRASTRUCTURES RESILIENCE

Inconsistent adoption Evolution of smart CIs occurs at different rates due to factors such as resource availability, needs and preference of users (e.g. utility operators’ use of smart technologies), or scale and accessibility (e.g. size of the airport, transport systems, water distribution system, etc.) [14]. The inconsistency in the use of new and smart technologies within the SCIs pose new security challenge (e.g. cyber security) for its operators, industry and other stakeholders. Further, merging the new technologies in the old legacy systems, unknown aspects or blind-spots may remain where older legacy systems are dominant making it difficult for the new technologies to report the operational status, problems or efficiency opportunities [14].

Increased automation With the increased automation in the cyber-physical infrastructures, the control of the systems shifts from people to algorithms-based systems. On one side, this transition introduces a “level of security and resilience into the system by mitigating any potential human errors” [14], on the other hand, it potentially presents new safety, security and resilience related challenges, such as: • Increasing the number of system access points and, therefore, potential attack vectors” for example, in a transportation systems, “automation that comes with autonomous vehicles that requires the use of a wide variety of sensors, including light detection and ranging (LIDAR), GPS, radar, and video cameras, all of which add potential vulnerabilities and attack vectors to autonomous vehicles; • Weakening of human skills; • Loss of visibility into all parts of a system; • Cascading failures; necessary changes in

emergency response plans (e.g., humans will not be present in areas of the system they once were); • Unanticipated permutations of automated functioning; • Unintentional elimination of manual overrides.

EMERGING CHALLENGES INDUCED BY IMPLEMENTING NEW TECHNOLOGIES Besides the current challenges presented above, the CWA 16649 standard – Managing emerging technology related-risks – identifies challenges (Table 2) related to the implementation of new technologies [19] . These are also relevant for the technology empowered with smart devices and systems since they can possibly bring new and unknown risks to the critical infrastructures. Hence, the related emerging risks related to smartness are extremely important for the smart CIs.

CONCLUSIONS The widespread use of smart technologies has attracted considerable attention amongst industry, academia, and government. In fact, prior work has documented the characteristics of “smart” systems, especially in the context of cities and critical infrastructures. The paper has described challenges that operators of critical infrastructures using smart systems can face, especially when opposed to an extreme event. However, the question if advantages of smart systems such as being more efficient and adaptive are outweighed by related risks can only be answered on a case by case basis. The same is true for the identification of specific vulnerabilities, which differ between different types of CI and different organisations. The methodology to measure resilience of smart critical infrastructures developed in SmartResilience can support the process of answering these questions. criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURES RESILIENCE

In addition, the paper suggests to use the CWA 16649 standard on “Managing emerging technology relatedrisks” instrumental to study a less explored area, such as resilience management of smart technology related emerging risks. It also provides decision support and guidance to implement a risk management process at the levels of governance, policies, and operations. ■

Commission. Brussels.

http://eur-lex.europa.eu/legal-

content/EN/TXT/?uri=CELEX:32008L0114 accessed on October 20, 2017 [10] Chourabi, N et. al. (2012). Understanding Smart Cities-. An Integrative Framework. 45th Hawaii International Conference on System Sciences, Maui, HI, USA, pp. 2289-2297 [11] Goddard, N. D. R., Kemp, R. M. J., & Lane, R. (1997). An overview of smart technology. Packaging technology and

REFERENCES

science, 10(3), 129-143.

[1] SmartResilience: Smart Resilience Indicators for Smart

[12] EPoSS (2017). Strategic Research Agenda. European

Critical Infrastructures (2016) – The European Union’s

Technology Platform on Smart System Integration. https://

Horizon 2020 Research and Innovation Programme,

www.smart-systems-integration.org/public/documents/.../

Grant Agreement No 700621 (2016-2019). Coordinator: EU-VRi, www.smartresilience.eu-vri.eu

EPoSS_SRA2017.pdf accessed on August 25, 2017 [13] István. M. & Zoltán. S. (2017). Case study DELTA and the

[2] Jovanovic. A., Schmid. N., Klimek. P., Choudhary. A.

significance of the SmartResilience project for the aviation

(2016). Use of indicators for assessing resilience of

security sector. Presentation at the SmartResilience

Smart Critical Infrastructures, IRGC Resource guide on resilience. Lausanne: EPFL International Risk Governance Center.

Workshop, September 14, 2017 [14] US Department of Homeland Security. (2015). The Future of Smart Cities: Cyber-Physical Infrastructure Risk.

[3] Vollmer, M.; Walther, G.; Jovanović, A.; Schmid, N.;

https://ics-cert.us-cert.gov/sites/default/files/documents/

Øien, K.; Grøtan, T. O.; Choudhary, A.; Kokejl, R.; Buhr,

OCIA%20-%20The%20Future%20of%20Smart%20

K.; Karlsson, A.; Egloff, R. (2016): SmartResilience D1.1

Cities%20-%20Cyber-Physical%20Infrastructure%20

Initial Framework for Resilience Assessment.

Risk.pdf

[4] Weiler et. al.(2013), Strategic Research Agenda of EPoSS, Strategic Research Agenda of EPoSS, Berlin [5] Choudhary A., et. al. (2017): SmartResilience D2.1 Understanding “smart” technologies and their role in ensuring resilience of infrastructures

[15] Marchese, D., & Linkov, I. (2017). Can You Be Smart and Resilient at the Same Time? Environmental Science &

technology,

51,

5867?5868,

DOI:

10.1021/acs.

est.7b01912 [16] EU CRISP project (2017) Briefing paper for the regulators.

[6] ENISA (2016) Securing Smart Airports. European Union

EU FP 7 project, GA no. 607941. Netherlands. http://

Agency For Network And Information Security doi:

crispproject.eu//wp-content/uploads/2016/09/CRISP-

10.2824/865081 accessed on August 25, 2017

Regulators-FINAL-.pdf

[7] ENISA (2016) Smart Hospitals- Security and Resilience

[17] Renn, O. (2015). Stakeholder and public involvement in

for Smart Health Service and Infrastructures. European

risk governance. International Journal of Disaster Risk

Union Agency For Network And Information Security, Greece doi: 10.2824/28801 accessed on August 24, 2017 [8] European Union Agency for Network and Information

Science, 6(1), 8-20, doi:10.1007/s13753-015-0037-6 [18] Scottish Readiness.

Government. Scotland:

Scottish

Smart

Cities

Government.

Security - ENISA (2015) Cyber Security and Resilience

Retrieved

of Intelligent Public Transport. Chapter 4. ISBN: 978-92-

static/53c8d78be4b0c984e42f0c74/t/555c8391e4b0add3

9204-146-5

ac04f1d3/1432126353356/Smart+Cities+Readiness+Ass

[9] European

Commission.

(2008).

Council

Directive

from

(2015).

https://static1.squarespace.com/

essment+-+Guidance+Note.pdf

2008/114/EC on the identification and designation of

[19] DIN CWA 16649:2013 E / DIN SPEC 91299: Managing

European critical infrastructures and the assessment

emerging technology-related risks, ICS 03.100.01 (Oct.

of the need to improve their protection. European

2013, conv. A. Jovanovic), CE, Brussels, Belgium 2013

46 Critical Infrastructure Protection Review - Autumn 2017

CRITICAL INFRASTRUCTURES RESILIENCE

ABOUT THE AUTHORS Prof. Dr. Aleksandar Jovanovic is the director of the Steinbeis Advanced Risk Technologies group in Stuttgart, Germany providing consultancy in the areas of risk assessment and management for industry and public sector. As from 2006 he is also the CEO of European Virtual Institute for Integrated Risk Management (EUVRi) and the EU Project Director at ZIRUS (Center for Interdisciplinary Risk and Innovation Studies, University of Stuttgart), teaching the courses in the area of CSR (Corporate Social Responsibility) and Risk. He has acted as Seconded National Expert (Germany) with the EU in Brussels, Belgium, Directorate-General Research – Industrial Technologies and Materials. His previous teaching assignments were in France (Ecole Polytechnique), Japan (University of Tokyo), USA (La Jolla) and other countries. A. Jovanovic has over 50 large international/multinational projects in the area innovation management, new technologies, business risk management, structured project management, advanced data analysis and data mining, and related areas. Main clients in the projects have been from the EU, national governments (Norway, Belgium, Japan…), industry, utilities, insurances companies, R&D and academia. Main topics covered by the projects have dealt with risk management in industry including HSSE (Health, Safety, Security, Environment), RCM (Reliability Centered Maintenance), RBI (Risk-Based Inspection), KPIs (Key Performance Indicators) and RCFA (Root Cause Failure analysis), and many applied in industry and/or used as the basis for further standardization. A. Jovanovic is author of five books and over 200 publications. Contact: jovanovic@eu-vri.eu www.eu-vri.eu

Maike Vollmer is a senior scientist at the Fraunhofer Institute for Technological Trend Analysis (INT) in Euskirchen, Germany. She is a geographer and conducts research mainly in the fields of crisis management, resilience, and innovation management. Currently, she is leading the institute’s contribution to the EU H2020 projects SmartResilience (“Smart Resilience Indicators for Smart Critical Infrastructures”), and ResiStand (“Increasing Disaster Resilience by Establishing a Sustainable Process to Support Standardisation of Technologies and Services”). She further conducts research within the EU H2020 project IN-PREP (“An INtegrated next generation PREParedness programme for improving effective inter-organisational response capacity in complex environments of disasters and causes of crises”), and is writing a doctoral thesis in the field of hurdles for innovation to increase resilience. Prior to her assignment at Fraunhofer INT in 2013, she has worked for the United Nations University – Institute for Environment and Human Security (UNU-EHS) for five years. Contact: maike.vollmer@int.fraunhofer.de www.int.fraunhofer.de

Acknowledgments The contribution is based on the Grant Agreement No. 700621 supporting the work on the SmartResilience project provided by the Research Executive Agency (REA) (‘the Agency’), under the power delegated by the European Commission (‘the Commission’). This support is gladly acknowledged here, as well as the collaboration of all the partners and their representatives (persons) involved. criticalinfrastructureprotectionreview.com

REFERENCE

SECURITY CHALLENGES IN THE NHS

Barnsley Hospital NHS Foundation Trust

SECURITY CHALLENGES IN THE NHS By Mike Lees MSc DipHEP CSyP FSyI FBCI, Head of Business Security, Barnsley Hospital NHS Foundation Trust INTRODUCTION The modern-day UK National Health Service faces a legion of challenges, which include financial, staffing and resources alongside a host of other competing priorities. It is a misconception that the NHS is just one national entity; in reality it is over four-hundred individual, regional and national organisations alongside over several thousand GP practices. The NHS is the fifth largest employer in the world following the US Department of Defense, the Chinese Army, Walmart and MacDonaldâ€™s and its organisational spectrum ranges from huge acute hospital premises to local cottage hospitals and large, secure mental health establishments to small, allied health contractors. With some 1.3 million staff employed and a planned expenditure of ÂŁ120bn the security challenges soon become obvious.

At a local level, a medium-sized acute hospital (see photo above) in a northern town will have some 5,000 persons passing through its doors daily. This same organisation will have a large mix of medical and surgical specialities, busy theatre areas, with vulnerable, young and elderly in-patients. There is also a need for the ever-flexible access for clinical, nursing and rapid response staff together with visitors, relatives and contractors. Together this makes for a potential security nightmare. This article will outline how many of the practical, protective security challenges are met within these setting but will also explore the more obscure, qualitative trials that beset senior NHS security managers. These include: the now limited national support, the politics of complexity, investigative culture, threat v risk debate and ongoing NHS transformation. The summary will underline the massive opportunities criticalinfrastructureprotectionreview.com

SECURITY CHALLENGES IN THE NHS

presented by many of these challenges and how one acute hospital Trust is actively embracing them. Although there is reference to Barnsley Hospital NHS Foundation Trust many examples and cases stated originate from other NHS organisations and have been cited at other regional and national security meetings. All opinions and views contained within this article are not those of the NHS or Barnsley Hospital NHS Foundation Trust and are entirely those of the author.

CONTEXT Nowadays, mixed speciality wards along with any acute hospital will accommodate many other facilities including retail outlets and ‘hospital streets’. Some larger city hospitals are now akin to smaller shopping centres. The author manages a small security unit with contracted uniformed officers (total staffing 13) in a hospital that serves a population of approximately 250,000 people, with circa 380 beds and built in the 1970’s which in itself poses problems. In 201617 the staff cared for 413,833 patients, 265,374 in clinic appointments and 83,550 in the Emergency Department (A&E). The Trust employs 3,500 staff and provides emergency and intensive care, medical and surgical care, elderly care, paediatric and maternity along with diagnostic and clinical support. The hospital site also includes two large pharmacy areas, pathology laboratories, nuclear medicine, children’s wards, renal unit and the large local public mortuary. There are also several small retail outlets alongside a 250-seater staff restaurant and volunteer catering outlets. NHS providers are mandated to provide accredited security managers within the NHS Standard Contract who also fall within the remit of a number of regulatory agencies including Care Quality Commission, NHS Improvement, Health & Safety Executive, Environment Agency, Security Industry Authority and Information Commissioner’s Office. Over the last 4 years, Barnsley Hospital has adopted an incremental improvement strategy in relation to security management, accepting valuable support from the local Counter Terrorist Security Advisors (CTSAs) and police Crime Reduction Officer. The Trust 50 Critical Infrastructure Protection Review - Autumn 2017

six-monthly security surveys are multiagency, layered and technically, qualitatively driven, with the Business Security Unit working innovatively to squeeze out every benefit from a financial background of harsh competing priorities. Some three years ago, the Trust completely refitted the camera recording system selecting a UK company and very recently equipped its uniformed security staff with front screen body worn video cameras. The Trust policies and procedures were updated accordingly which included an active dialogue with emergency service and local authority colleagues.

KEY CHALLENGES Identifying the challenges is an essential part of the equation and this where the title of ‘universal problem solver’ is well deserved by NHS security managers. Each NHS organisation chooses where to position and locate security management staff. The reporting line can vary between numerous management tiers or directly to the Chief Executive. Many NHS security managers sit within estates and facilities departments, health and safety departments or risk management departments with some directly linked to patient advice liaison teams. Progressively NHS strategic security teams are becoming members of arm’s length organisations (ALOs) or wholly owned subsidiaries of individual NHS organisations. The challenge is one of organisational linked to national consistency which has been accelerated by recent national changes in security management discussed later. The complexities and specialities of larger NHS organisations means attempting to match security priorities and strategies across numerous hospital wards, departments and in some cases different property sites. Owing to radical changes at a national level and a focus on intelligence led counter-fraud enquiries, support to local NHS security managers ceased on 1st April 2017. From that date management boards of individual NHS organisations and their respective Security Management Directors (SMD) assumed responsibility for all issues relating to security. Prior to this, security managers could discuss any legal problems with a national legal protection unit and

SECURITY CHALLENGES IN THE NHS

Certification by the Surveillance Camera Commissionerâ€™s Office for the proportionate, legal and responsible use of CCTV, body worn video and drone equipment. could call on the support of several highly experienced area security specialists in respect of any operational guidance. The author, who has over 30 yearsâ€™ previous police experience, found both resources invaluable with their wealth of NHS experience. There is no indication that this support will ever be replaced alongside the valuable annual statistics, alerts and learning the former national organisation published.

NHS security has a multi-agency dependency particularly with the local police and ambulance services. The reduction in public sector resourcing has played its part in increasing the challenges faced to all NHS managers. Local police forces are looking to reduce the demands placed on them from many organisations both public and private, hospitals generally being close, if not the top of the

Many security challenges within the NHS are legacy based and have been present within respective organisations for many years but there is now an unremitting drive to address these at all levels. Earlier in this article, there was reference to many hospitals having been built in the 1970s. At that time, asbestos was a readily accepted building material and its hazardous properties little known. To aesthetically modernise or upgrade any security infrastructure whether surveillance assets, access control or alarms often requires work within an asbestos or previously installed asbestos environment. This requires careful planning, substantial resourcing and safety monitoring so adding costs to every installation. Admittedly, this is problematic for many public and private sector organisations but there are few as large or complex as district general hospitals or larger NHS clinic premises.

list. Prioritised emergency calls from the NHS still elicit a good police response particularly in relation to threats or violence to nursing, medical or security staff. Local police strategies in relation to the NHS can range from basing one or more officers on a site, some at cost and some at no cost, to the occasional patrols by community support officers. It must be said that any support by a local police force or individual police commander is always appreciated and valued by NHS security managers. Nevertheless, there could still be an expectation that security management will initially investigate and gather evidence (including CCTV analysis) which in more complex cases can sometimes prove difficult. Arranging security-based table top or live exercises proves difficult owing to diminished resources, fewer staff and other competing demands on our partner agencies. criticalinfrastructureprotectionreview.com

SECURITY CHALLENGES IN THE NHS

The introduction of ‘Hospital Eyes’ posters and corresponding public web page. Although real advances are being made in all incident reporting within the NHS there is a way to go before what can be considered tangible ‘black box thinking’ is

Finally, the impact of Brexit on security management within the NHS has yet to be quantified. Possible changes in procurement, supplies, staff profiles,

achieved to the standards of organisations such as the Air Accident Investigation Branch. The current culture inherently leans towards a more risk-averse ethos where years of patient care training can on occasions produce a reporting imbalance. This is not a criticism but a refreshing change in security management where the balance is often based on negatives and rarely where good is seen in people. In the main, most security assessments are very much a threat as opposed to risk centred. In many cases, establishing an issue as a threat (capability, intention, vulnerability, opportunity) instead of a risk (consequence, likelihood or magnitude, possibility) can tightly define the problem so a more cost effective and timely solution can be identified. The real challenge to NHS organisations is to clearly define what are threats, risks and hazards.

recruitment and movements of EU nationals could well directly or indirectly impact on an organisation’s security priorities.

52 Critical Infrastructure Protection Review - Autumn 2017

MANAGING THE CHALLENGES No doubt many of the author’s colleagues across NHS security management will be able to cite their own innovative thinking and achievements. The following have certainly assisted to reduce if not totally overcome a good number of the challenges explored in this article: • A local confidential reporting line known as LUK (Let Us Know) for reporting security incidents and targeting re-assurance messages at the request of staff. This is underpinned by regular ‘Not on My Watch’ campaigns to reduce illicit activity by patients or staff.

SECURITY CHALLENGES IN THE NHS

• Establishing structured links to partner organisations (police, ambulance and local authority) via regular meetings and established forums. These include local resident’s groups, meetings with council members and community safety teams. • Regular meetings with building project management teams and in-depth safety briefings relating to asbestos and hazard safety • Regrouping local NHS security managers to meet regularly and work to address the loss of national advice and guidance • Introducing body worn video cameras and their regular use has reduced the calls to the police for violence and aggression incidents by 12% generally and a remarkable 80% over the last Christmas period. • The Business Security Unit is accredited to selfdeliver Project Griffin to Trust staff on behalf of NaCTSO and this training is supplemented by briefings on threats, risks and hazards. The advantages of an open ‘black box thinking’ approach is also outlined. • Certification by the Surveillance Camera Commissioner’s Office for the proportionate, legal and responsible use of CCTV, body worn video and drone equipment. • The introduction of ‘Hospital Eyes’ posters and corresponding public web page. Both these initiatives have been well received and provide the necessary assurance to patients and staff.

IN CONCLUSION Security Management within the NHS encourages universal problem solvers who are consummately professional in their approach to the very wide range of challenges explored in this article. Networking within organisations across every departmental and ward level provides valuable intelligence, promotes a mutual trust and allows the security team to appreciate the range of difficulties faced by staff and the organisation’s many service users. There is an absolute requirement for full Board and Executive support alongside any Non-

Executive Directors and Governing Body for security management. Certainly, in the case of the author this has always been unequivocal which readily translates into the provision of good patient safety and staff reassurance. Hospitals are places of high emotion; it is very rare that a patient visit or stay is without some worry or stress. Babies are born in hospitals, tragically patients die in hospitals and life changing diagnoses are communicated within their confines. The role of NHS security managers is to always maintain the delicate balance between patient care and welfare coupled with the pragmatic security of all attendees, staff, equipment and buildings. The challenges for them will always be present. ■

ABOUT THE AUTHOR Mike Lees served with the South Yorkshire Police for 30 years prior to his appointment as a management trainer and NHS commissioning business resilience manager and in 2007 joined British Transport Police as NE Area Emergency Planning Manager. His police experience included posts in community liaison, communications and contingency planning, whilst his role for an international training agency included working with BNFL at Sellafield, Virgin Trains, Royal Mail and the Environment Agency. In November 2009 he joined Barnsley Hospital NHS Foundation Trust as the Security and Resilience Manager and now as Head of Business Security holds this corporate responsibility. Mike is a Chartered Security Professional (CSyP), Fellow of the Security and Business Continuity Institutes and Emergency Planning Society. He is a Member of a number of other professional bodies and holds an MSc in Risk, Crisis and Disaster Management from the University of Leicester. Mike is also a qualified teacher and drone pilot, is proud to hail from Yorkshire, lives in Barnsley and received two commendations during his police service. criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

Critical Infrastructure India. Source: http.www.iciciventure.com

INDIA’s CRITICAL INFRASTRUCTURE PROTECTION – FOR AN INTEGRATED NATIONAL PLAN By Colonel H R Naidu Gade- Indian Army Veteran

NTRODUCTION

Critical infrastructures are organisational and physical assets, systems, networks, and facilities of such vital importance to a nation’s security and economy that their failure or degradation would significantly impact the social and economic wellbeing of the nation and its security. Critical infrastructure needs to be protected against physical as well as cyber threats. India, being a vast nation, developed huge infrastructure in multiple sectors which are critical for its economic development, security, health, safety, and nation functioning. Hence a need for a robust, wide reaching, and integrated plan and programme to protect this critical infrastructure as the national wellbeing relies upon secure and resilient critical infrastructure. To ensure security and resilience, all stakeholders must collectively identify priorities, articulate clear goals, mitigate risk, measure progress, and adapt based on feedback and the changing environment.

CRITICAL INFRASTRUCTURE - VARIOUS SECTORS The big challenge for any nation is in defining their critical infrastructure which needs to be protected. The major sectors in which critical infrastructure exists in India are: Transportation – rail, road, air, water; Energy and Power – oil and gas, conventional, nuclear, non-renewable, generation and transmission; Food and Agriculture – production, storage and distribution; Communications – telecom and Information technology; Defence – strategic assets, research and production; Healthcare & Public Health – hospitals, water and waste water systems; Financial Services – banking and insurance; Government Facilities – administration and public services; Manufacturing – chemicals, machinery and metals; Emergency Services – fire, disaster relief; National Monuments and Icons – heritage and religious sites, museums; and Commercial Facilities – office complexes and stock exchanges. Equally important is the Critical Information Infrastructure of criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

Airports India. Source: https.www.mottmac.com these physical infrastructure assets. Holistically, the Critical Infrastructure Protection (CIP) encompasses both physical and cyber protection.

EVOLVING THREATS TO CRITICAL INFRASTRUCTURE

events; pandemic influenza or other health crises; and the potential for accidents and failures due to infrastructure operating beyond its intended life span. The potential for interconnected events with unknown consequences adds uncertainty in addition to the known risks mentioned above.

The risk environment affecting critical infrastructure is complex and uncertain; threats, vulnerabilities, and consequences have all evolved over the last decade. Critical infrastructure that has long been subject to risks associated with physical threats and natural disasters is now increasingly exposed to cyber risks, which stems from growing integration of information and communications technologies with critical infrastructure operations and an adversary focus on exploiting potential cyber vulnerabilities. The evolving threats to critical infrastructure could be in the broad categories of adversarial/ human-caused, natural, and technological/ accidental threats. Critical assets, systems, and networks face many of the threats as categorised above, including terrorists and other actors seeking to cause harm and disrupt essential services through physical and cyber-attacks; severe weather

Growing interdependencies across critical infrastructure systems, particularly reliance on information and communications technologies, have increased the potential vulnerabilities to physical and cyber threats and potential consequences resulting from the compromise of underlying systems or networks. In an increasingly interconnected world, where critical infrastructure crosses national borders and global supply chains, the potential impacts increase with these interdependencies and the ability of a diverse set of threats to exploit them. In addition, the effects of extreme weather pose a significant risk to critical infrastructure â€“ rising sea levels, more severe storms, extreme and prolonged drought conditions, and severe flooding combine to threaten infrastructure that provides essential services to the people. Ongoing and future changes to the climate have the potential to

56 Critical Infrastructure Protection Review - Autumn 2017

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

Nuclear Facilities India. Source: http.insideclimatenews.org compound these risks and could have a major impact on infrastructure operations. Finally, vulnerabilities also may exist because of a retiring work force or lack of skilled labour. Skilled operators are necessary for infrastructure maintenance to reduce risks. These various factors influence the risk environment and, along with the government policy and operating environments, create the backdrop against which

decisions should be made for critical infrastructure protection.

STATUS CIP PROTECTION MEASURES - INDIA In India, measures have been taken since 2014 to coordinate the Critical Information Infrastructure Protection by setting up of the National Critical Information Infrastructure Protection Centre (NCIIPC)

Port Facilities India. Source: http.www.hindustantimes.com criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

NEED FOR INTEGRATED APPROACH

Space Infrastructure India. Source: http.www.indianetzone.com at the national level for coordinating and guiding all the stake holders in protecting their information from cyber threats. Being in nascent stage, the NCIIPC needs to do much more to be able to fulfil its mandate and keep critical information secure from possible threats. Large numbers of stakeholders in the states, local bodies and the private sector owners and operators of critical infrastructure have still not registered with the NCIIPC. While the physical security of critical infrastructure including the strategic assets of some government sectors is being taken care of by the designated security forces, many other sectors within the government are yet to initiate measures aimed to prevent, protect, mitigate, respond, and recover from any possible physical and cyber threats. The private sector is far behind in its initiatives in physical protection of the critical assets owned and operated by them, as they depend on ill-trained and ill-equipped private security agencies. Some big private owners especially in the IT sector have taken good initiatives to ward off any possible cyber threats. Overall, the status of Critical Infrastructure physical protection remains rudimentary while protection from cyber threats has picked up momentum of late. 58 Critical Infrastructure Protection Review - Autumn 2017

The stakeholders involved in managing risks to critical infrastructure either individually or in partnership is wide-ranging, composed from among central, state, local governments, owners, and operators of critical infrastructure, private businesses, non-profit organisations, and academia. Managing the risks from significant threat and hazards to physical and cyber critical infrastructure requires an integrated approach across these diverse entities with an objective to: identify, deter, detect, disrupt, and prepare for threats and hazards to the nationâ€™s critical infrastructure; Reduce vulnerabilities of critical assets, systems, and networks; and mitigate the potential consequences to critical infrastructure of incidents or adverse events that do occur. The success of this integrated approach depends on leveraging the full spectrum of capabilities, expertise, and experience across the critical infrastructure community and associated stakeholders. This requires efficient sharing of actionable and relevant information among partners to build situational awareness and enable effective risk-informed decision making.

ELEMENTS OF THE NATIONAL PLAN Any protection plan should be comprehensive, integrate physical and cyber security of the critical infrastructure and take into consideration the significant evolution in the critical infrastructure risks, government policies, and operating environments. The National Plan should be aligned with the goal of a secure and resilient nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk. This is central to a comprehensive approach for enhancing national preparedness and critical infrastructure risk management activities and contribute to achieving the National Preparedness Goal. It should provide a framework for collective efforts of all stakeholders and their ability to make risk informed decisions when allocating limited resources in both normal and crisis situations. The plan must integrate and create networks of national, regional, state, and local

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

Manufacturing Industry India. Source: http.momentumindia.in partnerships between government and the owners and operators who have the responsibility of managing risks to enhance security and resilience. The National Plan should establish basic principles which the critical infrastructure community should consider when planning for CIP: Risk should be identified and managed in a coordinated and comprehensive way across the stakeholders; Understanding and addressing risks from cross-sector dependencies and interdependencies is essential; Gaining knowledge of infrastructure risk and

approach to CIP recognises the unique perspectives and comparative advantages of the diverse critical infrastructure community; Security and resilience should be considered during the design of assets, systems, and networks.

interdependencies requires information sharing across the critical infrastructure community; The partnership

gamut of physical and cyber protection of all national critical infrastructure assets. Nominate organisations responsible for coordination and guidance related to CIP at the national, states, local and private sector levels. Critical infrastructure with dependencies and interdependencies in each sector be identified, periodically updated, and integration of these achieved. CIP plans be prepared for all sectors and at all levels for individual assets, these plans be tested and rehearsed. Resources need to be created and earmarked for each sector to take care of critical infrastructure of respective sectors. Set up mechanisms for obtaining and sharing information and intelligence related to the threats on a need to know basis with all the stake holders. Establish exclusive CIP communication networks at all levels for speedy dissemination of information, intelligence, and ensure quick response in case of any threats.

Critical Information Infrastructure. Source: https.image.slidesharecdn.com

WAY FORWARD CIP - INDIA A single point agency, preferably under the Cabinet Secretariat, be established to lay down policy, guidelines, and carry out coordination on the whole

criticalinfrastructureprotectionreview.com

CRITICAL INFRASTRUCTURE PROTECTION IN INDIA

E-Governance Infrastructure India. Souce: https.india.gov.in

CONCLUSION Critical Infrastructure Security and Resilience in India needs to be addressed on a priority basis by the national, states, local governments and asset owning and operating entities as both physical and cyber threats to these critical assets is ever increasing. Any vacillation on this account would be very catastrophic. The CIP should be integrated and coordinate activities based on partnership not only amongst all the stake holders but also international agencies. ■

ABOUT THE AUTHOR Colonel H R Naidu Gade - Indian Army Veteran [B E (Civil), M Sc (Defence Studies), M B A (HR)] Commissioned in to the Corps of Combat Engineers. A Civil Engineer, Management, and Security Professional, with 42 years of rich experience (8 years international) in the field of Combat Engineering, Chemical, Biological, Radiological, Nuclear and Explosives (CBRNe) Defence, Security & Disaster Management and Counter IED Operations. Is a qualified CBRN and C-IED Professional. 60 Critical Infrastructure Protection Review - Autumn 2017

Graduate of Defence Services Staff College and Army War College, commanded an Armoured Assault Engineer Regiment, prior to taking up an assignment with a United Nations Agency in 1997. Held important Command, General Staff, and Instructional appointments in the Army. As the Joint Director for CBRN Defence, the Ministry of Defence (Army), he was responsible for evolving, planning, and executing CBRN defence measures for the Indian Armed Forces. Is former Chief CW Inspector for nearly a decade with the ‘Organisation for Prohibition of Chemical Weapons (OPCW)’, The Netherlands, winner of the Nobel Peace Prize 2013. He led teams of international professionals on many verification missions to various member countries, to verify the inventory of Chemical Weapons and monitor their destruction. He logged many hours operating in heavily contaminated environments at the CW Destruction Facilities around the globe. Is presently the Chief Consultant with ‘CBRNe Secure India’ a ‘forum and a knowledge centre’ for bringing in awareness in the public, government and Security entities on the threats arising from the use of CBRNe material and their disastrous consequences. Speaks in various international & domestic conferences on CBRNe and C-IED Issues. Additionally, contributes articles to many CBRNe and C-IED related journals world wide.

Counter-IED Report Unique content â”‚ Global reach â”‚ In print and online

www.counteriedreport.com

Published by Delta Business Media Limited 3rd floor, 207 Regent Street, London, W1B 3HH, United Kingdom Tel: +44 (0) 20 7193 2303 Fax: +44 (0) 20 3014 7659 info@deltabusinessmedia.com www.deltabusinessmedia.com

co-located with

Gold Sponsor

Stronger Than Firewalls

Silver Sponsor

June 11-12, 2018 Hilton, Washington D.C.

SECURITY AND SAFETY FOR MASS TRANSPORT IN THE DIGITAL AGE 11%+

CAGR of the global transport security technology market from 2017 to 2022* *Source: QYReports

â€œUnderstanding how to better safeguard operations and protect critical networks and infrastructure from damage is paramount. Opportunities like TSSX that bring the industry together for training and solutions are welcomed by SANS.â€? Doug Wylie, Director, Industrials & Infrastructure Portfolio, SANS Institute

Contact Tim Edwards, Event Director to see how you can get involved: tim@transportsecurityworld.com +44 (0) 207 045 0945 Please visit www.transportsecurityworld.com for more information.

produced by

SMART CITY RESILIENCE

DEVELOPING SMART CITY RESILIENCE THROUGH CRITICAL FACTORS ANALYSIS By Victor R. Morris, civilian contractor and instructor at the U.S. Army Europe’s Joint Multinational Readiness Center (JMRC) in Germany

NTRODUCTION

Humanity is developing into an urban species therefore Smart Cities become an important centre of gravity or wielder of power for relevant populations. A SC is a system of systems that utilises information and communication technology (ICT) to enable citizens and meet their demands. Moreover, SC models include the community and incentivise participation, encourage ownership, and improve the lives of residents. Interdependent populations cope with environmental stressors and nonlinear escalation or “butterfly effects” through interconnected and resilient city systems. This article proposes a Smart City Critical Factors Framework consisting of smart city critical capabilities, requirements and vulnerabilities. The framework identifies, assesses and repairs critical vulnerabilities or problem nodes and flows that make systems less resilient to stressors. The framework uses a revised version of 19th century Prussian General Carl von Clausewitz’s Center of Gravity (COG) concept and associated critical factors analysis. The current definition of a COG uses systems theory and refers to the “primary entity that inherently possesses the critical capabilities to achieve the objective”1. Accurately assessing critical factors and repairing critical vulnerabilities that exacerbate system perturbations or disturbances is critical to a strategy for resilient and “smart” living.

This strategy is applied to a chaotic and multi-domain environment. The overall aim of this article is to outline a framework that enables systems resilience through critical factors analysis. The design processes consist of methods to identify and modify critical vulnerabilities. They also include a holistic and customised approach to planning, which not only shapes, but allows for shaping by the changing environment to enable resilience. Resilience occurs when relevant systems re-order to become less vulnerable to shocks and perturbations.

UNDERSTANDING NONLINEAR SCIENCE, DYNAMICAL SYSTEMS AND RESILIENCE A systems perspective for understanding interdependent environments is not new. Revised Center of Gravity or “COG” analysis draws on systems theory and uses it to link critical factors and decisive points to the centre(s) of gravity (see Figure 1.) The majority of the systems present in the world are nonlinear in nature. Nonlinear science has its origins in mathematics, general systems theory, cybernetics, fractal geometry and meteorology2. Network centric warfare borrowed concepts from chaos theory to describe an international system prone to exponential changes or “butterfly effects”. Chaos theory describes certain nonlinear dynamical systems as being sensitive to changes in initial conditions. Nonlinear means that due to feedback or multiplicative effects between the criticalinfrastructureprotectionreview.com

SMART CITY RESILIENCE

Figure 1: JP 2-01.3 - Systems Perspective of the Operational Environment. components, the whole becomes something greater than the mere sum of its individual parts. Dynamical means the system changes over time3. Resilience is a term used in ecology, social sciences, engineering and the military. In all cases, the term emphasises the ability of a system to cope with disturbances, adapt, and re-organise into a more stable state. Coping refers to degrees of success and increased stability when presented with disturbances. Similarly, the term thriving, whether physical or psychological, reflects decreased reactivity to stressors, faster recovery or consistently higher level of functioning. Conceptions of thriving involve desensitisation and enhanced recovery potential. Recent approaches involve urban resilience to chronic stresses and acute shocks. Some examples 64 Critical Infrastructure Protection Review - Autumn 2017

of chronic stresses and acute shocks are high unemployment, natural disasters and terrorist attacks. The city system of systems requires a coherent and comprehensive approach to reach an adaptive and stable state.

CITIES AS COMPLEX EVOLVING SYSTEMS A 2015 Small Wars Journal article entitled “City as a System Analytical Framework: A Structured Analytical Approach to Understanding and Acting in Urban Environments” identifies cities of all sizes present a variety of challenges. These challenges include “information saturation, unique terrain, and diversity of controllers” 4 .The same article identifies Environmental Centers of Gravity or E-COGs as the nodes and/or flows most critical to a problem system.

SMART CITY RESILIENCE

This section uses a variety of cities as short case studies to highlight the above challenges and aids in the development of resilience solutions. These challenges or factors personalise in the physical, cyberspace and information environments by residents who are part of groups, organisations and populations. The aforementioned article describes unique terrain with the concept of “edgelessness’ meaning cities no longer end at their administrative edges or political boundaries. Concepts of interdependence and resilience have no physical boundary and depend on the mutual support of all relevant systems and subsystems. Another crucial factor in dense urban areas is the influence of human populations, as the center of gravity for information activities, unique or contested terrain, and diversity of controllers. For example, Ukraine, Kiev, and the War in Donbass illustrates a fusion of the four above factors resulting in bifurcation, or split from mono-stable to multi-stable states. Kiev is more resilient than the eastern oblasts based on a variety of interactions. As a primary hub, Kiev has more dense interactions, but fewer axons or connections to the Donbass region. In Donbass, some individuals and ethnic groups support the separatist movement instead of the government in Kiev. Some of the reasons (i.e., the incentives) individuals support the separatists

When perturbations affect the totality of city challenges, they result in unpredictable and chaotic states. This is also a lesson learned from the Arab Spring and on-going operations in Afghanistan and Iraq, which resulted in co-evolution of complex systems and physically emerging states. The extremist proto-state referred to as “Daesh” exhibits complex system characteristics and city centric challenges. Ramadi, Mosul, Aleppo, al-Raqqa and Dabiq are cities of varying sizes and have proven to be centres of gravity for various populations, organisations, groups and ideologies. The city as a centre of gravity is not limited to the specific regions and has implications for international systems as well. Military force in conjunction with stateless, disenfranchised, and identity-driven populations account for dense interactions. These interactions often result in system(s) perturbations that lead to the escalating nonlinearity and chaos.

include a general sense of mistrust toward the central government in Kiev, according to political science writer Elise Guiliano’s 2015 study “The Origins of Separatism: Popular Grievances in Donetsk and Luhansk.” 5 Guiliano reports that a significant minority feel betrayed by the government, which they claim conducted “discriminatory demographic redistribution within Ukraine”. Some believe economic policies such as potential European Union membership will hurt their interests, and some are opposed to certain government policies. Therefore, while some share a sense of political and economic loyalty to Russia, the incentives leading individuals to support the separatists vary. Each group or individual may have different motives for their micro-decision to support separatists’ goals, but the macro-result is considerable support for the separatist movement.

The SC COGs use or consume supporting resources to accomplish their objectives; a physical agent that must perform the actions. Relevant organisations and actors who draw power from the city have interrelated centres of gravity at all levels. These include controlling information, terrain and populations and result in the multi-layering and overlapping of critical factors. Critical factors analysis takes concepts from mathematics like exploring system behaviour and stability. Similar to mathematical methods, COG analysis reveals hidden structure and patterns in underlying dynamics that may not be apparent. Defeat, stability and response options also develop from this type of analysis. Promoting or “targeting” resilience is intangible, but targeting individuals, organisations, and systems compelled to enable resilience is not.

COG ANALYSIS DEFINITIONS AND MULTI-DOMAIN APPLICATIONS A modern definition of COG uses basic logic to define what a COG is or is not. Logically: A (primary entity) + B (capability to achieve the objective) = COG 6. The COG is not a source of power as previously defined; it is the possessor and wielder of that power.

criticalinfrastructureprotectionreview.com

SMART CITY RESILIENCE

Figure 2: Part I - Linear COG analysis method based on likely objective or end state. Below are Dr. Strange’s critical factors that can be targets for direct or indirect engagement. • Critical capability: primary abilities that merit a COG, identified in the context of a given scenario. • Critical requirement: essential conditions, resources, and means for a critical capability. • Critical vulnerability: critical requirements or components thereof that are deficient or vulnerable to neutralization, interdiction, or attack in a manner achieving decisive results. The following two-part method emerged from a variety of critical factors analyses of a known COG and assessed objectives. First, the linear method based on familiarity, then an inside-out and nonlinear approach by identifying factors and re-aligning them to the appropriate category (see Figures 2 and 3). The detailed list of critical vulnerabilities became the focal point for repairing and resilience framework development below. Once again, a SC is one that uses information and communication technology (ICT) to meet the demands of the market and incentive structures. Incentive structures were highlighted for 66 Critical Infrastructure Protection Review - Autumn 2017

modification, as things that motivate an individual to perform an action or promote cooperation or competition within a larger structure. ICT-generated data guides incentive structure analysis and connects objects and environments to form the Internet of Things (IoT) as a SC enabler. Key concepts involving unified communications and communities are crucial to making critical vulnerabilities resilient to environmental disturbances. The below findings were the focal points for part two of the framework development.

WHOLE OF SOCIETY RESILIENT SMART CITY CRITICAL FACTORS FRAMEWORK: TRANSFORMED ENDS, WAYS AND MEANS Critical Capabilities or Ways (Verbs or Ability to): RECIPE • Restructure economic and energy sectors through growth, innovation cooperation and free trade • Enable government transparency, penetration, and population access to essential services

SMART CITY RESILIENCE

Critical Requirements or Means (Nouns): • Urban Informatics (people, ideas and technology) ◦◦ Government ◦◦ Personal ◦◦ Network of sensors • Urban Design (built environment) ◦◦ Positively super-empowered individuals and networks ◦◦ Global trade network access and creation of resources ◦◦ Mobility and transportation ◦◦ Agriculture ◦◦ Sustainable, renewable, and smart energy ◦◦ Climate change and heat effects mitigation • Urban Protection (multi-domain) ◦◦ Information and critical infrastructure protection ◦◦ Enhanced medical and rehabilitation services and outreach ◦◦ Infectious disease tracking, prediction and outbreak containment ◦◦ Ethical surveillance and policing ◦◦ Enhanced multinational civil-military forward engagement and positioning Figure 3: Part II - Nonlinear COG analysis method focusing on repairing and ◦◦ Complex Intelligence Preparation transforming critcal factors. of the Battlefield/Battlespace with agent-based models (ABMs)7 ◦◦ Cyber security and deterrence, human in • Connect, secure and standardise ICT and large the loop contingencies and electromagnetic data set architecture with embedded fail safes and spectrum protection alternate function systems ◦◦ Improved collective, artificial and all-source • Inter-organise institutions and maker culture to intelligence approaches and sharing optimise national security and rule of law ◦◦ Decentralised mission command systems and • Place make, enable e-participation and deliver combined arms integration narratives through mutual aid networks in the ◦◦ Joint and combined arms forces and sustainment information environment ◦◦ Multination counter-proliferation policies • Extend smart living through artificial general ◦◦ Flood, earthquake and storm effects mitigation intelligence (AGI) life cycle management and and response artificial neural networks. criticalinfrastructureprotectionreview.com

SMART CITY RESILIENCE

• Urban Partnerships (inter-organization and multi-national) ◦◦ Public, private, and maker culture cooperation ◦◦ Local, national and international resilience shaping ◦◦ Digital inclusion of all demographics

Objectives or Ends • Community awareness and education • Mass collaboration • High fitness landscape • Inclusive incentive structures • Quality of life and well-being management.

5. Elise Giuliano, “The Origins of Separatism: Popular Grievances in Donetsk and Luhansk,” PONARS Eurasia Policy Memo No. 396, October 2015, accessed 24 October 2016, http://www.ponarseurasia.org/sites/default/ files/policy-memos

pdf/Pepm396_Giuliano_Oct2015_0.

pdf. 6. COL (Retired) Dale C. Eikmeier “Let’s Fix or Kill the Center of Gravity Concept”, Joint Force Quarterly 83, 4th Quarter 2016 (1 October 2016). 7. Majors Tom Pike and Eddie Brown, “Complex IPB,” Small Wars Journal (24 March 2016).

In conclusion, hybrid and multi-domain resilience is critical to minimising disturbances and developing effective coping strategies in the contexts of future conflict and environmental adaptability. Identifying and transforming critical vulnerabilities that exacerbate system perturbations facilitates a strategy oriented towards resilient or “smart” living. Organisational and technological adaptation are ways to reduce the effects of instability and complexity in dynamic systems. The Smart City Critical Factors Framework facilitates the objective of the smart city system to preform actions enabling human and intelligent agent populations. Smart Cities + Smart Power = Smart Living. ■

REFERENCES 1. COL (Retired) Dale C. Eikmeier “Let’s Fix or Kill the Center of Gravity Concept”, Joint Force Quarterly 83 (1 October 2016).

ABOUT THE AUTHOR

2. Dr. Sean T. Lawson “Nonlinear Science and Warfare” Chaos, complexity and the U.S. military in the information age” (2014). 3. Geoff Boeing “Visual Analysis of Nonlinear Dynamical Systems: Chaos, Fractals, Self-Similarity and the Limits of Prediction” (7 September 2016). Accessed on 15 April 2017: http://www.mdpi.com/2079-8954/4/4/37/htm. 4. Mark Lomedico and Elizabeth M. Bartels, City As a System Analytical Framework: A Structured Analytical Approach to Understanding and Acting in Urban Environments, Small Wars Journal (4 August 2015).

68 Critical Infrastructure Protection Review - Autumn 2017

Victor R. Morris is a civilian contractor and instructor at the U.S. Army Europe’s Joint Multinational Readiness Center (JMRC) in Germany. The views expressed in this article are those of the author and do not reflect the official policy of NATO, Department of Defense or employer.

Unique content Ç€ Global reach Ç€ Direct mailing and online

www.cybersecurity-review.com

Subscribe at: www.cybersecurity-review.com/subscribe

Published by Delta Business Media 3rd floor, 207 Regent Street, London, W1B 3HH, United Kingdom Tel: +44 (0) 20 7193 2303 Fax: +44 (0) 20 3014 7659 info@deltabusinessmedia.com www.deltabusinessmedia.com

BOOK YOUR STAND 6-8 MARCH 2018

ADNEC, ABU DHABI, U.A.E

Empowering Collaborations For A Safer Connected World

The Must-Attend Exhibition Enhancing Thought Leadership, Innovation and Business with the Critical Infrastructure Protection Community

2018 Exhibitors Include Al Hamra Trading • Betafence Middle East • Cognitec Systems GMBH • CNL Software • EIMASS • Etimad Holding • Eye On Technology • Falcon Eye Technology LLC • Gatekeeper Security Middle East • Hader Security & Commucations Systems LLC • HIKVISION • Industrial Scientific • International Golden Group • Intertech Vision Middle East LLC • Larsa Scientific LLC • Metech • Mobile Land Systems FZ LLC • Research Electronics International (REI) • Streamax Technology • Tawazun Holding Company LLC • Thales • Thuraya Telecommunications • Transmex Systems International Pte Ltd. • Vostok Trading LLC • Zhejiang Dahua Technology Co. Ltd. • Alliance Solutions Group, Inc • Indigovision • Proengin • Prilyx Research & Development Ltd. • Technical Square Group

www.isnrabudhabi.com

#ISNRAbuDhabi

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE By Louisa Marie Shakou, Research Associate, Centre for Risk, Safety and Environment, European University of Cyprus

his summer has been one of extreme weather across the world; from the European heatwave and consequent wildfires in Portugal, Spain, Croatia, France and Italy to hurricanes Harvey and Maria, the monsoon floods in Mumbai, India and the wildfires raging in California. The impacts of these extreme weather events have been significant, ranging from loss of lives to severe damages to homes, businesses and infrastructure; with heavy financial and economic losses. Climate change has been implicated in the frequency (heatwaves) and intensity (hurricanes) of these extreme weather events. Indeed, analyses by the World Weather Attribution initiative have indicated that the European June 2017 heatwave was more likely due to human-induced emissions of greenhouse gases, whilst the World Meteorological Organisation has suggested that sea level rise and increased sea surface temperatures in the Gulf of Mexico likely exacerbated the strength and intensity of Hurricane Harvey. Such climate-related hazards (e.g. floods, storms, extreme precipitation, wildfires) have the potential to destroy or substantially affect the lifespan and effective operation of Critical Infrastructures (CI), such as energy, transportation, ICT and water infrastructures. Adverse impacts due to climate hazards have been exhibited by Hurricane Harvey whereby, according to the US Department of Energy, as of August 31 2017, 10 refineries in the Gulf Coast region were

shut down; these have a combined refining capacity equal to 16.6% of total U.S. refining capacity. Flooding had also affected chemical plants, with fires reported in some plants and advisory warnings of potential explosions and/or chemical spills in place for the surrounding areas. Health facilities had also experienced flooding as had schools and other infrastructures such as roads, airports, bridges, etc. In Puerto Rico, the impact of Hurricane Maria has been characterised as catastrophic, meaning that large proportions of infrastructure have been wiped out. When infrastructure systems are damaged or fail, the smooth functioning of society is disrupted. To further complicate matters, modern infrastructures operate as a â€˜system of systemsâ€™ with many interactions and interdependencies among these systems. Damage in one infrastructure system (e.g. ICT) can cascade and result in failures and cascading effects onto all related and dependent infrastructures (e.g. energy and water infrastructures). Critical infrastructures are designed and constructed in accordance with national building codes and infrastructure engineering standards (e.g. EUROCODES). These set out climatic design values that aim to build resilience to climate hazards; for example, return periods for extreme weather events. Most existing infrastructures have been designed with the assumption of stationary climate conditions using historic values and observations. Stationarity criticalinfrastructureprotectionreview.com

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

The EU-CIRCLE Framework. assumes that although climate is variable, these variations are, however, constant with time, and occur around an unchanging mean state. This assumption of stationarity is still common practice for design criteria for (the safety / security levels of) new infrastructure. However, the climate is changing: the atmosphere and oceans have warmed, global temperatures have risen by 0.85° C, and sea levels have risen by 19cm since pre-industrial times. There is evidence that the increase in global temperatures has resulted in an increase in the intensity and frequency of extreme weather events. As return periods of extreme weather events are calculated using past climatic data, under climate change weather extremes will tend to exceed the design specifications for CI more frequently and earlier during the lifetime of an infrastructure, decreasing the durability and resilience of the structure. The changing climate will, in effect, shorten the lifespan of existing CIs in many regions.

EU-CIRCLE: A pan-European framework for strengthening Critical Infrastructure resilience to climate change Managing the impacts of extreme weather events has increasingly gained importance, with many research groups and projects doing important work in the field. The EU research programme Horizon 2020 has funded several projects in this area, one of which is EU-CIRCLE: A pan-European framework for 72 Critical Infrastructure Protection Review - Autumn 2017

strengthening Critical Infrastructure resilience to climate change. The main objective of EU-CIRCLE is to increase the resilience of European infrastructure network(s) both to today’s natural hazards as well as to the future changing climate. It aims to contribute to the EU’s Adaptation Strategy through the promotion of better decision-making by addressing existing gaps in the knowledge on climate change impacts and adaptation in CIs. EUCIRCLE aims to achieve this by the development of a framework and set of tools that will enhance the resilience of interconnected Critical Infrastructure Networks to climate hazards and prepare them for future climate change. The EU-CIRCLE framework is made up of several components including a risk management framework (which includes risk assessment, damage and impact analyses), a resilience framework and an adaptation framework.

EU-CIRCLE Risk Assessment Framework A first step to improving resilience of CI to climate change impacts is the identification of the risks of several climate hazards to interconnected and interdependent critical infrastructures i.e. risk assessment. The EU-CIRCLE risk assessment framework includes: • Assessment of the current risks of a specific climate hazard to a single CI or a CI network or even an area of interest with interconnected and interdependent CI. • Examination of how climate change may alter risk in the future, or expose new risks. This analysis includes a baseline assessment of the risks to CI assuming no additional adaptation actions under various climate change scenarios, as well as a second assessment which considers how current or future potential adaptation actions will affect the overall scale of risk to CIs in the future under the same climate change scenarios.

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

EU-CIRCLE Resilience Framework The EU-CIRCLE climate resilience management framework is based on: a) the identification of the critical assets/processes of an infrastructure network that provide essential services to society; b) the determination of the critical values and/or patterns of climate parameters that result in a change of state for these assets (in terms of performance or functionality); c) the analysis of the relative impact, determined using appropriate consequence or damage curves; d) consequence analysis to determine cascading effects arising from interdependencies (including physical, cyber, geographic, and logical) and their related impacts; and e) analysis of the coping and adaptive capacities of the asset/network/society (resilience) which in turn leads to the identification of adaptation plans/programmes/strategies and investment needs. The EU CIRCLE resilience framework uses a system dynamics (SD) simulation modelling tool to better understand the behaviour of complex infrastructure systems to natural hazards in the short term and climate change stress impacts over the long-term. The approach is suited to capture the feedback between resilience and the hazard/stress impact through simulation modelling. By using the SD model, CI asset stakeholders, operators and/or service providers can address the following key questions: 1. How short-term or long-term choices in resilience capacities make an asset or network more resilient; 2. How these choices can minimise service loss when shocks occur; 3. How operational short-term and strategic long-term choices can minimise the time taken for an asset (or network) to recover and minimise the total loss of service.

EU-CIRCLE Registry of Assets The EU-CIRCLE climate risk and resilience frameworks use an asset-based and critical services approach to assess risk(s) of damages to CI due to climate stressors, and in the identification of subsequent impacts on the operation and performance of the CI. The EU-CIRCLE framework is based on ‘building’ a CI network, based on the analysis of the constituent

CRITICAL INFRASTRUCTURE SECTOR

CRITICAL INFRASTRUCTURE SUBSECTORS

Energy

• Oil • Gas • Coal • Electricity • Renewables • District Heating

Transportation

• Road • Rail • Aviation • Maritime • Inland waterway

Water

• Drinking Water • Wastewater • Flood Water

ICT Chemical Industry Public/ Government

• Telecommunication • Information • Basic • Chemicals/Commodities • Specialty/Fine Chemicals • Consumer Chemicals • Fire and Rescue Services • Emergency Medical Services • Military • Law Enforcement • Public Services • Public Health and Healthcare

Table 1: Critical Infrastructure Sectors and Subsectors. assets and the modelling of the relative critical services provided by interconnected and interdependent CIs. This modelling approach enables users to link asset-based damage assessment with CI business continuity models at the network level, and allows for the development of optimal adaptation measures, quantified through the appropriate CI risk metrics and resilience indicators. The registry of assets developed by EU-CIRCLE thus aids in the ‘building’ of a CI network with the appropriate representation of functional and geographical relationships between assets, both within a CI sector and across CI sectors, in order to depict criticalinfrastructureprotectionreview.com

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

support planners, operators and authorities to assess the impact of alternate climate change scenarios on the operation and performance of CIs, including any potential cascading effects due to interdependencies between CIs. It is intended to be a user-friendly environment that will provide its users with the ability to analyse what-if scenarios: leveraging model selection, climate data repositories, and CI inventories in order to calculate damages for any kind of climate hazard and CI.

Stakeholder Engagement

Critical Infrastructure Protection and Climate Change workshop. the CI ‘network of networks’ in an area of interest. The sectors included in the registry are: energy, transportation, ICT, water, chemical industry and the public sector. These sectors have been further divided into constituent sub-sectors as shown in Table 1.

EU-CIRCLE Climate Resilience Platform CI vulnerabilities to climate hazards and impacts from extreme weather events go beyond physical damages. EU-CIRCLE will provide an assessment framework that also takes into account the impacts to the services provided by CIs, the impacts associated with repair and/or replacement of services but also, societal costs, environmental effects, and economic costs due to suspended activities. Such assessments will be carried out on a validated Climate Infrastructure Resilience Platform (CIRP), which can be used by CI operators, National Authorities and other scientific groups. The CIRP is a standalone and comprehensive software toolbox that is able to accommodate different types of datasets (e.g. hazard, assets, interconnections, fragilities), file formats, and risk analysis algorithms. It is open, modular and extensible in order to support various risk and resilience assessment analysis tools. CIRP will provide users with access to diverse simulation, modelling and risk assessment solutions. This modelling approach will 74 Critical Infrastructure Protection Review - Autumn 2017

The project has run workshops in order to engage with stakeholders in Milan, France and Cyprus. The project ran a workshop in Cyprus on 7-8 March 2017 on the topic of Critical Infrastructure Protection and Climate Change. The workshop was organised by the European University Cyprus, and co-organised with the Cyprus Civil Defence (Cyprus’s national contact point for EU CI), with the participation of the Joint Research Centre and local Critical Infrastructure Operators from the energy, ICT, water and public sectors. In total, 50 stakeholders participated in the workshop, which included presentations on the potential impacts of hydro-meteorological hazards on CI, the changing climate in Cyprus and future climate change predictions as well as the EU-CIRCLE risk assessment and resilience frameworks. The second day of the workshop included a table top exercise, where participants engaged in discussions on the predicted impacts of forest fires exacerbated by climate change, on climate change risk assessment and on potential response options in interconnected national infrastructures.

Hydro-Meteorological hazards do impact CI All participating operators recognised that meteorological hazards such as wildfires, extreme temperatures and flooding impact their infrastructure, yet only some of them take risk mitigation actions and preventive measures. Furthermore, no CI operator currently takes into account climate change and how this can impact the frequency and intensity of extreme events. Through the workshop, EU-CIRCLE provided

CLIMATE CHANGE IMPACTS TO CRITICAL INFRASTRUCTURE

data on future forest fires and meteorological risk based on the IPCC’s (Intergovernmental Panel on Climate Change) Representative Concentration Pathways (RCP), RCP 2.6, RCP 4.5 and RCP 8.5 scenarios for the time period 2016 to 2050 in Cyprus, which raised awareness on how climate change will potentially result in increased impacts due to the increase in the frequency and intensity of extreme events. In discussions on how each CI sector is interconnected and dependent with the other, it became clear that the energy and ICT sectors are the most vital in Cyprus as all CI sectors are dependent on these two. In long-term crises, smooth port-operation becomes critical as entry points of spare parts and equipment. The electricity sector has done the most to build redundancy, with the ICT sector second. All other CI sectors identified that more needs to be done by them to buildin redundancy and that the EU-CIRCLE paradigm of resilience is a useful framework for guiding their efforts.

Climate Change must be taken into account in CI protection plans and interdependencies must be considered under crisis situations Finally, CI participants identified, through discussions of the future forest fire scenarios provided by EUCIRCLE, that climate change and its impacts on the frequency and intensity of extreme events is something that should be taken into account in their planning with respect to meteorological hazards. Dependencies between CI sectors are likely to be particularly important during a crisis and this is something that CI operators need to explore further. EU-CIRCLE’s work on climate data, risk and resilience modelling is of particular interest to the CI operators to help them take into account extreme events, climate change and interdependencies.

Future Validation of the EU-CIRCLE Framework The project will be conducting five case studies, which will test and validate the EU-CIRCLE methodological framework and associated tools. The case studies include:

• Case Study 1: Extreme dryness and forest fires on electricity and transport networks (October and November 2017) • Case Study 2: Storm and Sea Surge at a Baltic Sea Port, Gdynia Poland (January 2018) • Case Study 3: Coastal Flooding (surface water, highway, sewer and watercourse flooding) across Torbay, UK (March 2018) • Case Study 4: Cyclonic pressures and Flooding, Bangladesh (May 2018) • Case Study 5: Rapid Winter Flooding (melting ice, narrow mountain streams, flooding) around Dresden, Germany (March 2018) For further information please visit the EUCIRCLE website (http://www.eu-circle.eu/) or contact Dr Athanasios Sfetsos, the project coordinator at ts@ipta.demokritos.gr ■

ABOUT THE AUTHOR Ms Louisa Marie Shakou is a Research Associate at the Centre for Risk, Safety and Environment at the European University of Cyprus. Her main research interests include risk assessment of climate change risks, adaptation and resilience to climate change. Louisa Marie Shakou has a Masters in Chemistry from Leeds University and a Masters in Environmental Technology from Imperial College London with a specialisation in Environmental Economics and Policy. Louisa has worked as a Researcher in the Energy, Climate Change and Sustainability team at the National Audit Office of the UK Government. During her time with the team she was involved in studies on diverse topics including air pollution, funding for renewable energy, smart metering, carbon budgets, sustainable development and the environmental impacts associated with large critical infrastructure projects. Louisa has also worked at TUV Cyprus Ltd, as a member of audit teams conducting inspections against ISO 9001:2008, ISO 14001:2004 and EMAS. criticalinfrastructureprotectionreview.com

DELTA BUSINESS MEDIA Unique content │ Global reach │ In print and online

www.counteriedreport.com

www.cybersecurity-review.com

www.criticalinfrastructureprotectionreview.com

Published by Delta Business Media Limited

3rd floor, 207 Regent Street, London, W1B 3HH, United Kingdom Tel: +44 (0) 20 7193 2303 Fax: +44 (0) 20 3014 7659 info@deltabusinessmedia.com www.deltabusinessmedia.com

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS: RESPONSIBILITY AND DIFFERENT REFLECTIONS ON THE SUBJECT By Rogério Winter, Colonel, Brazilian Army and Rodrigo Ruiz, researcher, CTI - Information Technology Center Renato Archer

INTRODUCTION Cybersecurity has been worrying governments, armed forces and society in general but this is not a recent issue. In October of 1971, Ron Rosenbaum published in the “Esquire” magazine a history so incredible that left the companies of telephony sad. In the article entitled “Secrets of the Little Blue Box,” Rosenbaum taught how it was possible to explore the various “hidden codes” of telephone exchanges using only a regular telephone. Perhaps this is the first account of a malicious way to exploit critical infrastructure, telephony. Since then, thousands of other events related to cybersecurity have succeeded to the present day.

WHAT IS THE CYBERSPACE? The cyberspace is an environment with a high level of abstraction and the immediate consequence is the difficulty in identifying events and establishing their meanings in the kinetic (physical) domain. The cyberspace has the asymmetric characteristic that allows a balance of forces among countries with different military power. Likewise, the asymmetry of cyberspace modifies the social and human relations of citizens. Because anyone with programing knowledge can cause some kind of harm in civilian and military infrastructures.

In general, users of information technology have many questions about how to avoid data loss. There is no perfect solution for maintaining information security thus several rules or paradigms were created to mitigate data loss. A questionable paradigm, it is just install an anti-malware solution, preferably its inscribed on a comparative test list, and the protection is almost perfect. It is a fact that issues about cyber-security should have a holistic look that integrates technology, processes, people and the environment. In the cyber environment, the attacker has tactical advantages, such as surprise, initiative and knowledge of a point of failure. Thus, during an attack, the observations of the facts can be ambiguous and this ambiguity will allow that counterattacks can be directed to structures of communications with cybernetic weapons as against physical structures with the use of kinetic weapons. Allied to this ambiguity of the environment between defence and attack cybernetic weapons have the great advantage of reuse of the weapon. On the other hand, even if you cannot reuse a cyber weapon to its fullest, using reverse techniques, you can identify which vulnerabilities the weapon tries to exploit. The Stuxnet used multiple zero-days, which allowed other attacks around after the attack on Natanz. criticalinfrastructureprotectionreview.com

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

An attack that endangers critical infrastructure, both military and civil, will require retaliation or a preemptive strike against the risk of imminent attack, in a discriminatory and proportional manner. “Cyberspace, the name given to the global and dynamic domain composed of the infrastructures of information technology – including the Internet – networks and information and telecommunications systems, has blurred borders, involving their users in an unprecedented globalisation that provides new opportunities but also entails new challenges, risks and threats.” [1]

a. No constraints of physical space The lack of perception of physical boundaries in the digital world hampers actions to combat cyberterrorism and cybercrime as communication networks interconnect globally with a flow of information with little control. The nature of the internet makes it difficult to control where information travels.

b. Authorship assignment

e. Volatility The volatility where the nature, speed, and dynamics of change are persistent.

f. Uncertainty The uncertainty that leads to the lack of predictability, surprise and a sense of awareness and understanding of issues and events.

g. Complexity The complexity is the difficulty of determining the chain of cause and effect and the confusion that surrounds the organisation. Cyberspace is an environment with a high level of abstraction and an immediate consequence is the difficulty of identifying events and establishing their meanings in the kinetic (physical) space.

h. Ambiguity Ambiguity influences a misunderstanding of the meanings and leads to the confusion of cause and effect.

After a cyber-attack, the identification of the aggressor is determinant so that an effective response can be imposed. However, in cyberspace the attribution of an attack is difficult, if not impossible, due to the various

WHAT IS A CYBER WEAPON?

routes between communication networks.

used, with the aim of threatening or causing physical, functional, or mental harm to structures, systems, or living beings. The use of a cyber weapon is one way to conduct a cyber-attack. Clay Wilson[4] in his article mentions the recent studies regarding cyber-attacks, which revealed common features that describe a cyber weapon:

c. Power asymmetries One of the most interesting features in cyberspace is the power asymmetries. Where cleverness, subtlety, and cunning are as important as the economic and military power to carry out a cyber-attack.

d. Transversality of influence In the military field, cyberspace is considered a domain that transcends all existing domains: earth, sea, air and space. In July 2016, during the Warsaw Summit[2], NATO officially recognised cyberspace as an operational military domain. This means that the NATO alliance will respond with conventional weapons during the event of a cyber-attack. In this way, NATO is confirming that the Internet is a new battlefield. 78 Critical Infrastructure Protection Review - Autumn 2017

This paper accepts the definition proposed by Thomas Rid and Peter McBurney[3]: “cyber weapon is a computer code that is used, or designed to be

a. A malware attack campaign can combine multiple malicious programs for espionage, data theft or sabotage; b. The stealth capability allows you to maintain the secrecy of the operation for a long period; c. The attacker has detailed knowledge about the operation of the target system; d. There is a special kind of computer code to bypass cybersecurity protection technologies.

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

By the way, the cyber weapon has some advantages over kinetic weapons, such as:

GOVERNMENT RESPONSIBILITIES

Currently, we can observe that cybersecurity actions are fundamentally based on the versatility and dynamism to solve these problems, thus, the multidisciplinary teams involved is a preponderant factor of success. In this aspect, the ability to attribute and assign the authorship of a cyber-attack has intrigued police authorities, governments and security companies. The assignment is not always readily available, but eventually defenders can obtain enough information to take action. Recently, there is evidence that minor attacks were performed as part of a main attack. This type of action is part of military strategies. For instance, Russia’s

To defend against cyber threats, countries around the world are building the most varied types of partnerships, such as training, legal agreements, technological development in cyber capabilities. These partnerships are constructing a new concept with goals to prepare and conduct combined cyber operations, i.e. to respond effectively against cyber threats and to detain and to defeat aggression in cyberspace. The governments of the different countries have most recently been demanding cyber solutions, whether for monitoring terrorists, combating cybercrime or espionage. Some companies like Hacking Team, FinFisher GmbH, Elbit Systems and Vupen Security have developed solutions of attack and surveillance for governments and armed forces. However, buying cyber solutions from companies may not be the safest strategy because companies can have their systems hacked and attackers can expose buyers’ information. This happened with Hacking Team, FinFisher GmbH, Elbit Systems and Vupen Security. Intelligence agencies are apparently developing their own cyber weapons arsenal in order to take advantage in the various operations. Since 2013, Edward Snowden has disclosed details about NSA cyber operations against its enemies and NSA are using experts to identify failures in software and

operational military doctrine is based on the principle of “combined weapons”, whereby each weapon of military service is used in a complementary relationship, so that weapons can be brought to victory. Successive military leaders throughout history used the principles of war. The best known of the early strategists was the legendary Chinese general and military theorist, Sun Tzu, who lived around 500-400 B.C. In this sense, the same tactics of conventional warfare can be adapted for cyberspace. The FM 100-5 Operations[5] is an important reference in terms of military manoeuvre. Distracting and confusing the enemy is a very old and effective operation to reduce the defences of the main target. The digital world tends to imitate the real world; for instance, Apoc@lypse, the end of antivirus[6] is the book where a bioinspired technique can be used as a cyber weapon.

hardware. This is demonstrated in the reports released by Wikileaks and DoD’s own reports. In 2016, NASA was informed that its encryption system was vulnerable[7], and it is believed the vulnerability persists. The subject is reported in the article “Lazarus: Data Leakage with Pretty Good Privacy and Resurrection of the Revoked User”. On May 2017, the world witnessed a cyber-attack that affected more than 200,000 computers in 150 countries[8]. The attackers, an anonymous group called Shadow Brokers, based cyber weapon, Wannacry, on National Security Agency (NSA) leaked vulnerabilities in April. In March 2017, WikiLeaks released information leaked from U.S. Central Intelligence Agency (CIA), code-named “Vault 7”. It was the largest ever publication of confidential documents on the agency[9].

a. A cyber weapon needs less financial resources to be produced. b. It is possible use the same cyber weapon to attack different countries, organisations and governments. c. There is the difficulty of assigning the attacker. d. It is reasonable to reuse a cyber weapon against the attacker. e. The effects of a cyber weapon can transcend cyber space and cause kinetic effects.

CYBER STRATEGIES

criticalinfrastructureprotectionreview.com

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

maintenance of international peace and security. The Unit Security Council consists of 15 members, with five permanent members with veto power: the United States, France, the United Kingdom, and the People’s Republic of China. We emphasise in this regard that Article 27 of the Charter of the United Nations allows permanent members to use their right of veto to block decisions of the Security Figure 1: User credentials recovered from Citi.com in clear text. Council. However, war is a lucrative business. According In September 2017 the article “The leakage of to Stockholm International Peace Research1, world passwords from home banking sites: A threat to global military expenditure was estimated at $1686 billion cyber security?”[10] described the vulnerability in the in 2016, equivalent to 2.2 per cent of global gross credential control system of several banks around domestic product or $227 per person. The same the world. This failure allows the home banking user report presents the ten countries that most exported information to be stored on the computer in clear text weapons: USA, Russia, China, France, Germany, so that an attacker can retrieve them and perform bank UK, Spain, Italy, Ukraine, and Israel. Here a paradox transactions. Figure 1 clarifies how Citi’s home banking is established, since the countries that have the credentials are retrieved in clear text. This vulnerability responsibility to maintain world peace are those that can also be found on several e-commerce sites, e-mail, export most arms. intranet systems, government services and the military. When a war artifact is launched and fails to reach a Cyber threats threaten not only public institution but also society, business, government, and the military. This becomes more critical when we realise that governments have not yet taken a concrete step towards improving cybersecurity of society. Is cybersecurity a matter to be evaluated and discussed from the point of view of state? Or society or maybe both? From the examples cited above, there is a marked need for governments to participate in guiding the various protective actions of society. In this context, the United Nations Security Council is the body of the United Nations whose mandate is to ensure the

target, the military protocol establishes the destruction of artifact. In the military unit, there is a professional EOD team2 responsible for assessing the situation and destroying the device that failed. In a recent example in Germany3, thousands of residents were forced to evacuate a Frankfurt district on Sunday (September 03, 2017) before experts began the operation at a construction site where the device was found earlier in the week. However, in the cyber environment the situation is somewhat different. To conduct a disruptive or destructive cyber operation against a military system or industrial control system requires only expertise and a potential adversary

1 https://sipri.org/sites/default/files/2017-09/yb17-summary-eng.pdf 2 Explosive Ordnance Disposal (EOD Team) EOD team have expert knowledge, skills and equipment. 3 http://www.dw.com/en/frankfurt-evacuates-thousands-to-defuse-world-war-ii-bomb/a-40343581

80 Critical Infrastructure Protection Review - Autumn 2017

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

rather than spending 10 billion dollars to develop an offensive capability. To build a cyber weapon needs more of people’s intelligence and less investment than a kinetic weapon. This can equilibrate the world war game. In addition, a cyber weapon can be reused against an attacker with some improvements. Acting shrewdly is as important as economic and military power to carry out a cyber-attack. Anyone can learn how to create effective cyber weapons. For this, all that is necessary is a computer, Internet connection, time to learn about software, hardware network vulnerabilities, and finally patience. In the examples mentioned above it is possible to identify the contribution of governments to producing an insecure cyber environment. How are governments dealing with this?

Nowadays, our society depends on efficient and security computer systems. However, we realise that governments have not yet taken a concrete step toward coordinating the cybersecurity in our society. In addition to the aspects mentioned in this article, there are issues that are difficult to solve internationally: internet censorship, anonymity on the internet and attribution of attacks; applicability of existing laws of war to cyberspace; overflow effect of cyber attacks and protection of intellectual property.

and claim rights. The various information technologies became cheap and easily accessible to all. Cybersecurity is the issue on the international agenda. The abuse of communication and faulty software is a common practice that brings the decade of 70. Invariably, technology is the great protagonist of data leakage and loss of privacy. However, issues related to cybersecurity are founded on social, anthropological and technical approach: technology, people, processes and environment, which interact indistinctly in a sensitive relationship. Insiders contribute to the dissemination of information and there are flaws in information security processes. Denning[11] mentioned in her article that developing systems that are absolutely secure is extremely difficult, if not generally impossible. Because the concepts used today to developing system may in the future be outdated. There are many flaws hidden in the systems. For instance, Microsoft patches critical bug that affects every Windows version since 954 and this flaw existed for almost 19 years. Are concepts in computer science consolidated or are they eventually reviewed and questioned? Again, Denning[11] emphasised that existing systems with known flaws are not easily replaced by systems that are more secure – mainly because the systems have attractive features that are missing in the more-

Between the 1970s and 1990s, the world had a geopolitical polarisation, and armed conflicts were geographically delimited – only nations was engaged in warfare. Critical infrastructure control systems were not reliant on technology, and cybercrime and cyber espionage were not so obvious. Since the 1990s, new paradigms have emerged. Geographical barriers no longer exist for political militancy, social media and electronic media democratised the information. Vital systems are increasingly complex and dependent on information technology. Nations, corporations and organised groups began to use cyber space to carry out war activities

secure systems, or cannot be replaced for economic reasons. In November 2015, the Paris Orly Airport5 had to close temporarily after the failure of a system running Windows 3.1. In addition, UK’s Nuclear Submarines6 used windows XP in 2016. Unquestionably, both cases justify our premise. Unlike conventional weapons, cyber weapons do not require much in the way of financial resources and on many occasions governments are contributing to the development and spread of cyber weapons. Saved to the right proportions, in cyber war countries are using their economic power to buy, discover and store zero-day vulnerabilities of software and hardware

CONCLUSION

4 https://www.theverge.com/2014/11/12/7202801/microsoft-patches-critical-19-year-old-windows-bug 5 https://arstechnica.com/information-technology/2015/11/failed-windows-3-1-system-blamed-for-taking-out-paris-airport/ 6 https://mspoweruser.com/uks-nuclear-submarines-runs-windows-xp-submarines/

criticalinfrastructureprotectionreview.com

CYBERSECURITY, CYBER WEAPONS AND CYBER-ATTACKS

systems. We define zero-days as the raw material of cyber weapons. Another interesting characteristic of the cyber weapon is re-use of the weapon against its own attacker. After a cyber-attack, specialists can capture the cyber artefact and with some changes or improvements, it is possible to fight back. In this case, act shrewdly and precisely is as important as the economic and military power to carry out a cyber-attack. War is a profitable business and the environment of insecurity helps to maintain a business model of fear[11]. We may conclude that all governments are contributing to an insecure cyber world. We have no victims in this game. All of our countries are responsible for global cyber-attacks. All countries will continue to improve their cyber weapons. The DOD should continue to prioritise its cyber investments and develop the capabilities required to defend U.S. interests at home and overseas[12]. What can we expect of cybersecurity? ■

REFERENCES [1] NATO, “Cyber Definitions,” NATO, 2007. [Online]. Available: https://ccdcoe.org/cyber-definitions.html. [Accessed 26 09 2017]. [2] North Atlantic Treaty Organisation (NATO), “Warsaw Summit Communiqué,” NATO, 09 July 2016. [Online]. Available:

http://www.nato.int/cps/en/natohq/official_

texts_133169.htm#cyber. [Accessed 01 september 2017]. [3] T. Rid and P. McBurney, “Cyber-Weapons,” RUSI Journal,

[8] D. Burg and S. Joyce, “Cybersecurity after WannaCry: How to Resist Future Attacks,” PWC, 16 May 2017. [Online]. Available:

https://www.strategy-business.com/

blog/Cybersecurity-After-WannaCry-How-to-ResistFuture-Attacks?gko=22163. [Accessed 17 May 2017]. [9] WikiLeaks, “Vault 7: CIA Hacking Tools Revealed,” Wikileaks, 07 March 2017. [Online]. Available: https:// wikileaks.org/ciav7p1/. [Accessed 22 May 2017]. [10] R. W. K. P. F. A. Rodrigo Ruiz, “The leakage of passwords from home banking sites: A threat to global cyber security?,” Journal of Payments Strategy & Systems, Volume 11 / Number 2 / Summer 2017, pp. 174-183, 09 2017. [11] R. Ruiz, “Symbiosis and fear:Evolutionary Benefits of Cybersecurity,” United States Cyber Security Magazine, vol. 6, nº 1, pp. 109-111, 6 2017. [12] DoD, “The DoD Cyber Strategy,” 2015.

ABOUT THE AUTHORS Rogério Winter is a Colonel in the Brazilian Army at with more than 25 years of experience in military operations and information security. He holds a Master’s degree in Electronic Engineering and Computer Science at the Instituto Tecnológico de Aeronáutica (ITA) - Brazil and is a member of the Society of Digital Information and Wireless Communications). His current interests are warfare issues, cybernetics, command and control, and decision-making processes. He is also the co-author of ‘Apoc@lypse: The End of Antivirus’.

vol. 157 , pp. 6-13, 29 February 2012. [4] C. Wilson, “Cyber weapons: 4 defining characteristics,” 04 June 2015. [Online]. Available: https://gcn.com/ articles/2015/06/04/cyber-weapon.aspx.

[Accessed

December 2015]. [5] ARMY WAR COLL CARLISLE BARRACKS PA, “Defense Technical Information Center,” 31 march 1986. [Online]. Available:

http://www.dtic.mil/docs/citations/ADA170781.

[Accessed 29 september 2017]. [6] R. Ruiz, R. Winter, K. Park and F. Amatte, Apoc@lypse: The End of Antivirus, Charleston – US: Amazon, 2015. [7] R. Ruiz e R. Winter, “Lazarus: Data Leakage with PGP and Resurrection of the Revoked User,” Journal of Cyber Security and Mobility, pp. 1-14, 04 2016.

82 Critical Infrastructure Protection Review - Autumn 2017

Rodrigo Ruiz is a researcher at CTI - Information Technology Center Renato Archer, Campinas, Brazil. In addition, he is the IEEE member, member of SDIWC, as well as the co-author of Apoc@lypse: The End of Antivirus. He has also authored papers about privacy and security for Cyber Defense Magazine, Cyber Security Review, US Cyber Security Magazine, JPSS, IJOFCS, JCSM and international conferences and Journals. Contact: rodrigosruiz@outlook.com https://www.researchgate.net/profile/Rodrigo_Ruiz3

CALL FOR PAPERS Critical Infrastructure Protection Review editorial team would like to invite government departments, intergovernmental organisations, researchers, academics and industry experts to contribute their articles, case studies, research papers and opinion pieces. We are looking for both theoretical and practice based non-promotional editorial contributions. Only original, so far not published articles are accepted. All enquiries and articles should be submitted by email to: editorial@deltabusinessmedia.com For more information please visit: http://www.criticalinfrastructureprotectionreview.com/editorial/

CRITICAL INFRASTRUCTURE PROTECTION REVIEW Unique content I Global reach I In print and online

PRINT EDITION

eBOOK AND PDF

WEBSITE

NEWSLETTER

DISTRIBUTION AT THE EVENTS

Keep up-to-date with the latest news and developments, subscribe at http://www.criticalinfrastructureprotectionreview.com/subscribe/

criticalinfrastructureprotectionreview.com