Critical Infrastructure Protection in Homeland Security

Defending a Networked Nation

Ted G. Lewis

• Publisher: Wiley
• Year: 2019
• ISBN:
  9781119614562
• Edition: 3
• Topic: Politique et relations internationales
• Subtopic: Terrorisme

Covers critical infrastructure protection, providing a rigorous treatment of risk, resilience, complex adaptive systems, and sector dependence

Wide in scope, this classroom-tested book is the only one to emphasize a scientific approach to protecting the key infrastructures components of a nation. It analyzes the complex network of entities that make up a nation's infrastructure, and identifies vulnerabilities and risks in various sectors by combining network science, complexity theory, risk analysis, and modeling and simulation. This approach reduces the complex problem of protecting water supplies, energy pipelines, telecommunication stations, power grid, and Internet and Web networks to a much simpler problem of protecting a few critical nodes.

The new third edition of Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation incorporates a broader selection of ideas and sectors than the previous book. Divided into three sections, the first part looks at the historical origins of homeland security and critical infrastructure, and emphasizes current policy. The second examines theory and foundations, highlighting risk and resilience in the context of complexity theory, network science, and the prevailing theories of catastrophe. The last part covers the individual sectors, including communications, internet, cyber threats, information technology, social networks, SCADA, water and water treatment, energy, and more.

• Covers theories of catastrophes, details of how sectors work, and how to deal with the problem of critical infrastructure protection's enormity and complexity
• Places great emphasis on computer security and whole-community response
• Includes PowerPoint slides for use by lecturers, as well as an instructor's guide with answers to exercises
• Offers five robust appendices that augment the non-mathematical chapters with more rigorous explanations and mathematics

Critical Infrastructure Protection in Homeland Security, Third Edition is an important book for upper-division undergraduates and first-year graduate students in political science, history, public administration, and computer technology. It will also be of great interest to professional security experts and policymakers.

1
ORIGINS OF CRITICAL INFRASTRUCTURE PROTECTION

What is the motivation for studying critical infrastructure protection (CIP)? What are the central issues that need to be addressed in order to create a meaningful strategy for dealing with threats against infrastructure? We begin by tracing the development of CIP over several decades and noting that it has evolved through at least eight phases: from initial awareness to combating terrorism, emphasis on natural disaster response, an early definitional phase, a public–private cooperation phase, a federalism versus states phase, a resilience awareness phase, a risk‐based decision‐making phase, and after massive computer security breaches and the failure of government to “wake up to” the realities of computer and network exploits at both misdemeanor and warlike levels, the cybersecurity phase.

CIP is a multifaceted topic because it cuts across many disciplines and jurisdictions. It cuts vertically across federal, state, local, and tribal political boundaries, and it cuts horizontally across public and private organizations. It has a variety of policy issues at one extreme and a diverse set of scientific and engineering issues at the other extreme. The most glaring example of this is the electric power grid, which is pulled in many different directions by political, social, engineering, and public–private forces. The rapid emergence of online e‐commerce, social networks, and misinformation campaigns also raise political, social, and engineering issues broadly classified as cybersecurity threats and exploits. The topics in this book touch on all of these, at architectural and policy levels, by applying complexity theory and network science to the practical problem of securing critical infrastructure and key resources (CIKR).

One of the most difficult tasks of protecting critical infrastructure (CI) is the problem of deciding who is responsible for what across these political and organizational lines. While policy at the Department of Homeland Security (DHS) offices in Washington, DC, may advocate an all‐hazard risk‐informed decision‐making process and encourage community action, actual operational and organizational processes at the state and local level may be entirely different due to a number of factors. Federalism and top‐down policy‐making may look good on paper, but actual implementation at the local level often lacks jurisdictional clarity, required expertise, willpower, or all three. For example, what is the role of public safety responders such as firefighters and law enforcement officers when something goes wrong with a gas pipeline, electrical power fails during a storm, or hackers exploit the Internet in a city without cybersecurity expertise?

There remain gaps in knowledge, jurisdictional clarity, and organizational fitness—challenges this book attempts to address—in the emerging field of CIP. As this chapter illustrates, the field is still evolving. Some issues are being resolved, while others are still in the early stages of their evolution. The field has matured, circa 2019, after decades of slow but steady maturation, such as follows:

• Recognition: No such field of study existed prior to the mid‐1900s. Although awareness of the importance of infrastructure began in 1962 with the Cuban Missile Crisis, nearly 30 years passed before the term critical infrastructure protection was defined. Throughout these 30 years, the roles and responsibilities of governmental agencies as well as the definition of CIP changed as the field evolved. Nonetheless, much remained to be resolved in this initial phase.
• Natural disaster recovery: In the beginning, CIP was nearly identical to consequence management—recovery from disasters such as floods, hurricanes, and earthquakes. The Stafford Act¹ established the Federal Emergency Management Agency (FEMA)—a federal agency dedicated to recovery after a flood, hurricane, earthquake, tornado, and so on. Terrorism was not a factor in CIP in the beginning. It would take a decade of attacks before CIP was linked with terrorism in the United States. But a focus on terrorists—human‐caused incidents—soon faded as natural disasters occurred more often than terrorist attacks, and headlines focused the public's attention on billion‐dollar natural disasters.
• Definitional phase: The term “critical infrastructure” did not exist before the 1990s. There was no definition of CIP, and infrastructure was taken for granted. The public was confident that freshwater always flowed from faucets and electric light switches always produced light. The terrorist attacks of 9/11 changed all that, of course, even though the earliest definition of CIP was made in 1997. Then, from 1997 through 2003, the identification of CI sectors expanded from eight to 13 sectors plus 5 key assets, expanded again to 18 sectors and key resources (KR), and then consolidated into 16 CIKR sectors in 2013. Today it is difficult to identify sectors of the national economy that are not critical; however, this book attempts to define criticality in a rigorous and operational way.
• Public–private cooperation: The role of the private sector in CIP was slow to take root until the late 1990s. But so many CIKR assets are in the hands of corporations—not local, state, or federal government—that it is difficult to separate public versus private assets. Public safety and health, law enforcement, and emergency response are largely a function of local government, but energy, power, communications, and commercial air travel are largely a function of the private sector. Water and key assets such as dams fall somewhere in between. Who should respond when something happens to these systems? Even today, the federal government and private sector owners of infrastructure are not clear on their respective roles and responsibilities with respect to CIP, although the role of government in protecting systems of all types has narrowed over the decades. Nonetheless, when a small business in mid‐America is hacked by a teenager running scripts downloaded from the dark web, it is not clear who is responsible for the protecting the small business from the...