Critical Infrastructure

Homeland Security and Emergency Preparedness, Fourth Edition

Robert S. Radvanovsky, Allan McDougall

• Publisher: CRC Press
• Year: 2018
• ISBN:
  9781351674898
• Edition: 4
• Topic: Sciences sociales
• Subtopic: Études du développement mondial

This edition of Critical Infrastructure presents a culmination of ongoing research and real-work experience, building upon previous editions. Since the first edition of this work, the domain has seen significant evolutions in terms of operational needs, environmental challenges and threats – both emerging and evolving. This work expands upon the previous works and maintains its focus on those efforts vital to securing the safety and security of populations.

The world continues to see a shift from a force-protection model to one more focused on resilience. This process has been exacerbated and challenged as societies face increased instability in weather and arguably climate, a destabilized geopolitical situation, and continuing economic instability. Various levels—ranging from international oversight to individual actions—continue to work towards new approaches and tools that can assist in meeting this challenge.

This work keeps pace with the key changes that have occurred since previous editions and continues to provide insight into emerging and potential issues. Expanding from historical research, major areas of interest such as climate change, regulatory oversight, and internal capacity building are explored. This work provides a reference for those that are working to prepare themselves and their organizations for challenges likely to arise over the next decade.

In keeping with the fast-changing nature of this field, Critical Infrastructure: Homeland Security and Emergency Preparedness, Fourth Edition has been completely revised and fully updated to reflect this shift in focus and to incorporate the latest developments.

• 
  
  

• Presents an overview of some of the emerging challenges and conflicts between the public and private sector;

• 
  
  

• Continues to build the case for organizations to adopt an intelligence-driven and adaptive approach to protecting infrastructure;

• 
  
  

• Presents a unique and new perspective of re-examining baseline requirements against a range of shifting factors, taking a balanced approach between risk-based planning and consequence management;

• 
  
  

• Expands upon the issue of internal and lone-wolf threats that pose additional challenges to a system that continues to focus largely on external threats; and

• 
  
  

• An enhanced and improved view of interdependencies in an increasingly inter-connected and network-enabled world.

Preparing for the challenges of increasingly unstable threat and operating environments will pose challenges at all levels. Those involved in ensuring that critical infrastructure protection and assurance efforts function effectively and efficiently—whether as government regulators, business operators, clients of various infrastructure sectors or those seeking to maintain an accountable system – will find insights into less-explored aspects of this challenging field.

1Introduction to Critical Infrastructure Assurance and Protection

1.1Introduction

Critical infrastructure protection (CIP) is a topic that is now beginning to span generations. The basic concept of critical infrastructure protection finds its roots in concepts such as vital point protection that can cast back several thousand years with the protection of key shelter points, food stores, and other features such as water sources. Those involved in the planning of conflicts extended this to such infrastructure as food, water, ammunition, fuel and equipment. Civil infrastructure followed the same course, with the need for protecting vital points gradually expanding from vital points to the protection of distributed infrastructure (such as transportation, telecommunications, water, and other networks) to the more holistic protection of critical services described in previous editions. Some will remember the year 2000 (Y2K) issue as an emerging crisis that was one of the first clear examples of this expansion, involving the surveys of several critical infrastructures (such as the electrical grid) in preparation for the possible disruption of services that included power, communications, financial services, and transportation. For others, the issue began shortly after the attacks on September 11, 2001. While acts of terrorism have continued, other threats such as severe weather, climate change, and cyber threats and others have re-emerged and the threat spectrum has again broadened to cover a more holistic approach. What this book addresses is a fundamental shift in how we look at CIP—changing the approach from one that can be described as a series of connected, consecutive mad dashes to one that better approximates a marathon.

Within recent (albeit growing more distant) memory, the mad dashes began with Y2K when the situation became dire enough that airline executives had to board aircraft to fly across 0 hour in order to demonstrate that their planes were still safe. While Y2K caused concerns at a technical level, it represented on narrow band on the overall threat spectrum The attacks of 9/11 broadened the focus to include terrorist attacks while natural disasters around the world and including Hurricanes Katrina and Sandy at home broadened it even further. Populations have become less confident that critical services can be protected and delivered at all times.

Since the last edition, however, the threat spectrum itself has changed. The various categories of events have broadened. Terrorist attacks have evolved from the actions of small groups, to coordinated efforts (such as ISIS) using internal resources to ideologically inspired events where individuals have carried out “lone wolf attacks” not because of their membership within a group but as a result of their being inspired to such events by messages carried through various media services (ranging from the internet enabled to traditional media). The spectrum has also changed in terms of the pace of events. While threats were often looked at in a manner that would align with the preparedness measures (a single natural disaster), the sheer scope of certain challenges like climate change and the complexity of these kinds of issues have perhaps broadened this beyond thinking largely at the preparedness phase of the Emergency Management cycle to include thinking more aligned with the mitigation level.

While what might be described as the breadth and depth of the challenge has increased, so has the nature of those involved. While the issue of critical infrastructure protection involved significant resources for the Y2K challenge, these focused on narrower groups of technical and government teams. This broadened to include various other security domains quickly and has further evolved to include many traditional and social sciences as sources of conflict and the sources of changes within complex systems are sought and explored. As these groups have expanded and evolved, so have the methods used to examine this domain and its associated challenges.

As one examines the community now engaging this challenge, not all the changes have been positive. While governments, academic institutions, and private sector entities have continued to take up the challenge, there has been an increasing politicization of the issue, notably through those that have tainted scientific and critical issues in order to promote political and other interests. The security community has not been immune to this. In short, the issue of critical infrastructure protection which once resided in the public domain has expanded to become its own business line and, like any other business line, there are those that continue to attempt to serve the public interest while others have identified the issue as a potentially lucrative source of funds. As a result, the data, information, and intelligence associated with climate change has become tainted through communications and spin-doctoring, meaning all conclusions must be put under a far more critical eye.

1.2What Is Critical Infrastructure?

The term critical infrastructure refers to assets of physical and logical systems that are essential to the minimum operations of the economy and government. This much, at least, has not changed. They include, but are not limited to, telecommunications, energy, banking and finance, transportation, water systems, and emergency services, both governmental and private. As these systems become further interconnected, we see two major trends becoming apparent. The first trend involves the pace at which technology evolves. This is not a constant around the world, and as time progresses, we continue to see examples of certain societies and communities progressing at different rates and the emerging challenges associated with the replacement of aging infrastructure. The second trend involves understanding that the specific elements that make up a critical infrastructure are not constant across all communities and may be subject to physical, sociological, and cultural factors. As a result, CIP practitioners need to understand the contexts (economic, environmental, cultural, and political) within which critical infrastructures can be found. Thus, due to advances in information technology and efforts to improve efficiencies in these systems, infrastructures have become increasingly automated and interlinked. These improvements have created new vulnerabilities relating to equipment failure, human error, weather and other natural causes, as well as physical and computer-related attacks.

Over the past decade, various levels of government have been held responsible for the protection of their own infrastructure. As the world moves inexorably toward a global-centric network, we are seeing levels of government, along with the private sector, and even individual citizens, having responsibilities take a more global approach. It is not unusual for individuals to call service centers halfway around the world to assist them with their networking difficulties. At the same time, global supply chains require that private entities become much more aware of events around the world that can affect the resilience of their supply chains. What this means is that local efforts that were seen as manageable, if somewhat uncomfortable, have grown exponentially into international “monsters.” As a result, the previous process associated with critical infrastructure assurance has grown in scope from consistent testing and evaluation of local infrastructures to one that is at its beginning of understanding the vast influences that operate at a much more global level. This has changed the playing field—significantly—from one where the edicts coming from national capitals are now the second step in a much grander process that involves balancing of international interests and priorities with national responsibilities.

1.3What Is the Private Sector?

The private sector of a nation’s economy consists of those entities not controlled by the state, such as private firms and companies, corporations, private banks, nongovernmental organizations (NGOs), etc.1 Many nations have entities that are established to deal with the private sector. Often these are linked to applying requirements or to the contracting arrangements that can be made between the government and the private sector. What needs to be understood here is how controls differ between the two. The private sector entity may influence laws or government policy, but does not have the authority to set that policy. The policy controls which are often referred to in today’s asset protection community are management decisions that remain largely constrained to its own persons, assets, and operations. Even in arrangements where the government delegates work, it is always done under the oversight of some legal mechanism. The private sector may also have to respond to authorities that are outside of the nation—such as those imposed on it by parent companies, partners, or even financial institutions. This can lead to a level of complexity when attempting to determine what the requirements being placed on the private sector actually are.

The second aspect to remember about the private sector is the nature of its finances. Regardless of good intentions and public messaging, the private sector entity seeks to generate wealth. In return for some consideration, companies that operate for-profit business models tend to seek to increase that wealth, while those that operate not-for-profit business models attempt to balance their cash flows with their operations. In short, decisions are made with a very clear understanding that there are financial risks involved.

This financial risk is also different than that of the government. The government operates on a fiscal year that allows for budgets to be reset to a starting point and also has a significant ability to determine its level of debt, although the past few years have seen a pressure on government financial controls to reduce waste and limit spending, resulting in a similar decline in resources in, or even elimination of, some activities. The private sector does not have this. Budgets are linear in that if money out is greater than money in, then eventually the company will first go into debt, then insolvency, and then finally cease to exist. This has a profound effect on how organizations look at their budgets and new requirements—the government may see issues in terms of “costs of doing business,” while the private sector may interpret those new measures as another step on the road toward “going out of business.”

With increases in globalization, differences in the competitive playing field can either exacerbate this challenge or mitigate it. In the context of critical infrastructure assurance (making sure it’s there), we need to take a whole-picture approach to this issue. If competition is based on lowest dollar value or even best dollar value approaches, entities operating within those states with lower costs of production are able to market their goods or services globally at a lower cost. This is a major issue associat...