Critical Infrastructure Risk Assessment

The Definitive Threat Identification and Threat Reduction Handbook

Ernie Hayden, MIPM, CISSP, CEH, GICSP(Gold), PSP

• Publisher: Rothstein Publishing
• Year: 2020
• Print ISBN:
  9781944480714
• eBook ISBN:
  9781944480721
• Topic: Business
• Subtopic: Infrastructure
• Index: Business

As a manager or engineer have you ever been assigned a task to perform a risk assessment of one of your facilities or plant systems? What if you are an insurance inspector or corporate auditor? Do you know how to prepare yourself for the inspection, decided what to look for, and how to write your report?

This is a handbook for junior and senior personnel alike on what constitutes critical infrastructure and risk and offers guides to the risk assessor on preparation, performance, and documentation of a risk assessment of a complex facility. This is a definite "must read" for consultants, plant managers, corporate risk managers, junior and senior engineers, and university students before they jump into their first technical assignment.

PART I

FOUNDATIONS

Before you can begin to conduct a risk assessment you need to understand a few fundamentals. This section helps you get prepared before you pick up your pen and camera to walk down the site.

Part I includes essential information on the following:

• What constitutes Critical Infrastructure and how is it defined in the US and internationally?
• What is Risk? What are the elements that make up this concept?
• What is a Risk Assessment? What are the different types of risk assessments and their constituent parts?

You should find this an interesting read which will offer the basic information necessary to jump into the risk assessment phase.

Chapter 1

Just What is
Critical Infrastructure?

Infrastructure sector is all about building assets for the country. It is part of nation building.¹

- Gautam Adani

This chapter brings you the fundamentals of what constitutes critical infrastructure and the associated government policies from the US and internationally. Since this book will discuss approaches and techniques when performing risk assessments of critical infrastructure, it is important for the executive and the assessment team to understand what critical infrastructure constitutes as a concept, and the history of it becoming a policy idea for government focus. Then, with this knowledge, the assessment process can be more holistic and complete with better understanding of a) what is critical infrastructure, b) what sectors does my company/institution rely upon, and c) how are the sectors interdependent and what is their effect on my organization’s performance and production?

1.1 What is Critical Infrastructure?

So, just what is critical infrastructure?

We are surrounded by it. We use it every day. It keeps our factories running, schools operating, and governments governing.

Infrastructure is very important for the function of a nation as well as an industrial sector.

One of my favorite quotes about infrastructure is from an article in The Atlantic where the author, Ian Bogost observed²:

Infrastructure is everything you don’t think about. The roads you drive on. The rigs and refineries that turn fossil fuel into the gas that makes your car go. The electricity that powers the streetlights and lamps that guide your way. All these technologies vanish into the oblivion of normalcy.

To give you a sense of how large this challenge is, the 2003 National Strategy for the Physical Protection of Critical Infrastructure and Key Assets offered a list of the different sectors and the scope of every way an attacker can penetrate your perimeter digitally and physically. Such a concept of the ways to break into an organization is often referred to as the attack surface.

This updated list is provided in the table below and, upon study, can be not only impressive but overwhelming to national policy makers and defenders.³

Table 1.1 Critical Infrastructure Attack Surface

Agriculture & Food	2.1 million farms 935,000 restaurants 200,000 registered food manufacturing, processing, and storage facilities 1/5 of the US economy
Banking & Finance	5,177 FDIC Insured Banks^4
Chemical Industry & Hazardous Materials	13,500 Chemical Plants Owned by Over 9,000 Companies^5
Commercial Assets	Entertainment and Media (e.g., motion picture studios, broadcast media). Gaming (e.g., casinos). Lodging (e.g., hotels, motels, conference centers). Outdoor Events (e.g., theme and amusement parks, fairs, campgrounds, parades). Public Assembly (e.g., arenas, stadiums, aquariums, zoos, museums, convention centers). Real Estate (e.g., office and apartment buildings, condominiums, mixed use facilities, self-storage). Retail (e.g., retail centers and districts, shopping malls). Sports Leagues (e.g., professional sports leagues and federations).
Dams	Over 90,000 Dams
Defense Industrial Base	Over 100,000 Firms
Emergency Services	Over 50,700 fire stations Over 120,000 Full-Time Federal Law Enforcement Officers 787,470 Full-Time State, Local, Tribal, Territorial Law Enforcement Officers 9,840 Emergency Management Directors 21,280 Emergency Medical Service Agencies
Energy	6,413 Power Plants 1,100,000 Oil and Natural Gas Production Sites Produced by Over 9,000 Different Companies 200,000 Miles of High-Voltage Transmission Lines^6 5.5 Million Miles of Distributions Lines^7
Government Facilities	General Service Administration (GSA) Owns and Leases Over 376.9 Million Square Feet of Space in 9,600 Buildings in > 2,200 Communities^8
Natural Monuments & Icons	62 National Parks^9 83 National Monuments^10
Nuclear Power Plants	60 Commercially Operating Nuclear Power Plants with 98 Nuclear Reactors in 30 States
Postal & Shipping	137 Million Delivery Sites 31,324 US Post Offices 2,000 Federal Express Sites 5,000 United Parcel Service Sites 720,000,000 Packages & Letters Shipped Each Day
Public Health	6,146 Registered Hospitals^11
Telecommunications	349,344 Cell Towers^12 2,668 Internet Service Providers (ISP)^13 113,000 Miles of Fiber^14
Transportation	19,700 Public Airports 4,000,000 Miles of Roadway 350 Tunnels 138,000+ Route-Miles of Major Railroads 600,000+ Highway Bridges 2,500,000 Miles of Pipelines 361 Commercial Ports 25,000 Miles of Waterway 11,000,000 Containers Enter the US Annually
Water & Wastewater	153,000 Public Drinking Water Systems 16,000 Publicly Owned Wastewater Treatment Facilities

The United States has been a leader in defining critical infrastructure, what it constitutes, and protection policies. However, this is not just an American problem. A CIPedia¹⁵ article identified 40 countries that have put forth a definition or at least a list of what constitutes critical national infrastructure. I will provide an in-depth review of the United States and a few other countries and their approach to critical infrastructure definition and protection policy in the discussion which follows.

1.2 Critical Infrastructure Conceptual Development — United States

Infrastructure can be defined as:

Basic facilities, services and installations needed for the functioning of a community or society.

One of the earliest policy reviews identified in my research is from the United States Congressional Budget Office (CBO). The report, Public Works Infrastructure: Policy Considerations for the 1980’s, was initiated at the request of the Senate Committee on the Budget in order to “...assess the needs of seven infrastructure systems and the costs of meeting those needs.” (Bodde, page iii).

In this document, the concept of “critical” infrastructure is not discussed; however, the report identifies the following infrastructure verticals considered for this review.

• Highways
...

Table of contents

• Cover
• Title page
• COPYRIGHT ©2020, Ernie Hayden
• WHAT YOUR COLLEAGUES ARE SAYING ABOUT CRITICAL INFRASTRUCTURE RISK ASSESSMENT
• DEDICATION AND ACKNOWLEDGEMENTS
• Foreword by Kirk Bailey
• Foreword by Peter Gregory
• CONTENTS
• Introduction
• PART I FOUNDATIONS
• PART II HANDBOOK
• APPENDIX A EXAMPLE RISK ASSESSMENT REPORT
• INDEX
• ABOUT THE AUTHOR