Critical Infrastructure Protection

Critical Infrastructure Protection
David Brodbeck from Seattle, WA, USA · CC BY 2.0 · source
Name	Critical Infrastructure Protection
Type	Policy area
Jurisdiction	International

Critical Infrastructure Protection is the practice of safeguarding essential physical and cyber systems that underpin modern societies, including New York City, Washington, D.C., London, Tokyo, and Beijing. It encompasses activities by agencies such as the Department of Homeland Security (United States), National Cyber Security Centre (United Kingdom), European Union Agency for Cybersecurity, and organizations like NATO, United Nations, and Interpol. Major events shaping the field include responses to the 9/11 attacks, the 2007 cyberattacks on Estonia, the 2015 Ukraine power grid cyberattack, and natural disasters such as Hurricane Katrina and the Tohoku earthquake and tsunami.

Overview

Critical Infrastructure Protection integrates frameworks developed by bodies including the Presidential Policy Directive 21 sponsors, the National Institute of Standards and Technology, and the International Organization for Standardization to protect sectors such as Energy, Water, Transportation systems, Health care, Financial services, Telecommunications, and Food and agriculture. Actors include national entities like the Federal Emergency Management Agency, regional authorities such as the European Commission, private operators like ExxonMobil, Siemens, AT&T, and research institutions including MIT, Stanford University, and Carnegie Mellon University. Historical precedents trace to infrastructure reconstruction after the Marshall Plan and civil defense measures from the Cold War.

Threats and Vulnerabilities

Threats encompass state-sponsored operations attributed to actors like Fancy Bear, Lazarus Group, and APT28, criminal organizations such as the Shadow Brokers incidents, insider risks observed in cases involving Edward Snowden, and physical attacks exemplified by the IRA campaigns. Natural hazards include events tied to Hurricane Maria, volcanic eruptions such as Eyjafjallajökull eruption 2010, and pandemics like the COVID-19 pandemic. Vulnerabilities arise from legacy industrial control systems (ICS) linked to Stuxnet and the 2016 Mirai botnet compromises, supply chain exposures evident in SolarWinds hack, and regulatory gaps highlighted by debates around the Patriot Act and the Cybersecurity Information Sharing Act. Critical nodes—ports such as Port of Rotterdam, airports like Heathrow Airport, and power plants including Three Mile Island—illustrate cascading failure risks.

Policy and Legal Frameworks

Legal instruments include statutes and directives such as Homeland Security Act of 2002, European Programme for Critical Infrastructure Protection, and national strategies like United Kingdom National Security Strategy. Multilateral agreements involve Budapest Convention on Cybercrime and standards from International Electrotechnical Commission. Regulatory agencies such as the Federal Communications Commission, Office of the Privacy Commissioner of Canada, and courts like the European Court of Human Rights shape compliance. Oversight and accountability mechanisms reference reports by Government Accountability Office, audits by International Monetary Fund, and legislative inquiries like hearings of the United States Congress.

Risk Management and Resilience Strategies

Risk frameworks employ methods from ISO/IEC 27001, NIST Cybersecurity Framework, and business continuity planning used by firms such as General Electric and Microsoft. Strategies include redundancy implemented in grids by National Grid plc, decentralization seen in microgrid pilots, segmentation of networks adopted by Cisco Systems, and insurance mechanisms underwritten by companies like AIG and Munich Re. Exercises and trainings reference scenarios from Exercise Cyber Storm and TOPOFF series, while academic research at Oxford University and Harvard University informs modeling of systemic risk.

Sector-Specific Approaches

Energy sector practices draw on lessons from operators like Exelon and regulators such as the Federal Energy Regulatory Commission; water sector resilience includes initiatives by World Bank and UNICEF projects; transportation security involves protocols at International Civil Aviation Organization and port management at International Maritime Organization. Health sector preparedness builds on guidance from World Health Organization and national public health agencies such as the Centers for Disease Control and Prevention. Financial sector continuity is coordinated through entities like the Bank for International Settlements and central banks including the Federal Reserve System.

Incident Response and Recovery

Incident response leverages Computer Emergency Response Teams such as US-CERT, CERT-EU, and private firms like FireEye and CrowdStrike. Forensics methodologies were refined after incidents such as the Target data breach and the Equifax data breach. Recovery planning uses frameworks from ISO 22301 and lessons from post-disaster reconstruction projects like those following Indian Ocean earthquake and tsunami relief. Coordination across municipal responders such as New York City Office of Emergency Management and national militaries including the United States National Guard is routine during major incidents.

International Cooperation and Standards

International cooperation is facilitated by NATO Cooperative Cyber Defence Centre of Excellence, the G7 cyber dialogues, and forums such as the Global Forum on Cyber Expertise. Standard-setting organizations include ISO, IEC, and IETF, while development finance for resilience is provided by bodies like the World Bank and Asian Development Bank. Cross-border exercises and mutual aid arrangements reference mechanisms seen in Schengen Area disaster support and bilateral agreements such as those between the United States and Canada.

Category:Infrastructure protection