A scientific approach to the new field of critical infrastructure protection This book offers a unique scientific approach to the new field of critical infrastructure protection: it uses network theory, optimization theory, and simulation software to analyze and understand how infrastructure sectors evolve, where they are vulnerable, and how they can best be protected. The author demonstrates that infrastructure sectors as diverse as water, power, energy, telecommunications, and the Internet have remarkably similar structures. This observation leads to a rigorous approach to vulnerability analysis in all of these sectors. The analyst can then decide the best way to allocate limited funds to minimize risk, regardless of industry sector. The key question addressed in this timely book is: What should be protected and how? The author proposes that the answer lies in allocating a nation's scarce resources to the most critical components of each infra-structure--the so-called critical nodes. Using network theory as a foundation, readers learn how to identifya small handful of critical nodes and then allocate resources to reduce or eliminate risk across the entire sector. A comprehensive set of electronic media is provided on a CD-ROM in the back of the book that supports in-class and self-tutored instruction. Students can copy these professionally produced audio-video lectures onto a PC (Microsoft Windows(r) and Apple Macintosh(r) compatible) for repeated viewing at their own pace. Another unique feature of the book is the open-source software for demonstrating concepts and streamlining the math needed for vulnerability analysis. Updates, as well as a discussion forum, are available from www.CHDS.us. This book is essential for all corporate, government agency, and military professionals tasked with assessingvulnerability and developing and implementing protection systems. In addition, the book is recommended for upper-level undergraduate and graduate students studying national security, computing, and other disciplines where infrastructure security is an issue.

This edited volume uses a ‘constructivist/reflexive’ approach to address critical infrastructure protection (CIP), a central political practice associated with national security. The politics of CIP, and the construction of the threat they are meant to counter, effectively establish a powerful discursive connection between that the traditional and normal conditions for day-to-day politics and the exceptional dynamics of national security. Combining political theory and empirical case studies, this volume addresses key issues related to protection and the governance of insecurity in the contemporary world. The contributors track the transformation and evolution of critical infrastructures (and closely related issues of homeland security) into a security problem, and analyze how practices associated with CIP constitute, and are an expression of, changing notions of security and insecurity. The book explores aspects of ‘securitisation’ as well as at practices, audiences, and contexts that enable and constrain the production of the specific form of governmentality that CIP exemplifies. It also explores the rationalities at play, the effects of these security practices, and the implications for our understanding of security and politics today.

Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE) introduces a new methodology to help critical infrastructure owners, operators and their security practitioners make demonstrable improvements in securing their most important functions and processes. Current best practice approaches to cyber defense struggle to stop targeted attackers from creating potentially catastrophic results. From a national security perspective, it is not just the damage to the military, the economy, or essential critical infrastructure companies that is a concern. It is the cumulative, downstream effects from potential regional blackouts, military mission kills, transportation stoppages, water delivery or treatment issues, and so on. CCE is a validation that engineering first principles can be applied to the most important cybersecurity challenges and in so doing, protect organizations in ways current approaches do not. The most pressing threat is cyber-enabled sabotage, and CCE begins with the assumption that well-resourced, adaptive adversaries are already in and have been for some time, undetected and perhaps undetectable. Chapter 1 recaps the current and near-future states of digital technologies in critical infrastructure and the implications of our near-total dependence on them. Chapters 2 and 3 describe the origins of the methodology and set the stage for the more in-depth examination that follows. Chapter 4 describes how to prepare for an engagement, and chapters 5-8 address each of the four phases. The CCE phase chapters take the reader on a more granular walkthrough of the methodology with examples from the field, phase objectives, and the steps to take in each phase. Concluding chapter 9 covers training options and looks towards a future where these concepts are scaled more broadly.

Strategies for Protecting National Critical Infrastructure Assets eases the research burden, develops investigative protocols, and pulls together data into a comprehensive and practical guide, to help the serious reader understand advanced concepts and techniques of risk assessment with an emphasis on meeting the security needs of the critical national infrastructure. The text is divided into five major sections, which are further broken down by individual chapters, each addressing one element of risk assessment as well as focusing attention on applying the risk assessment methodology to a particular industry. This book establishes a new and acceptable approach for conducting risk assessments in a high-risk world. Helps the reader to understand advanced concepts and techniques of risk assessment Provides a quick, reliable, and practical "briefcase" reference to use in the office as well as on the road Introduces the elements of the risk assessment process by defining its purpose and objectives, describing the behavioural and physical sciences, the techniques employed in the process, and the measurement and evaluation tools and standards used to perform an objective risk assessment.

Since 9/11, the U.S. government and the private sector have devised sophisticated ways of protecting people and assets. The threats have evolved, however, becoming more insidious. They no longer comprise just terrorists who target critical infrastructures. They also include insider threats, such as PFC Manning and NSA contractor Snowden who leaked classified defense information, active shooter incidents like the Sandy Hook Elementary School massacre, and the 2013 Boston Marathon terrorist bombing. These events make it imperative for the public and private sectors to engage in effective partnership to protect people, facilities, and national infrastructure assets. Homeland Security and Private Sector Business: Corporations' Role in Critical Infrastructure Protection, Second Edition identifies the role the private sector plays in securing our homeland and offers strategies to aid in the fight against national and international threats. Addressing mandates and legislation introduced since the first edition, this new edition includes: Updates to the NIPP (National Infrastructure Protection Plan) New case studies of both proper security policies and procedures in practice versus costly security breaches Greater focus on smaller business and practical "immediate use" guidance New measures for assessing and addressing vulnerabilities and threats New appendices with sample plans and practical checklists Supplying tools that can easily be adapted and applied to every business situation at all budget levels, the book helps businesses counter the total threat, from traditional terrorists to inside betrayers—providing a clear blueprint for securing people and assets.

Critical infrastructures are the backbone of modern, interconnected economies. The disruption of key systems and essential services - such as telecommunications, energy or water supply, transportation or finance - can cause substantial economic damage. This report looks at how to boost critical infrastructure resilience in a dynamic risk landscape, and discusses policy options and governance models to promote up-front resilience investments. Based on an international survey, the report analyses the progressive shift of critical infrastructure policies from asset protection to system resilience. The findings are reflected in a proposed Policy Toolkit for the Governance of Critical Infrastructure Resilience, which can guide governments in taking a more coherent, preventive approach to protecting and sustaining essential services.

This book is open access under a CC BY 4.0 license. This book summarizes work being pursued in the context of the CIPRNet (Critical Infrastructure Preparedness and Resilience Research Network) research project, co-funded by the European Union under the Seventh Framework Programme (FP7). The project is intended to provide concrete and on-going support to the Critical Infrastructure Protection (CIP) research communities, enhancing their preparedness for CI-related emergencies, while also providing expertise and technologies for other stakeholders to promote their understanding and mitigation of the consequences of CI disruptions, leading to enhanced resilience. The book collects the tutorial material developed by the authors for several courses on the modelling, simulation and analysis of CIs, representing extensive and integrated CIP expertise. It will help CI stakeholders, CI operators and civil protection authorities understand the complex system of CIs, and help them adapt to these changes and threats in order to be as prepared as possible for mitigating emergencies and crises affecting or arising from CIs.

Security protections for critical infrastructure nodes are intended to minimize the risks resulting from an initiating event, whether it is an intentional malevolent act or a natural hazard. With an emphasis on protecting an infrastructure's ability to perform its mission or function, Critical Infrastructure System Security and Resiliency presents a practical methodology for developing an effective protection system that can either prevent undesired events or mitigate the consequences of such events. Developed at Sandia National Labs, the authors’ analytical approach and methodology enables decision-makers and security experts to perform and utilize risk assessments in a manner that extends beyond the theoretical to practical application. These protocols leverage expertise in modeling dependencies—optimizing system resiliency for effective physical protection system design and consequence mitigation. The book begins by focusing on the design of protection strategies to enhance the robustness of the infrastructure components. The authors present risk assessment tools and necessary metrics to offer guidance to decision-makers in applying sometimes limited resources to reduce risk and ensure operational resiliency. Our critical infrastructure is vast and made up of many component parts. In many cases, it may not be practical or affordable to secure every infrastructure node. For years, experts—as a part of the risk assessment process—have tried to better identify and distinguish higher from lower risks through risk segmentation. In the second section of the book, the authors present examples to distinguish between high and low risks and corresponding protection measures. In some cases, protection measures do not prevent undesired events from occurring. In others, protection of all infrastructure components is not feasible. As such, this section describes how to evaluate and design resilience in these unique scenarios to manage costs while most effectively ensuring infrastructure system protection. With insight from the authors’ decades of experience, this book provides a high-level, practical analytical framework that public and private sector owners and operators of critical infrastructure can use to better understand and evaluate infrastructure security strategies and policies. Strengthening the entire homeland security enterprise, the book presents a significant contribution to the science of critical infrastructure protection and resilience.

Since the September 11 attacks, America is safer, but we are not yet safe. We have done much to degrade al-Qaida and its affiliates and to undercut the perceived legitimacy of terrorism. Our Muslim partners are speaking out against those who seek to use their religion to justify violence and a totalitarian vision of the world. We have significantly expanded our counter terrorism coalition, transforming old adversaries into new and vital partners in the War on Terror. We have liberated more than 50 million Afghans and Iraqis from despotism, terrorism, and oppression, permitting the first free elections in recorded history for either nation. In addition, we have transformed our governmental institutions and framework to wage a generational struggle. There will continue to be challenges ahead, but along with our partners, we will attack terrorism and its ideology, and bring hope and freedom to the people of the world. This is how we will win the War on Terror.

The information infrastructure--comprising computers, embedded devices, networks and software systems--is vital to operations in every sector. Global business and industry, governments, and society itself, cannot function effectively if major components of the critical information infrastructure are degraded, disabled or destroyed. This book contains a selection of 27 edited papers from the First Annual IFIP WG 11.10 International Conference on Critical Infrastructure Protection.