The vulnerability of critical infrastructures is a recurring theme on this blog, and today’s article has been on my mind for a while. What I like about Critical infrastructures at risk: A need for a new conceptual approach and extended analytical tool by Wolfgang Kröger is how it couples critical infrastructures, showing how one is dependent on the other, picking up a notion I described in an earlier post Are roads more important than computers?. The article also shows how external factors are a major contributor to the risk and interconnectedness of critical infrastructures.
IRGC
Much of the paper is based on the research undertaken by the International Risk Governance Council (IRGC), a Switzerland-based independent organization whose purpose is to help the understanding and management of emerging global risks that have impacts on human health and safety, the environment, the economy and society at large.
Critical infrastructure
In 2004 the EU Commission prepared an overall strategy for Critical Infrastructure Protection, that defined critical infrastructures as those physical and information technology facilities, networks, services and assets which, if disrupted or destroyed, would have a serious impact on the health, safety, security or economic well-being of citizens or the effective functioning of governments:
- Energy installations and networks (e.g. electrical power, oil and gas production, storage facilities and refineries, transmission and distribution system).
- Communications and Information Technology (e.g. telecommunications, broadcasting systems, software, hardware and networks including the Internet)
- Finance (e.g. banking, securities and investment)
- Health Care (e.g. hospitals, health care and blood supply facilities, laboratories and pharmaceuticals, search and rescue, emergency services)
- Food (e.g. safety, production means, wholesale distribution and food industry)
- Water (e.g. dams, storage, treatment and networks)
- Transport (e.g. airports, ports, intermodal facilities, railway and mass transit networks, traffic control systems)
- Production, storage and transport of dangerous goods (e.g. chemical, biological, radiological and nuclear materials)
- Government (e.g. critical services, facilities, information networks, assets and key national sites and monuments)
However, not all “critical” infrastructure is really “critical”. It is the degree of criticality that matters most.
Degree of criticality
The above mentioned EU report suggests three factors to look for when identifying critical infrastructure:
Scope – The loss of a critical infrastructure element is rated by the extent of the geographic area which could be affected by its loss or unavailability – international, national, provincial/territorial or local.
Magnitude – The degree of the impact or loss can be assessed as None, Minimal, Moderate or Major. Among the criteria which could be used to assess potential magnitude are:
(a) Public impact (amount of population affected, loss of life, medical illness, serious injury, evacuation)
(b) Economic impact (GDP effect, significance of economic loss and/or degradation of products or services)
(c) Environmental impact (on the public and surrounding location)
(d) Interdependency (between other critical infrastructure elements)
(e) Political impact (confidence in the ability of government)
Effects of time – This criteria ascertains at what point the loss of an element could have a serious impact (i.e. immediate, 24-48 hours, one week, other).
Seeing it all
Risk issues need to be addressed comprehensively or even holistically because a set of multifaceted factors shape the risks of critical infrastructure as a whole: Societal, System-related, Technological, Institutional and Natural risk factors:
This reminds me of Helen Peck’s holistic approach towards supply chain risk, where she reconciles supply chain vulnerability, risk and supply chain management with corporate governance, business continuity, national security and emergency planning.
Conclusion
I can only agree with the author when he concludes that
Critical infrastructures deserve increased attention as our societies simply rely on most of their goods and services they are expected to continuously supply. They are subject to fundamental changes in technology and operating environment pushing systems closer to their limits and making them more vulnerable; as a consequence, single failures may develop into serious breakdowns and cascade into dependent systems. To reduce vulnerabilities and better balance social needs, risk governance strategies should be developed including all major actors in the decision-making process and various risk-shaping factors considered important.
This paper is one step closer to developing an approach that fully comprises the complexity and interdependency of critical infrastructures.
References
KROGER, W. (2008). Critical infrastructures at risk: A need for a new conceptual approach and extended analytical tools. Reliability Engineering & System Safety, 93 (12), 1781-1787 DOI: 10.1016/j.ress.2008.03.005
Birchmeier, J. (2007). Systematic assessment of the degree of criticality of infrastructures. Paper presented at ESREL 2007, Stavanger, Norway, 25-27 June 2007. In: T. Aven and J.E. Vinnem (eds.) Risk, Reliability and Societal Safety. London: Taylor & Francis Group.
Author links
- ethz.ch: Wolfgang Kröger
- ethz.ch: Jürg Birchmeier
Links
Downloads
- igrc.org: IGRC Publications
Related
- husdal.com: The security of supply
- husdal.com: Are roads more important than computers?
