Critical Infrastructure Security and Resilience Cyber Infrastructure November 2023
Dr. Ir. Henk Jan Jansen
Security Tech Enthusiast | Bridging the Gap Between Ideas, Execution & Innovating for a Better Tomorrow
Table of Contents??????
1)??? What is Critical Infrastructure??????????
2)??? What are the “Threats and Hazards” to Critical Infrastructure? ?????
3)??? Who is Responsible for Critical Infrastructure?????????
4)??? What Drives Critical Infrastructure Security and Resilience? ???????????
5)??? Getting Started??????????
6)??? The Risk Management Framework ???
7)??? The Role of Risk Assessments
8)??? Training and Education??????????
9)??? Evaluating the Program?????????
10) Promoting the Program?????????
11) Conclusion?????
What is Critical Infrastructure?
Critical infrastructure includes the assets, systems, facilities, networks, and other elements that society relies upon to maintain national security, economic vitality, and public health and safety. We know critical infrastructure as the power used in homes, the water we drink, the transportation that moves us, the stores where we shop, and the Internet and communications we rely on to maintain our contact with friends, family, and colleagues. This physical and cyber infrastructure is typically owned and operated by the private sector, though some is owned by federal, state, or local governments. Not all infrastructure within an industry sector is critical to a nation or region. It is necessary to identify which infrastructure is both critical to maintain continued services or functions and vulnerable to some type of threat or hazard. Prioritizing the allocation of available resources to that subset of infrastructure can enhance a nation’s security, increase resiliency, and reduce risk.
There are four designated lifeline functions – transportation, water, energy, and communications, which means that their reliable operations are so critical that a disruption or loss of one of these functions will directly affect the security and resilience of critical infrastructure within and across numerous sectors. For example, energy stakeholders provide essential power and fuels to stakeholders in the communication, transportation, and water sectors, and, in return, the energy sector relies on them for fuel delivery (transportation), electricity generation (water for production and cooling), as well as control and operation of infrastructure (communication).
These connections and interdependencies between infrastructure elements and sectors mean that the loss of one or more lifeline function(s) typically has an immediate impact on the operation or mission in multiple sectors. As a result, additional loss of other functions may arise over time. Further, identifying and officially recognizing industry sectors that are lifeline sectors and/or have cross-sector interdependencies facilitates collaboration and information exchange that promotes continuity of operations and services. The choice of sectors prioritized in outreach efforts should reflect an understanding of the infrastructure’s interconnectedness and interdependencies, recognize existing industry associations, and align to government agencies’ roles and oversight responsibilities.
Critical infrastructure encompasses functions in addition to the lifelines. For example, in 2017, in the US Election Infrastructure was designated a subsector of the Government Facilities Sector due to the importance of free and fair democratic elections as a foundation of the American way of life. Working to reduce risk in partnership with the public and private sector entities responsible for providing this kind of critical function is a crucial element of maintaining public confidence in the Nation’s critical infrastructure.
Current Critical Infrastructure Sectors
Chemical????????????????????????????????????????????????????????? Financial Services
Commercial Facilities????????????????????????????????????? Food and Agriculture
Communications???????????????????????????????????????????? Government Facilities
Critical Manufacturing??????????????????????????????????? Healthcare and Public Health
Dams?????????????????????????????????????????????????????????????? ? Information Technology
Defense Industrial Base????????????????????????????????? Nuclear Reactors, Materials, and Waste
Emergency Services??????????????????????????????????????? Transportation Systems
Energy???????????????????????????????????????????????????????????? Water and Wastewater Systems
What are the “Threats and Hazards” to Critical Infrastructure?
Both natural and man-made (deliberate or accidental) incidents have the potential to harm, damage, incapacitate, or destroy critical infrastructure. Rather than focusing on one type of threat or hazard at a time, such as hurricanes or terrorism, States should identify all threats and hazards that pose the greatest risks to critical infrastructure, which allows for more effective and efficient planning and resource allocation.
Critical infrastructure has long been subject to risks associated with physical threats and natural disasters, and is also now increasingly exposed to cyber risks. These risks stem from a growing integration of information and communications technologies with critical infrastructure and adversaries focused on exploiting potential cyber vulnerabilities. As physical infrastructure becomes more reliant on complex cyber systems for operations, critical infrastructure can become more vulnerable to certain cyber threats, including transnational threats.
Connections and interdependencies between infrastructure elements and sectors means that damage, disruption, or destruction to one infrastructure element can cause cascading effects, impacting continued operation of another. Identifying and understanding interdependencies (two-way) or dependencies (one-way) between infrastructure elements and sectors are important for assessing the risks and vulnerabilities and for determining which steps may be taken to increase security and resilience. For example, the electric grid relies on integrated information and communication systems from other critical infrastructure sectors in order to operate. One example of the immediate need for energy is in recovery operations following a
natural disaster. Until the energy system is restored, water and wastewater systems cannot provide clean water, natural gas cannot flow to provide heat, and generation and telecommunications systems quickly become inoperative once backup power sources begin to fail.
Soft Targets and Crowded Places
From cyber to physical security threats, we live in a world where terrorist activity is increasing and becoming more diffuse, where attacks can be either simple and opportunistic in nature or complex and organized. The rising number of attacks against soft targets/crowded places in multiple cities worldwide from EU to Orlando, New Zealand, San Bernardino to Sri Lanka, demonstrates that the nature of the threat is evolving and reinforces the need for global vigilance, preparedness, and collaboration. National and international efforts seek to address the trend toward attacking soft targets and crowded places.
For example, the EU is working domestically with all levels of government to provide training, resources, and materials to enhance and promote soft target and crowded places security.
On the international front, countries are working together to share good practices, lessons learned and experiences on attacks against soft targets and crowded places to help create and advance a global culture of security. The Global Counterterrorism Forum (GCTF) Soft Target Protection Initiative, co-led by the United States and Turkey, involved a series of regional workshops with government and the private sector aimed at raising awareness, increasing preparedness, and creating the first set of non-binding international good practices on soft target protection in a counterterrorism context.
The good practices are meant to inform and guide governments and private industry as they work together to develop policies, practices, guidelines, programs, and approaches in protecting their citizens from terrorist attacks on soft targets and crowded places. Discussions acknowledged that States have the primary responsibility for ensuring security in their territory and protecting their civilians in accordance with the United Nations (UN) Charter. The UN Security Council Resolution 2341 (2017) outlines the role of States on the protection of critical infrastructure and particularly vulnerable targets, such as public places, from terrorist attacks, including through public-private partnerships as appropriate.
Threats and Hazards
Threats and hazards may be specific to geographic regions, or across an entire country, and may even have global ramifications; such as:
These threats and hazards must be analyzed to determine their potential impacts on infrastructure and how likely they are to occur.
Managing Cross-Sector Risk to Critical Infrastructure
In April 2021, Cybersecurity and Infrastructure Security Agency (CISA) released the first-ever set of 55 National Critical Functions to more effectively manage the most strategic risks to the nation. National Critical Functions are the functions of government and the private sector so vital to the EU & United States that their disruption, corruption, or dysfunction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. The functions were developed in coordination with sector and state, local, tribal and territorial partners, and enable the critical infrastructure community to analyze complex challenges that cannot be easily identified, understood, or examined within the existing risk management structures for cyber and physical infrastructure.
Effective risk management depends on the critical infrastructure community’s ability to engage across sectors to facilitate a shared understanding of risk and integrate a wide range of activities to manage risk. As a framework, the National Critical Functions captures cross-cutting, cross-sector risks and associated dependences that may have cascading impacts within and across sectors. By identifying what is truly critical at the functional level and where key dependencies and interdependencies lie, CISA can identify pockets of risk that are deemed unacceptable to the nation. This approach will allow CISA to more effectively capture risks to supply chain security and resilience, such as the introduction of counterfeit parts and components or the unique challenges of lean processes and just-in-time practices. The National Critical Functions framework also allows CISA to more effectively assess major cybersecurity issues, such as attacks conducted to steal intellectual property, or the abuse of control systems that could lead to physical damage, personnel hazards, and interrupted operations. The functional approach also highlights the systemic challenges of workforce development in the face of rapid technology growth. Finally, the National Critical Functions signal a recognition that technology is driving a need for coordination and collaboration that builds on the legacy successes of the sector approach, allowing for cross-industry engagement around complex challenges like vulnerabilities associated with position, navigation, and timing systems.
?
Who is Responsible for Critical Infrastructure?
Strengthening the security and resilience of critical infrastructure is a shared responsibility between stakeholders — the critical infrastructure owners and operators, and the various government entities and non-government organizations (including industry associations).
Roles and responsibilities for maintaining or improving the security and resilience of infrastructure vary widely and are affected by many factors such as:
Industry associations often play a key role in recommending practices, while in other sectors there may be regulations that require certain actions — or both may apply. Some sectors have statewide or national design standards that help protect against damage from events like fires, floods, and earthquakes. Insurance providers may also impose security requirements on their policyholders in some sectors. The chemical sector for instance, promotes preparedness through a voluntary framework between industry and government, and is partially subject to regulatory programs.
Response efforts may be driven by first responders, owners/operators, or regional and federal resources, but responsibility for recovery in a predominately voluntary system, such as in generally falls to the owners and operators who know the infrastructure best.
Engagement at all levels of government and industry fosters mutual understanding and trust, and promotes information sharing and practical exchanges. Engagements that promote planning, prioritization of resources, exercises, and training greatly contribute to the success of national preparedness efforts and, especially, effective and timely responses. Such engagements also galvanize support for joint public-private efforts.
?
Case Study - Information Sharing and Analysis Centers
Information Sharing and Analysis Centers (ISACs) help critical infrastructure owners and operators protect their facilities, personnel and customers from cyber and physical security threats and other hazards. ISACs collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency. ISACs are trusted entities established by critical infrastructure owners and operators to foster information sharing and best practices about physical and cyber threats and mitigation. The concept of ISACs was introduced and promulgated pursuant to Presidential Decision Directive-63 (PDD-63), signed in 1998. Some ISACs formed as early as 1999, and most have been in existence for at least ten years. Typically, nonprofit organizations, ISACs reach deep into their sectors, communicating critical information far and wide and maintaining sector-wide situational awareness.
The Real Estate Information Sharing and Analysis Center (RE-ISAC) serves as an excellent example of this information sharing construct. The RE-ISAC a public-private information sharing partnership between the Commercial Facilities Sector and federal security officials organized and managed by The Real Estate Roundtable (non-profit public policy organization based in Washington, DC). The Commercial Facilities Sector is an integral part of critical infrastructure and includes a vast range of sites where people live, work, shop and play. The RE-ISAC is the designated sector-specific conduit for sharing information about potential physical and cyber security threats and vulnerabilities to help protect commercial facilities and the people who use them. By bringing together industry representatives to aggregate, share and assess information, the quality, relevance, and overall value of the resulting information increases exponentially. As a result, the RE-ISAC and its members are able to achieve objectives that no single industry organization could accomplish alone. This benefits the industry, government and the nation as a whole.
Voluntary and Regulatory Approaches
Infrastructure security and resilience programs can be voluntary, regulatory, or a combination of both. In the EU, voluntary programs are most common.
What Drives Critical Infrastructure Security and Resilience?
Security may be defined as reducing the risk to critical infrastructure from intrusions, attacks, or the effects of natural or man-made disasters, through the application of physical means or defensive cyber measures.
?Resilience may be defined as the ability to prepare for and adapt to changing conditions. This means being able to withstand and recover rapidly from disruptions, deliberate attacks, accidents, or naturally-occurring threats or incidents. Resilient infrastructure must also be robust, agile, and adaptable.
?A strong critical infrastructure security and resilience program is based on collaboration and information sharing.
Collaboration is facilitated by establishing the structures and processes necessary for government(s) and the private sector to communicate freely without releasing proprietary information or providing unfair advantage; support a trusted information sharing environment where stakeholders share information to strengthen security and resilience; and ensure relevant stakeholders are fairly represented and engaged, from all levels of government, industry, emergency management, and security.
?Successful information sharing requires established mechanisms or channels to reach stakeholders regularly, as well as before, during, and after an incident. Sharing information can take many forms, including training events, briefings, email alerts, conference calls, or meetings in secure locations to discuss classified materials about specific threats or hazards, and documents and forums that encourage sharing lessons learned. The latter category improves the planning for handling future events.
To facilitate voluntary collaboration and information sharing within and across critical infrastructure sectors and government agencies (federal, state, local, tribal, and territorial), established a formal partnership framework comprised of government and private sector coordinating councils that meet separately as well as jointly to enhance critical infrastructure security and resilience. Private sector information sharing is conducted through Information Sharing and Analysis Centers (ISACs). ISACs primarily operate through a sector-based model, meaning that organizations within a certain critical infrastructure sector (or a specific segment within a sector) join together to share information. Although many of these groups are already essential drivers of effective information sharing, some organizations do not fit neatly within an established sector or have unique needs. also has industry collaborative Information Sharing and Analysis Organizations (ISAOs). Created to gather, analyze, and disseminate cyber threat information, ISAOs offer a more flexible approach to self-organized information sharing activities amongst specific communities of interest (for example, small businesses across sectors such as legal, accounting, and consulting firms that support cross-sector clients).
领英推荐
Information Sharing
The following can help facilitate and support information sharing efforts:
Getting Started
Developing a critical infrastructure security and resilience program starts by establishing goals and objectives; these may be at a national, regional, local, sector, or organizational level. Vision and mission statements may also be helpful to share the view of what the program seeks to accomplish. The steps identified in the following page are generally documented in a critical infrastructure security and resilience plan. To keep the effort moving and to ensure plans are not sidelined by other priorities, having specific deadlines and milestones is important.
In some EU countries, a top-down or national framework may be useful to guide and unify efforts, including those between government and industry. However, in other countries, it may be more common for states, provinces, regions, or similar entities to organize and oversee security, emergency management, and preparedness efforts.
A critical infrastructure security and resilience program should reflect the existing operational environment, and cultural values/ beliefs, and build upon existing relationships, efforts, and policies. It should align with and support other programs so that resources are effectively utilized, existing capabilities and communities leveraged, and roles and responsibilities are understood.
Determining the scope of the effort is also important when starting out. Some questions to answer include: whether to identify a few lifeline sectors or a larger group of infrastructure sectors? Public and private infrastructure, or just one of these to start? Will there be any funding for the establishment of the program, or will there be a government directive to get work underway?
Are all threats and hazards to be included (recommended) or just selected ones? The more comprehensive and integrated the scope, the greater the preparedness benefits that can be realized on an ongoing basis.
Other initial questions to ask relate to identifying stakeholders — which agencies, associations, infrastructure owners and operators, and other stakeholders should be involved? Experience suggests that broad-based participation is key to the successful development and implementation of a comprehensive program to promote continuous improvement in security and resilience.
Identifying the roles and responsibilities of different stakeholders at the beginning can help align and even combine relevant expertise/disciplines, focus efforts, ensure that timelines are met, and provide the desired inputs for an effective program.
Similarly, identifying existing programs or efforts that relate to infrastructure security and resilience can help anchor the development of an overall program and serve as a guide to other sectors. Consider if there are airport screening projects or water and energy security efforts underway or already in place that can serve as examples.
Collaboration and information sharing across the critical infrastructure community are fundamental to the overall process. Establishing mechanisms that foster open collaboration and ensure the exchange of timely and actionable information as well as best practices will help gain participation in the program — both as the program is designed and developed and when it is implemented. Collaborative partnerships enable more effective and efficient risk management. Consider the need for these mechanisms and partnerships at each level of organization or governance, for example, within and across sectors, within and across government, and within and across the private sector.
?
Basic Steps for a Critical Infrastructure Security and Resilience Plan
Once you make your plan, be sure to exercise it regularly. Doing so will ensure that, if there is a real-life incident, everyone will know their role and what to do.
The Risk Management Framework
Risk is the potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by its likelihood — a function of threats and vulnerabilities — and the associated consequences. Risk management is the process of identifying, analyzing, and communicating risk and accepting, avoiding, transferring, or controlling it to an acceptable level at an acceptable cost.
Risk management focuses resources on those threats and hazards that are most likely to cause significant, unwanted outcomes to a specific infrastructure or sector and informs actions designed to prevent or mitigate the effects of those incidents. It also increases security and strengthens resilience by identifying and prioritizing actions to ensure continuity of essential functions and services and support enhanced response and restoration. Risk management facilitates decision making and the setting of priorities across all stakeholders.
A risk management framework sets out an approach to consistently:
The risk management framework can be applicable to all levels of government or private sector organizations. It should cover all threats and hazards and varying factors across critical infrastructure sectors, in addition to individual assets and systems.
The current Critical Infrastructure Risk Management Framework is provided below and described in the National Infrastructure Protection Plan (NIPP) 2023.
Critical Infrastructure Risk Management Framework
Risk Management Tenets
1)??? Risk should be identified and managed in a coordinated way within the critical infrastructure community to enable effective resource allocation.
2)??? Critical infrastructure partnerships can greatly improve understanding of evolving risk to both cyber and physical systems and assets, and can offer data and perspectives from various stakeholders.
3)??? Understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing overall critical infrastructure security and resilience.
4)??? Gaining knowledge of and reducing infrastructure risk requires information sharing across all levels of the critical infrastructure community.
5)??? A partnership approach, involving public and private stakeholders, recognizes the unique perspectives and comparative advantages of the diverse critical infrastructure community. For example, Emergency Support Function 14 of the National Response Framework supports the coordination of cross-sector operations, including stabilization of key supply chains and Community Lifelines, among infrastructure owners and operators, businesses, and their government partners.
6)??? Regional, state, and local partnerships are crucial to developing shared perspectives on gaps and improvement actions.
7)??? Critical infrastructure transcends national boundaries, requiring bilateral, regional, and international collaboration; capacity building; mutual assistance; and other cooperative agreements. For example, the EU Action Plan for Critical Infrastructure sets the foundation for cross-border critical infrastructure security and resilience efforts between the two countries.
8)??? Security and resilience should be considered during the design of infrastructure elements.
The Role of Risk Assessments
A range of methodologies are available to assess threats and hazards and to guide the development of risk management programs. Assessments help government officials and owners and operators to understand potential incidents and how they could affect infrastructure and communities.
Risk assessments give decision makers better information to determine which mitigation and risk management measures are most critical and to understand where different types of actions are most suitable. The range of available measures includes: coordination with other stakeholders; provision of additional response or recovery equipment; modifications to infrastructure design; restrictions on operations; hiring and training of staff; among others. Risk assessments also keep the focus from automatically defaulting to rare or worst-case events with extreme consequences, promoting consideration of a range of more likely events, even if they have somewhat lesser, but still significant, consequences.
The objective is to perform accurate and comprehensive assessments that individually or collectively cover threat, vulnerability, and consequence (also known as hazard, frequency, and consequence for non-threat-based risks). The type of assessment may be determined by international standards, industry best practices, or available historical data. As cybersecurity is a key concern for ensuring the resilience of critical infrastructure, a comprehensive understanding of security and resilience involves considerations of both physical and cyber domains in a holistic fashion. Assessments, therefore, should involve experts from both the physical and cybersecurity domains of critical infrastructure. Analyzing dependencies and interdependencies as a part of risk assessments (at international, national, regional, and/or local levels) can further inform planning and facilitate prioritization of resources to ensure the continuity of critical services and mitigate the cascading impacts of incidents that do occur. Modeling and simulation may be an important part of analyzing complex systems and interdependencies. In the, non- governmental entities (academics, associations, etc.) also develop and disseminate products regarding threats, vulnerabilities, and potential consequences to broader audiences.
Performing a risk assessment on an infrastructure element can require a significant expenditure of resources by owners/operators or others which may not be justified in all cases. To determine the scale of the assessment, many risk assessment methodologies suggest that some type of screening – typically a consequence screen to see if potential impacts are significant or not – be performed first. This helps minimize the resources devoted to full risk assessments. In the government offers expert guidance and assistance through protective security advisors deployed across the country and provides tools to assist owners and operators in conducting assessments and to help in managing cost.
A full risk assessment may be justified for all or most critical infrastructure elements in certain areas where the potential consequences associated with disruption, destruction, or exploitation are especially high. In these limited cases, a screening process is not necessary as all of the assets would “screen in.” A screening process is recommended for all other infrastructure to help lower the demands on those elements that may not warrant a full assessment. As an example, screening-level assessments may be sufficient for most infrastructure in rural areas, while large metropolitan areas may warrant full risk assessments for a number of infrastructure elements.
Sharing the results of assessments among critical infrastructure stakeholders will provide a greater understanding of the probability, impact, and related consequences of various threats and hazards.
Communicating the assessment results can guide planning and resource allocation and expenditures for relevant stakeholders. In addition, conveying the risk will inform preparedness, mitigation and response efforts undertaken by owners, operators, and government officials.
Informing Catastrophic Earthquake Preparedness
A magnitude 9.0 Cascadia Subduction Zone earthquake will have a broad, regional impact area that extends more than 700 miles from British Columbia to Northern California. Direct seismic forces, ground failure, and tsunami flooding will extensively damage much of the region’s infrastructure at a systemic level. In many cases, these systems are likely to be rendered unusable immediately after the initial earthquake. Such extensive damage to western Washington’s infrastructure will place significant demand on the government and private-sector response to provide basic commodities and relief supplies into the region to sustain disaster survivors. Understanding with greater clarity the scope, scale, and degree of a CSZ earthquake on critical infrastructure assets and systems while accounting for system level resilience attributes is then a vital step in informing disaster response and recovery plans and pre-disaster mitigation efforts. In support of such Federal, state, and local CSZ preparedness efforts, the CISA Regional Resiliency Assessment Program (RRAP) has undertaken three collaborative regional resilience assessment projects focusing on regional transportation systems—including road, rail, bridge, maritime, and aviation modes—and water supply.??????????? To date, these efforts have:
Most importantly, the collaborative nature of these efforts has brought together and fostered even greater cooperation between Federal, state, and local agencies and the private sector on these critically-important issues in which each has a distinct but essential role. This important work is directly influencing disaster planning and readiness, improving the resilience of critical
infrastructure and, with it, the resilience of communities in these states.
Training and Education
Training and education are fundamental to the success of a critical infrastructure security and resilience program and must reach government officials, infrastructure owners and operators, first responders, and the public, where appropriate.
Training should be available in many different forms to ensure the broadest reach, including instructor-led courses, webinars, web-based independent study courses, and written guidance and job aids. Training offerings may be on general concepts, best practices, or very specific topics. The sidebar below illustrates the range of topics currently offered by other infrastructure partners.
Practice reinforces training and education and helps achieve the greatest benefit from the time and resources expended. Exercises provide this kind of practice in a practical way that includes discussing or simulating the unwanted kinds of events that may involve critical infrastructure. There are many different types of exercises, including: discussion-based workshops or seminars; facilitated discussions with multiple agencies and infrastructure operators about a specific scenario (known as a tabletop exercise); drills of specific plans or activities; simulated events (functional exercises); and actual responses to artificial events (known as full-scale exercises).
An additional benefit of training and education efforts is building relationships among the stakeholders, particularly in practical exercises. Developing greater trust and understanding within a sector facilitates a more effective response in times of crisis. A disaster recovery test should be considered during the training.
Creating a culture of continuous improvement in infrastructure security and resilience also requires increasing the exposure to fundamental concepts in certain college or university curricula as well. The purpose of academic programs may be to: train students on the use of assessment techniques; make engineers more aware of ways to protect infrastructure elements, reduce their vulnerabilities, or make them more resilient by design; inform planners on the importance of advance planning, information sharing, and partnerships; help emergency managers understand the potential impacts of cascading failures; among other factors.
Evaluating the Program
Once you have set up a program to assess and address threats to critical infrastructure, it is a good practice to periodically evaluate that program. A key challenge in evaluation is measuring critical infrastructure security and resilience programs because of the breadth and diversity of a program’s infrastructure—across numerous sectors, levels of government, and types of owners and operators.
There are two competing imperatives:
?A hybrid of metrics common to all industry sectors and those metrics tailored to each element within a sector may help address the competing imperatives. Performance measures should address process-based outputs (such as numbers of assessments or activities) and outcomes (such as reductions in risk or improvements in resilience) and should evaluate progress towards goals and objectives. Routine reporting of performance should be outlined to document the critical infrastructure security and resilience program, as well as to determine appropriate adjustments.
Similarly, data collection processes, systems, and tools as well as analytic approaches must be identified. This can be difficult if the overall critical infrastructure security and resilience program is voluntary and data is considered proprietary by the infrastructure owners and operators. It may be helpful to coordinate with overseeing government agencies, particularly those that already collect information on the operational performance of specific sectors as they may have resolved some of the collection barriers, at least at a high level.
Value Proposition/Business Case
Promoting the Program
Critical infrastructure security and resilience impacts everyone. While not all stakeholders are engaged in the more detailed elements of the program, they still need a high-level understanding of the risks so they have adequate information and greater confidence in their decisions regarding risk mitigation and management activities — especially those that may require changes in their daily operations and lives.
Stakeholders may include individual companies, the general public, local governments, and many others. To reach these diverse audiences, marketing campaigns such as the “See Something, Say Something” effort in the United States may be useful. This effort has successfully reached beyond infrastructure partners to involve the whole community and increase their situational awareness. Other outreach and awareness efforts may draw on existing communications channels used by industry associations and trade groups.
Communication Channels
Conclusion
Critical infrastructure is the foundation on which daily vital societal and economic functions depend, and disruption or loss to any element of critical infrastructure has the potential to severely impact our lives. Working together and sharing good practices, approaches, and experiences will help promote and enhance national – and global – critical infrastructure security and resilience today and in the future.
Security Tech Enthusiast | Bridging the Gap Between Ideas, Execution & Innovating for a Better Tomorrow
1 年Question for you: Do you know any company who is planning a disaster recovery test yearly. Disaster recovery testing is?the process to ensure that an organization can restore data and applications and continue operations after an interruption of its services, critical IT failure or complete disruption. It is necessary to document this process and review it from time to time with their clients. So, I am wondering myself why there is such a lack from companies to maintain this? In my next upcoming article I will closer going closer in to this subject. ??