Critical Infrastructure Interdependencies H. Scott Matthews March 30, 2004

Recap of Last Lecture  Threats/Vulnerabilities/Risks  Risk Assessment and Management  Changing place of infrastructure in national policy / defense strategy  National priorities related to protecting infrastructure/etc from terrorist attacks (security, not reliability, etc).

Effects of Attacks  Direct - loss of service  Attack on a critical node, system, function  E.g. bridge  Indirect  Attack leads to behavioral/psychological  Exploitation  Using one to destroy another  May involve interdependencies

Nth-order Effects

Interdependencies  A new emphasis on critical infrastructures  PDD-63 in 1998 after Oklahoma City  Generally worried about hackers  Use of digital assets to disrupt physical assets suggests interdependency  There are many non-hacking interdependencies  Everyday/natural events can exploit them too  Galaxy 4 satellite failure (lost pagers) - single satellite responsible for 90% of users  California blackouts (2001) - cut off other energy  Almost everything we do depends on “infrastructure”  All infrastructure depends highly on others

Definition of Infrastructure Sectors - PCCIP Report  Telecommunications, electric power systems, natural gas and oil, banking and finance, transportation, water supply systems, government services, and emergency services.  This is a narrow definition (food also?)

Key Questions  How to balance needs for better service/ quality with the systems created to do so?  What tools can be used to predict?  How can everyday operation be balanced with security/other vulnerability concerns?  What are performance measures?  Who are stakeholders?  How to deal with risk and uncertainty?  What are the frameworks for analysis?

Complex Adaptive Systems (CAS)  Collective, systemic behavior is emergent  i.e., follows patterns that result from, but not predictable from, nonlinear interactions with a large number of subsystems  Capabilities change over time  Components influenced by past experiences  System is greater than the sum of its parts  Defined at high levels  May be possible to model/ manage/ understand via agent-based systems  Software systems where simple decision rules are followed and tracked via information given to them

Other Issues  Centralized control (e.g. through info. Systems) lead to weakest link issues  Blackout of 2003 (again)  Resource sharing (e.g. water)

Six Dimensions of Infras. Interdependencies (Rinaldi)  They include the technical, economic, business, social/political, legal/regulatory, public policy, health & safety, and security concerns that affect infrastructure operations.  (Infrastructure) environment  Coupling / Response behavior  Failure types  Infrastructure characteristics  State of Operation  Types of Interdependencies

Types of Interdependencies  Physical - output is dependent on other  E.g. coal by rail to power plants  Cyber - depends on info. transfer  Banking/ATM systems use wired networks  Geographical - location/environmental factors  Co-located or nearby sites (power plant near steel factory)  Logical - states interdependent (“other”)  Linked through financial markets (buy/sell)

Dependent System Unidirectional: Supported and supporting infrastructures

Interdependency  Bi-directional  “The connections among agents in different infrastructures in a general system of systems.”  Interdependencies dramatically increase the overall complexity of the “system of systems

Interdependency Diagrams Production, Cooling, Emissions Reduction Water for Power for Compressors, Storage, Control Systems Fuel for Generators Power for Pump and Lift Stations, Control Systems Power for Switches Water for Cooling, Emissions Reduction Heat Power for Pumping Stations, Storage, Control Systems Fuel for Generators, Lubricants SCADA, Communications SCADA, Communications SCADA, Communications SCADA, Communications Fuels, Lubricants SCADA, Communications Water for Cooling Fuel Transport, Shipping Fuel Transport, Shipping Shipping Power for Signaling, Switches Fuel for Generators Water for Production, Cooling, Emissions Reduction Water Transpor- tation Oil Telecom Natural Gas Electric Power

Use Insights for CI Sectors Outputs in $millions

Top Sectors Dependent on CI

Top Sectors With Highest % CI Average across All sectors is 11%