CRITICAL INFRASTRUCTURES. Critical Infrastructures (hereafter CI) are comprised of a set of complex systems, in other words, CI is a system of systems targeted to deliver essential services and products for citizens. According to the European Council Directive 2oo8/114/EC “Critical infrastructure (CI) means an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of the failure to maintain those functions (Lazari, 2o14) This directive establishes sectors and subsectors for the CI at European level: Sector Subsector I Energy 1. Electricity: Infrastructures and facilities for generation and transmission of energy in respect of electricity supply. 2. Oil: production, refining, treatment, storage and transmission by pipelines 3. Gas: production, refining, treatment, storage and transmission by pipelines, LNG terminals II Transport 4. Road transport 5. Rail transport 6. Air transport 7. Inland waterways transport 8. Ocean and short-sea shipping and ports Table 2 – Sectors and subsector in CI according to Xxxxx X (EU2008) Reviewing the papers, reports, etc. on Threat Landscape in Critical Infrastructure, one of the most relevant sources is found in ENISA (2o13). Deliberate physical attacks Unintentional data damage Failures, malfunction Eavesdropping, Interception, Hijacking Legal Although the scope of the report is for Smart Grids, the threat classification is totally applicable for CI in general. Below, the threats will be explained in detail to outline the threats landscape in CI protection: Natural Disaster Damage, Loss of IT assets Outages Nefarious, activity, abuse Threats Figure 2 - Threat Landscape for Smart Grids according to (ENISA, 2013) • Threat Group: Loss/Damage o Threat: Loss of devices, media and documents o Threat: Information Leakage • Threat Group: Eavesdropping, Interception, Hijacking o Threat: Interfering radiation o Threat: Man in the middle, session hijacking o Threat: Interception of information o Threat: Network reconnaissance and information gathering o Threat: Replay of messages • Threat Group: Failures/Malfunction o Threat: Failure of devices and systems o Threat: Failure or disruption of communication links (communication networks) • Threat Group: Nefarious Activity/Abuse o Threat: Unsolicited e-mail o Threat: Denial of S...
CRITICAL INFRASTRUCTURES. Every citizen relies on public utilities such as energy, natural gas and water supplies and distribution to carry out daily activities. Electric blackouts, disruption of oil, gas or water supply, interruption of transportation (trains, metro, and traffic control) can cause consistent problems to governments and citizens. Unfortunately, these utilities are extremely vulnerable to cyber-attacks, hence they are within easy reach of cyber attackers and cyber terrorists. Clearly, there is a direct connection between utilities vulnerabilities to cyber-attacks and the society vulnerability to cyberterrorism. Cyber-terrorist, indeed, may target one of these vital infrastructures to hit governments or citizens. Concerns about an attack against national utilities are high. According to Xxxxxxxxx (2o12) “each country needs to make a very serious audit of the critical infrastructure within its borders”. In addition, he pointed at the power network as the most critical of all (nothing can work without power) followed by telecommunications, financial services and transportation5. Nowadays, utility companies need to reduce the cost of running their core operations. This objective is achieved primarily by increasing industrial process automation, thus minimizing the human impact on those costs. The widespread use of automation systems and the establishment of new interconnections that were simply not there in the past, have exposed implications concerning the availability of the assets. This in turn impacts the security and safety of the processes. Software and component vendors have introduced an additional worsening factor for security. They have begun to include in their products COTS (Commercial Off The Shelf) in order to improve interoperability among utility networks and lower their development costs. As a result, critical systems now run on common software platforms (such as Windows) for which vulnerabilities are regularly discovered. Attackers can leverage those vulnerabilities to gain access to critical systems and alter critical operations. Facing the emerging problem of the large diffusion of advanced threats targeting objectives to disrupt critical services such as those provided by utility companies represent an urgent need that has to be addressed. Because of the impact that a disruption of the utility services would have on citizens, they have been classified as CI. Protecting utilities from advanced threats is thus crucial and has been constantly ranked hi...
