I527-290 ESRIF Final Report (WEB).indd - European Commission

2.6.6 Intervention
The evolution of CI and corresponding risks will partially aff ect response forces. In the case of physical CI,
response forces and their linkages mostly exist already. In the case of ICT, intervention forces are rudimentary at
best and security relies on soft- and hardware barriers. The limits of these «static» lines of defence are evident and
necessitate new solutions which warrant both basic as well as applied research into these counter-hacking/-spoofi ng
strategies, methodologies and instruments.
2.6.7 Education and Training
Given the importance of trust for CI security and operations and the knowledge that trust is generated by transparency and
understanding, preventive education and response training should expand not only to security experts and CI
operators, but also to customers and the public at large (for crisis situation training, see WG4 chapter). The theoretical
and practical consequences of empowering European citizens as security stakeholders need foundation level as well as
detailed, programmatic research.
2.6.8 Societal Embeddedness
Critical infrastructures, perhaps more so than any other infrastructure, are vulnerable to insider threats, namely from
personnel and third party individuals with access rights to certain key components that have radicalised and intend to use
their know-how for adverse eff ects. We therefore need more knowledge about radicalisation processes, how to
detect them and how to prevent resulting security breaches.
2.7 Conclusions
Security in the future remains a careful and very specifi c act of balancing prevention, protection and reaction/mitigation. In
some cases, prevention and protection must be emphasised since the consequences of failure would be too dire to accept.
In other cases, where prevention and protection are too diffi cult to implement, the emphasis must be on reactive mitigation
of eff ects, that is, service must be delivered. In both cases, European critical infrastructures 1 that cross international borders
need a higher level of resilience. If ESRIF advocates a «Culture of Resilience» that is understood to be comprehensive, then this
is the result of realism and pragmatism: Crises will occur. Terrorists will exist and strike. Europe will experience fl oods, storms,
droughts and epidemics.
If the work of ESRIF WG2 «Security of Critical Infrastructure» were to be broken down into a few words for national governments,
they would be «prepare yourselves to ensure that nothing can completely put your system out of service». This is why WG2
strongly advocates the concept of resilience: That despite changes in assumptions, measures put in place will be eff ective
(e.g. what helps against bioterrorist release of agents can very well help against a natural pandemic), power and water will
be running to an acceptable standard (e.g. water will be potable), and basic communication will work eff ectively. Societal
resilience is heavily dependent upon certain vital consumables and services being in place, and this is the contribution of WG2
«Security of Critical Infrastructures» to the endorsed concept of «societal resilience».
In the fi nal analysis the security of critical infrastructure requires as full an appreciation of the potential impact of “negative
externalities” as possible. Whether these are deliberate or accidentally generated, strategies, while ideally aiming to prevent
the impacts, must also focus on mitigating the eff ects.
1 European critical infrastructure or ‘ECI’ refers to critical infrastructure located in Member States the disruption or
destruction of which would have a signifi cant impact on at least two Member States. The signifi cance of the impact shall
be assessed in terms of cross-cutting criteria. This includes eff ects resulting from cross-sector dependencies on other
types of infrastructure. EU COM(2008)114
87