Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
providers. On the other hand, network operators can expect improved operational
flexibility and efficiency that in turn minimizes operational expenditures, rapid
service launches, increased customer satisfaction and immediate returns on
investments.
However, the technological advances accompanying these evolutions also
increase the number of ways and instances that an information infrastructure could
be rendered vulnerable. Each one of the added vulnerabilities creates opportunities
for attacks from an infinite number of threats, both known and previously
unknown. For example, the widespread adoption of smartphones and PDAs with
local Bluetooth and Internet connectivity has introduced malwares into the mobile
communications arena, a threat previously synonymous with computer networks
(Hyponnen 2006). 102 The security challenges are considerable as the
interconnectivity and proliferation of devices goes beyond unprecedented levels,
with each device and connection representing a possible security gap. Awareness
of these security challenges is on the rise and some significant research is already
being carried out to address them. 103
As CII becomes increasingly complex, failure prevention can never be total.
Therefore, fault tolerance presents arguably the most effective method for
automatic recovery from failures and their potentially highly disruptive outcomes
(Liotine 2003). Fault tolerant systems are typically designed to detect failures
instantly, avoid single point failures, isolate elements with persistent problems and
enable repairs to be carried out even whilst continuing normal system operations.
It therefore enables network user transactions to continue without any noticeable
loss or interruption. These design objectives are met by providing redundancy,
continuous status monitoring of network elements and automated recovery
mechanisms. The majority of threat scenarios generated for CIIP studies and
planning evoke scenes of destroyed or disabled infrastructure, thus necessitating
methods such as fault tolerance to be designed into the infrastructure (that is,
critical infrastructure protection).
However, the increased decoupling of services and applications from the
underlying infrastructure in future networks creates a new inter-infrastructure
dimension for fault tolerance design, whereby a service or application could be
continuously available by migrating from a damaged infrastructure to a working
one as a way of adapting to a new user context. An example solution is the
proposed Secured Infrastructure Router (SIR) that has multiple interfaces for
connecting to alternative networks as a form of redundancy against failure to any
of the networks (Kari 2007). Such capabilities present a paradigm shift to critical
information protection within the CIIP concept, as it shifts the emphasis to
availability, confidentiality and integrity of user’s information over a particular
service or application, from traditional infrastructure protection. This service or
application level protection mechanisms present significant cost and time
advantages in comparison to preventing attacks by fortifying every node,
102 The number of known mobile malware nonexistent before 2004 has risen sharply to over 200 in
late 2006. This is small when compared to over 200,000 known computer malware. However, with
the number of mobile devices connected to Internet expected to significantly outstrip the number
of PCs, the threat of mobile malware is likely to be a formidable one.
103 See, for example, Calin et al. (2006).
136 NORDREGIO REPORT 2007:5