SECURITY

Critical Infrastructure
Risks for modern
infrastructure
The hazards which operators
of critical infrastructure face
can be categorised as (1) hazards
related to natural
events, (2) hazards from human
error or technical failures
and (3) hazards related to terrorism
and criminal activity.
Some events can also draw in neighbouring
or linked installations and property.
A domino effect resulting for example
from fire spreading from neighbouring
establishments, or from flying debris following
an explosion or even from the failure
of utilities after disasters, can mean
the surrounding area may be damaged
or destroyed too.Multiple events which
take place in a short time frame such as
a second, delayed separate explosion or
several almost simultaneous breakdowns
at different places can under certain circumstances
cause an exponential effect
in which rescue or recovery measures are
prevented or resources are assembled in
the wrong place (diversionary measures).
Risk factors
The following risk factors can cause
disruption of critical infrastructure
Risk factor: human
• lack of security awareness
• insufficient qualified staff
• human error
• criminal behaviour (sabotage, terror
attacks)
Risk factor: organisation
• concentration of vital resources
• outsourcing of infrastructures critical
to the enterprise
Risk factor: nature/environment
• Natural disasters (extreme weather,
earthquakes, wild fires, mass social
movements)
• epidemics
The assumptions applied within a particular
hazard type are based on empirical
knowledge of criminality, but may not
apply absolutely in every case.The question
of who are the likely culprits and
their modus operandi cannot of course
be answered with certainty.Based on experience
of securing operations though
it is possible to produce a rough classification
with perpetrators or groups whose
typical motives and possible behaviour
patterns can be categorised according to
level of danger.Negligent actions are not
considered here, these are registered under
hazards from events resulting from
human error and technical failures.
How far potential culprits can actually
generate serious damage and at what
point it is possible and likely has to be
the subject of a risk assessment in which
the hazards in the locality of the company
are identified (risk management). The types
of hazard contain a series of assumptions
which it should be possible to assign
to the investigated hazard situation.
Essentially these assumptions include:
• possible circumstances of the act,
• possible motives and typical behaviour/procedure,
• probable resources used and
• criminal force to be expected.
Deliberate incorrect operation
This refers to all deliberate acts in which a
disturbance can be generated using one’s
hands and without any further resources.This
kind of act could for example include the
switching on and off of facilities, the opening
or closing of pipe controls (sliders), the turning
of hand wheels and the operation of
levers as part of a process sequence.Deliberate
incorrect operation can be carried out
both by an organisation’s own employees
and by third parties.
Potential impacts
Manipulation means the deliberate changing
or moving of system parts with the
aim of precipitating a critical situation.
Examples of this are:programming controls
wrongly, tampering with measuring
systems, suppressing process, error or
alarm reporting systems or even switching
off of protection systems. Here it is primarily
insiders with precise knowledge
of the installation who come into question
as culprits.
Threats from actions
with criminal intent
For security professionals the following
types of attack on structures are special
risks as they can result in extensive damage.
EURO SECURITY / MES Critical Infrastructure II/14 61