syssec_red_book

6 Critical Infrastructure SecurityGreater in size than anything build so far, current critical infrastructures(CI) refer to systems or assets that are vital in modern society andeconomy. Water supply, electricity, transportation, financial services,health care and telecommunication are the most common examples of CIs. CIsare regulated by different rules and laws, and operated diversely from countryto country. In addition, CIs are influenced by non-technological factors such aspolitics or culture. According to the EU Directive 2008/114/EC [63], a CI is“an asset [...] which is essential for the maintenance of vital societalfunctions, health, safety, security, economic or social well-being ofpeople, and the disruption or destruction of which would have asignificant impact [...] as a result of the failure to maintain thosefunctions.”Thanks to the evolution of information and telecommunication technology,controlling CIs remotely (e.g., over the Internet) is feasible and, more importantly,convenient. Therefore, CI actors (e.g., industries and governments)have been progressively incorporating IT systems to consolidate the operationof CIs, up to the point that CIs and IT systems have converged. The termcyber-physical system (CPS) is commonly used in this context to refer to theintegration of a physical (critical) system with a cyber (Internet-connected)system, which is typically an industrial control system (ICS). In the remainderof this section, we will use the term CI to refer to the critical infrastructure as apart of the physical environment, and the term CPS to refer to the systems thatcomprise and interconnect these infrastructures, thus including IT components(i.e., the ICSs).Security issues arise because two previously isolated worlds, the Internetand the CI systems, are now interconnected. When early CIs were created, neithersecurity nor misuse of the interconnected control system were considered.As a matter of fact, Internet technology is itself an underlying, critical assetof modern CIs, because the ICSs that control them are often distributed (overremote, Internet-connected locations).This section highlights the most relevant security problems and the state ofthe art of CPSs, with a particular emphasis on the ICS part.