Many situationsranging from unintentional short circuits and human errors to intentional hacking and terrorismcan paralyse large critical complex infrastructures (LCCIs) such as electricity networks.
Howevera new EU E7m project has the safe distribution of electricity as its objective.
The Integrated Risk Reduction of Information-based Infrastructure Systems (IRRIIS) projectpart of the EU’s Sixth Framework Programme (FP6)is aimed at deepening the understanding of information security threats to complex and critical infrastructuresparticularly from the perspective of interdependencies. IRRIIS focuses onfor examplepreventing information security threats to the telecommunications systems of European electricity distribution networks. It aims to improve the reliabilitysecurity and dependability of these systems (Fig.1).
IRRIIS runs for three years and involves a consortium of 15 corporate and research partners from different European countries. It is co-ordinated by the Fraunhofer Institute from Germany (see The IRRIIS strategybelow).
The Technical Research Centre of Finland (VTT) is playing an important role in the projectespecially in assessing public and information security threats and risks to LCCIstheir control systemsand their interdependencies.
Such security threats often involve interdependencieswhere the realisation of one threat has a significant effect on the realisation of other threats. “Fuller development of this understanding of interdependencies requires a comprehensive perspective” notes the VTTwho will be drawing together information security researchers from across its different applications and technologies centres.
This information security expertise in different fields is then synthesised into an internationally novelsystematic and comprehensive understanding of critical infrastructures and their environment through effective research coordination. VTT’s key role in the IRRIIS project is based on this strongly interdisciplinary and aggregated perspective.
“The electricity distribution and telecommunications infrastructures that have expanded rapidly over the past several decades are vital to today’s society and their collapse would have serious consequences. Telecommunications technologies play an increasingly pivotal role in the critical technological systems of our liveswhich are more and more interconnected and mutually dependent. The fact that these systems operate across administrative and geographical boundariesin addition to their complexitypresents a major security and maintenance challenge” adds the VTT.
The IRRIIS strategy
According to the Fraunhofer Institute for Autonomous Intelligent Systemsthe IRRIIS project will be carried out under the motto “enhance substantially the dependability of LCCIs by introducing appropriate middleware improved technology (MIT) components”.
The institute goes on to say that IRRIIS will increase dependabilitysurvivability and resilience of EU critical information infrastructures based on information and communication technology (ICT). Its detailed objectives are to:
- Determine a sound set of public and private sector requirements based upon scenario and related data analysis.
- Designdevelopintegrate and test MIT components suitable for preventing and limiting cascading effects and supporting automated recovery and service continuity in critical situations.
- Developintegrateand validate novel and advanced modelling and simulation tools integrated into a synthetic environment (SYNTEX) for experiments and exercises.
- Validate the functions of the MIT components using the SYNTEX environment and the results of the scenario and data analysis.
- Disseminate novel and innovative conceptsresultsand products to other ICT-based critical sectors.
IRRIIS will address the challenges of complex information infrastructure protection (CIIP) by a ‘diagnosis therapy strategy’ and ‘therapy implementation and validation approach’ starting with the electrical power infrastructure and its supporting telecommunication infrastructure.
After thoroughly analysing these infrastructures and their interdependenciesthe synthetic simulation environment will be built. MIT components will be developedtested and validated inside SYNTEX to demonstrate their capabilities before dissemination to potential stakeholders. Importantlythis approach is open for successively including additional critical infrastructures.
Up till nownotes the Institutethere has been a lack of advanced understanding of LCCI dependability and interdependency – particularly with regard to the use of ICT. Although some models and tools dealing with these issues existLCCI complexity and criticality cannot yet be tackled properly. Basic researchit saysis necessary to understand the phenomena of interdependencydynamic behaviour and cascading effects in order to support the development of solutions for protecting and managing existing LCCIs in case of incidents. IRRIIS will perform
in-depth research regarding the topological structure of LCCIs and the interdependencies between different LCCIs.
Then appropriate analytical approaches will be appliedsuch as simulation models or analytical models suitable to investigate interdependencynetwork dynamics and cascading effects.
So starting from a thorough analysis of LCCIsincorporating the stakeholder’s views regarding ICT tools and modelsa sound set of public and private sector requirements can be determined. These requirements will build the basis for the development of the SYNTEX simulation environment and the MIT components needed by the project’s deadline in three year’s time.
"
