Search

In recent times, security and safety are, at least, conducted in safety-sensitive or critical sectors. Nevertheless, both processes do not commonly analyze the impact of security risks on safety. Several scholars are focused on integrating safety and security risk assessments, using different methodologies and tools in critical infrastructures (CIs). Bayesian networks (BN) and graph theory (GT) have received much attention from academia and industries to incorporate security and safety features for different CI applications. Hence, this study aims to conduct a systematic literature review (SLR) for co-engineering safety and security using BN or GT. In this SLR, the preferred reporting items for systematic reviews and meta-analyses recommendations (PRISMA) are followed. Initially, 2295 records (acquired between 2011 and 2020) were identified for screening purposes. Later on, 240 articles were processed to check eligibility criteria. Overall, this study includes 64 papers, after examining the pre-defined criteria and guidelines. Further, the included studies were compared, regarding the number of required nodes for system development, applied data sources, research outcomes, threat actors, performance verification mechanisms, implementation scenarios, applicability and functionality, application sectors, advantages, and disadvantages for combining safety, and security measures, based on GT and BN. The findings of this SLR suggest that BN and GT are used widely for risk and failure management in several domains. The highly focused sectors include studies of the maritime industry (14%), vehicle transportation (13%), railway (13%), nuclear (6%), chemical industry (6%), gas and pipelines (5%), smart grid (5%), network security (5%), air transportation (3%), public sector (3%), and cyber-physical systems (3%). It is also observed that 80% of the included studies use BN models to incorporate safety and security concerns, whereas 15% and 5% for GT approaches and joint GT and BN methodologies, respectively. Additionally, 31% of identified studies verified that the developed approaches used real-time implementation, whereas simulation or preliminary analysis were presented for the remaining methods. Finally, the main research limitations, concluding remarks and future research directions, are presented

Critical infrastructure (CI) is an integrated set of systems and assets that are essential to ensure the functioning of a nation, including its economy, the public's health and/or safety. Hence, protecting critical infrastructures (CI) is vital because of the potential severe consequences that may emerge at the national level. Many CIs are now controlled by software, and likewise, software is often the major source of many security problems in critical infrastructures. Software security management in CIs has been addressed in the literature and several useful approaches have been provided. Yet, these approaches are fragmented over multiple different studies, often do not explicitly relate to CIs, and a synthesized overview of the state-of-the-art on software security in CIs is lacking. To this end, this article presents the results of a systematic literature review (SLR) that identifies and synthesizes how software security has been addressed in CIs. This study identifies and synthesizes the current approaches applied for security management in critical systems in terms of identified security threats, adopted solutions, CI domains, and evaluation approaches. Hereby 32 primary studies were retrieved from electronic databases to respond to the research questions defined in this study. Based on the outcome of the SLR the reported approaches are discussed, and a roadmap is described for security management in CIs. The results of the SLR identify the current open challenges and pave the way for further research. In addition, practitioners can benefit from the best practices in the security management of CIs. [ABSTRACT FROM AUTHOR]

This paper considers terrorism as potentially ‘intelligent’, as a threat capable of abusing the critical infrastructures of societies and the related methods for knowledge production. Respectively, it sees critical infrastructures as attractive mediums for terrorist influence. The paper describes the contrast between the logic of providing security and certainty for critical infrastructures and the threat of terrorism, which is evolving in terms of its systemic capacities and intelligence. The way security is provided within critical infrastructures and the way intelligent terrorism could operate seem to separate from each other, thereby creating vulnerability. The paper seeks to enhance the conceptual understanding of this question by describing and closing the gap created by the intellectual separation. By doing so, the article will shed light on the conceptual dimension of the (in)security that has gone unnoticed in the interface between critical infrastructures and terrorism. It outlines the aforementioned dilemma and provides conceptual understanding that makes it easier to grasp and communicate further. The paper shows that the intellectual separation has weakened the possibilities for theoretically understanding and practically recognising terrorism as a phenomenon that is becoming systemically more conscious, more intelligent and potentially increasingly capable in a form of violence that exploits the basic structures of societies and the related knowledge methods for its own purposes. As a conclusion, the paper stresses the importance of profoundly critical tools. Such tools are often perceived as being undesirable or even counter-productive in figuring out the mechanism through the very means utilised in providing for security. [ABSTRACT FROM AUTHOR]

The objective of this work has been to propose a framework that will aid governments with the development of more coherent and effective infrastructure planning and resilience policies through a system-of-systems approach that is grounded in theory for complex sociotechnical systems. The framework has been developed by using a work domain analysis (WDA). The WDA consists of an abstraction hierarchy analysis and a part-whole decomposition. Together, the abstraction hierarchy and the part-whole description form the abstraction-decomposition space (ADS) for which the system constraints apply. By imposing constraints, the WDA promotes design for adaptation where actors within the system are allowed to adapt their behaviour as they find appropriate without violating the system’s constraints. The proposed ADS consists of five levels of abstraction and four levels of decomposition. By applying the ADS, it will aid decision making related to the overall purposes of the critical infrastructure system, the values and priority measures that are used to assess the system’s progress towards the functional purposes, as well as formulation of infrastructure needs that are necessary to achieve the functional purposes. The framework is formative in the sense that it reveals how work can be done in the critical infrastructure system. This is important because it is not feasible to prescribe, describe and risk assess all possibilities for action that are available in complex sociotechnical systems, especially when dealing with unforeseen events. Future research should focus on finding science-based yet useful in practice ways for establishing values and priority measures that encompass sustainability issues and resilience standards. [ABSTRACT FROM AUTHOR]

Over the years, the digitization of all aspects of life in modern societies is considered an acquired advantage. However, like the terrestrial world, the digital world is not perfect and many dangers and threats are present. In the present work, we conduct a systematic review on the methods of network detection and cyber attacks that can take place in a critical infrastructure. As is shown, the implementation of a system that learns from the system behavior (machine learning), on multiple levels and spots any diversity, is one of the most effective solutions.

Abstract Adequate sanitation is one of the most important aspects of community well-being. It reduces the rates of morbidity and severity of various diseases like diarrhea, dysentery, and typhoid among others. A study about toward the attainment of the recommended Humanitarian Sphere Standards on sanitation in Bidibidi refugee camp, Yumbe District, was initiated. A total of 210 households distributed in Bidibidi refugee camp were randomly selected and one adult person interviewed to assess the accessibility of different sanitation facilities, and to explore the sanitation standards of the sanitation facilities in relation to the recommended Humanitarian Sphere Standards in the area. Pit latrines, hand washing facilities, and solid waste disposal areas as reported by 81.4%, 86.7%, and 51.9% of the respondents respectively, are the main sanitation facilities accessed in the refugee camp. Despite their accessibility, the standards of the pit latrines, hand washing, and solid waste disposal facilities are below the recommended standards, which might have contributed to the outbreak of sanitation related diseases (χ2 = 19.66, df = 1, P = 0.05) in Bidibidi refugee camp. The respondents in the study area were aware that the presence of the sanitation-related diseases was because of the low-level sanitation practices in place (χ2 = 4.54, df = 1, P = 0.05). The inaccessibility to some sanitation facilities by some respondents was found to be related to their low level of education (χ2 = 130.37, df = 1, P = 0.05). This implies that the sanitation facilities in Bidibidi refugee camp need to be redesigned and improved especially the pit latrines and the solid waste disposal facilities in order to meet the minimum Humanitarian Sphere Standards. Also, there should be more provision of taps with flowing water in the camp for effective washing practices to minimize the spread of sanitation-related diseases.

Cyber-physical systems (CPSes) are rapidly evolving in critical infrastructure (CI) domains such as smart grid, healthcare, the military, and telecommunication. These systems are continually threatened by malicious software (malware) attacks by adversaries due to their improvised tactics and attack methods. A minor configuration change in a CPS through malware has devastating effects, which the world has seen in Stuxnet, BlackEnergy, Industroyer, and Triton. This paper is a comprehensive review of malware analysis practices currently being used and their limitations and efficacy in securing CPSes. Using well-known real-world incidents, we have covered the significant impacts when a CPS is compromised. In particular, we have prepared exhaustive hypothetical scenarios to discuss the implications of false positives on CPSes. To improve the security of critical systems, we believe that nature-inspired metaheuristic algorithms can effectively counter the overwhelming malware threats geared toward CPSes. However, our detailed review shows that these algorithms have not been adapted to their full potential to counter malicious software. Finally, the gaps identified through this research have led us to propose future research directions using nature-inspired algorithms that would help in bringing optimization by reducing false positives, thereby increasing the security of such systems.

Fragility curves are a common tool to appraise the expected damage to critical infrastructure (CI) after an earthquake event. Previous studies offer fragility curve parameters for CI that are suitable for a vast range of systems, without an in-depth examination of the system architecture and subcomponents. These curves are applicable in cases where a thorough analysis is not required or when the information related to a single system is poor. This paper proposes an original approach and presents a comprehensive methodology for developing exclusive fragility curves for critical infrastructure systems. In the proposed methodology, the fragility curves are developed by a decomposition of the system into its main subcomponents and determination of the failure mechanisms. The derivation of the fragility parameters includes failure analysis for each damage state by a Fault Tree Analysis and approximation of the fragility parameters in accordance with the rate of exceedance. The implementation of the methodology is demonstrated by a case study with three alternatives of an oil pumping plant configuration. It was found that a change of a subcomponent has an effect on the derived values of the fragility parameters. Moreover, the variances in the fragility parameters have implications for the effectiveness of each alternative to resist different levels of severity. [ABSTRACT FROM AUTHOR]

A procedure for assessing and monitoring the response of critical infrastructures when subjected to natural hazards is proposed in this paper, with a particular focus on bridges and viaducts, which are very peculiar and strategic assets of transport networks. The proposed procedure is characterized by three levels of analysis (L1–L3) with increasing reliability and complexity. The first level of analysis (L1) is carried out by evaluating a Class of Attention in line with the approach that is proposed by the Italian Guidelines for the safety assessment of bridges. The second level (L2) of analysis requires the definition of a numerical model of the bridge. The third level (L3) of analysis relies on the seismic response data from a seismic monitoring network. For all the three levels of the proposed procedure, data are collected in the CIPCast Decision Support System (CIPCast-DSS), a WebGIS platform developed by ENEA to support the decision-making process related to risk prevention and the management of impacts induced by natural hazards on critical infrastructures. The real-time analysis of the data collected and processed in the CIPcast-DSS in post-disaster circumstances provides a quasi-real-time prediction of the impacted infrastructures, and the extent of damages they could have suffered before a local inspection and analysis could take place. The continuous static and dynamic monitoring in periods without seismic events enables the planning of preventive and effective maintenance interventions. [ABSTRACT FROM AUTHOR]

Nowadays, Industrial Control Systems became more vulnerable because of integration of Information Systems and Operational Systems. And also critical infrastructures, such as energy, water, petrol etc., are more important ICS must be secured for threats. The methods to secure the critical infrastructures may be both by hardware or software. And by the way, the scientist and the engineers are implementing hardware and software solutions for securing. But the problem is how and where to test their solutions. The solutions cannot be tested in real systems, because critical infrastructures are systems that run 24/7 and cannot be stopped. During the test the system may be in fault. The testbeds can be used as modelling tool and they represent the real systems, with same devices, network topologies, processes etc., that means testbeds are realistic hardware and software environment that to test solutions without having the ultimate system. For this purpose, a testbed center called "Center Energy" has been established in order to carry out studies on the critical infrastructure of the electrical power grid for the purposes such as education of security researchers, and the development of national/international attack and defense solutions. In this study, the information about the architectural structure of Center Energy, implemented according to the Purdue model, and the process scope of the substation and distribution center owned by the electricity transmission and distribution companies, SCADA (Supervisory Control and Data Acquisition) and data management are given, as well as the SOC (Security Operation Center) implemented in accordance with the Defense in Depth approach of this architecture. Studies related to its activities are also presented. [ABSTRACT FROM AUTHOR]

One of the challenges in the Internet of Things systems is the security of the critical data, for example, data used for intrusion detection. The paper research construction of an intrusion detection system that ensures the confidentiality of critical data at a given level of intrusion detection accuracy. For this goal, federated learning is used to train an intrusion detection model. Federated learning is a computational model for distributed machine learning that allows different collaborating entities to train one global model without sharing data. This paper considers the case when entities have data that are different in attributes. Authors believe that it is a common situation for the critical systems constructed using Internet of Things (IoT) technology, when industrial objects are monitored by different sets of sensors. To evaluate the applicability of the federated learning for this case, the authors developed an approach and an architecture of the intrusion detection system for vertically partitioned data that consider the principles of federated learning and conducted the series of experiments. To model vertically partitioned data, the authors used the Secure Water Treatment (SWaT) data set that describes the functioning of the water treatment facility. The conducted experiments demonstrate that the accuracy of the intrusion detection model trained using federated learning is compared with the accuracy of the intrusion detection model trained using the centralized machine learning model. However, the computational efficiency of the learning and inference process is currently extremely low. It is explained by the application of homomorphic encryption for input data protection from different data owners or data sources. This defines the necessity to elaborate techniques for generating attributes that could model horizontally partitioned data even for the cases when the collaborating entities share datasets that differ in their attributes. [ABSTRACT FROM AUTHOR]

The smart city concept, in which data from different systems are available, contains a multitude of critical infrastructures. This data availability opens new research opportunities in the study of the interdependency between those critical infrastructures and cascading effects solutions and focuses on the smart city as a network of critical infrastructures. This paper proposes an integrated resilience system linking interconnected critical infrastructures in a smart city to improve disaster resilience. A data-driven approach is considered, using artificial intelligence and methods to minimize cascading effects and the destruction of failing critical infrastructures and their components (at a city level). The proposed approach allows rapid recovery of infrastructures’ service performance levels after disasters while keeping the coverage of the assessment of risks, prevention, detection, response, and mitigation of consequences. The proposed approach has the originality and the practical implication of providing a decision support system that handles the infrastructures that will support the city disaster management system—make the city prepare, adapt, absorb, respond, and recover from disasters by taking advantage of the interconnections between its various critical infrastructures to increase the overall resilience capacity. The city of Lisbon (Portugal) is used as a case to show the practical application of the approach.

Port activities are crucial for sustained, long-term economic growth, serving as the primary nodes for importing and exporting goods within global supply chains. Given their coastal locations, ports are inherently exposed to climate hazards, such as waves and extreme sea levels, requiring large investments in resilient infrastructure. This study introduces an innovative methodology for assessing climate-related impacts and risks in ports, applicable to both existing and new constructions. This approach aims to facilitate climate-informed decision-making and enhance the management of coastal structures and ports under high uncertainty. The methodology's novelty resides in: (1) the development of a port-specific risk framework capable of estimating impacts from both extreme events and daily conditions; (2) the integration of the latest advancements in nearshore climate hazard modeling; (3) the application of high-resolution tools for accurately simulating wave propagation towards harbor basins and the interaction between waves and structures; (4) the probabilistic determination of failure modes and operational shutdowns susceptible to climate conditions; and (5) the estimation of economic losses resulting from diminished operational capacity, in addition to the degradation of reliability and functionality in port infrastructures. Formulated within the Intergovernmental Panel on Climate Change (IPCC) risk framework and anchored in established Spanish Recommendations for Maritime Works (ROM Program), this methodology has been applied to a complex, state-owned, newly-built outer port in the Mediterranean Sea. Preliminary findings suggest that, over the course of a 50-year lifespan, climate-related risks could lead to cumulative losses nearing 10 million euros for such infrastructure. Nevertheless, in scenarios marked by extreme events, potential losses could escalate to as much as 100 million euros, despite their occurrence being relatively rare (with a probability of only 0.1%). It stresses the significant uncertainties encountered when evaluating climate-related risks for critical infrastructure, including ports, and highlights the critical need for advanced methodologies to accurately understand these risks. • It presents a new risk assessment, focusing on extremes and regular conditions. extreme events and regular conditions. • It integrates IPCC's risk framework into the port engineering field. • It implements the risk assessment locally with high-resolution, probabilistic methods. • It has been applied in a new state-owned port in Spain. [ABSTRACT FROM AUTHOR]

• A systematic review of multiplex network in resilience of interdependent infrastructures. • Three types of interdependencies including proximity, function, and logic. • Research gaps in multi-hazard attacks, high-resolution performance indicators, percolation mechanisms. • Lack systematic evaluation of nature-based and engineering solutions towards infrastructure resilience. • Call for high-quality observation data and informed multi-faced uncertainties. Modeling the effect of extreme events on multiple interdependent critical infrastructure systems (CIS) simultaneously is essential for improving their resilience. To uncover CIS resilience, an increasing number of studies are attempting to incorporate the interdependency in CIS resilience modeling under disaster events, where multiplex network is a powerful and promising representative. This paper presents a systematic review of multiplex networks in CIS resilience modeling and discusses the state of the art on the topic. This review helps to guide the construction of multiplex networks in CIS with different types of interdependencies and highlights the key aspects of CIS resilience modeling including attacks, evaluation, evolution, and control. Moreover, several challenges are identified while providing possible future research directions. The findings and discussions of this study could be helpful to researchers and professionals in the field of CIS resilience modeling especially when leveraging multiplex networks. [ABSTRACT FROM AUTHOR]

Abstract Industry 4.0 and highly automated critical infrastructure can be seen as cyber‐physical‐social systems controlled by the Collective Intelligence. Such systems are essential for the functioning of the society and economy. On one hand, they have flexible infrastructure of heterogeneous systems and assets. On the other hand, they are social systems, which include collaborating humans and artificial decision makers. Such (human plus machine) resources must be pre‐trained to perform their mission with high efficiency. Both human and machine learning approaches must be bridged to enable such training. The importance of these systems requires the anticipation of the potential and previously unknown worst‐case scenarios during training. In this paper, we provide an adversarial training framework for the collective intelligence. We show how cognitive capabilities can be copied (“cloned”) from humans and trained as a (responsible) collective intelligence. We made some modifications to the Generative Adversarial Networks architectures and adapted them for the cloning and training tasks. We modified the Discriminator component to a so‐called “Turing Discriminator”, which includes one or several human and artificial discriminators working together. We also discussed the concept of cellular intelligence, where a person can act and collaborate in a group together with their own cognitive clones.

Providing a comprehensive view of the city operation and offering useful metrics for decision-making is a well-known challenge for urban risk-analysis systems. Existing systems are, in many cases, generalizations of previous domain specific tools/methodologies that may not cover all urban interdependencies and makes it difficult to have homogeneous indicators. In order to overcome this limitation while seeking for effective support to decision makers, this article introduces a novel hybrid simulation framework for risk mitigation. The framework is built on a proposed city concept that considers the urban space as a Complex Adaptive System composed by interconnected Critical Infrastructures. In this concept, a Social System, which models daily patterns and social interactions of the citizens in the Urban Landscape, drives the CIs demand to configure the full city picture. The framework's hybrid design integrates agent-based and network-based modeling by breaking down city agents into system-dependent subagents, to enable both inter and intra-system interaction simulation, respectively. A layered structure of indicators at different aggregation levels is also developed, to ensure that decisions are not only data-driven but also explainable. Therefore, the proposed simulation framework can serve as a DSS tool that allows the quantitative analysis of the impact of threats at different levels. First, system-level metrics can be used to get a broad view on the city resilience. Then, agent-level metrics back those figures and provide better explainability. On implementation, the proposed framework enables component reusability (for eased coding), simulation federation (enabling the integration of existing system-oriented simulators), discrete simulation in accelerated time (for rapid scenario simulation) and decision-oriented visualization (for informed outputs). The system built under the proposed approach facilitates to simulate various risk mitigation strategies for a scenario under analysis, allowing decision-makers to foresee potential outcomes. A case study has been deployed on a framework prototype to demonstrate how the DSS can be used in real-world situations, specifically combining cyber hazards over health and traffic infrastructures. The proposal aims at pushing the boundaries of urban city simulation towards more real, intelligent, and automated frameworks. [ABSTRACT FROM AUTHOR]

The growing complexity of infrastructure has increased to overwhelming levels, making it more difficult to understand the potential causes and consequences of failures. Also, as services based on critical infrastructure are used intensively in both the economy and society, the severity of potential failures develops. The degree of complexity of the transport infrastructure is increasing, and the need for operational efficiency determines the implementation of new solutions offered by space infrastructures. To understand the complexity of critical space infrastructures, the authors describe space architecture. Furthermore, the paper introduces the concept of Complex System Governance (CSG) that addresses these issues, providing the tools, concepts, mindsets, and processes needed to understand the complexity of systems. [ABSTRACT FROM AUTHOR]

The Black Sea region features high complexity and other factors, such as the lack of a regional security architecture, which, in the current security context, result in a high effectiveness for hybrid warfare approaches. This has been proven by the track record of hybrid and unconventional warfare operations in the region, targeting also civilian infrastructure. The article proposes a Critical Infrastructure perspective on Black Sea insecurity, highlighting the potentiality for hybrid warfare but also measures which can increase resilience to hybrid threats on the basis of the Critical Infrastructure Protection framework. Lastly, the article highlights contributions which Romania can make on the basis of its experience and success in implementing CIP. [ABSTRACT FROM AUTHOR]

The paper presents some risks from outer space, elaborating on a risk profile for critical space infrastructure by presenting, in short, the problem of space weather phenomena, space debris and near-Earth objects. At the same time, the analysis also takes into account the development of anti-satellite weapons and other forms of space warfare. The main novelty of the scientific approach is the attempt to introduce a new paradigm in the field of critical space infrastructure, i.e. the human factor as a component that is currently missing from the literature. The analysis proves that the risk profile of the physical component is similar to the risk profile generated by the same spectrum of threats to the human component.

This article summarises research-in-progress for improved risk assessment and management (RAM) of critical infrastructures that interconnect across California's Sacramento-San Joaquin Delta. The need for improved RAM is patent in the Delta as elsewhere: a 'patch and pray' stalemate has developed which focuses on short-term reactive marginal maintenance and emergency response and recovery systems, all pushing infrastructures - and their engineers, designers and operators - increasingly to their performance edges and beyond. The research focuses on water supply, transportation, energy and flood protection systems, all of which are embedded in a dynamic ecosystem and showing clear signs of deterioration. Provisional findings of research activities are discussed. This article addresses critical infrastructure modelling uncertainties and ways to better understand, reduce or otherwise accommodate human/organisational and informational uncertainties in any RAM focused at the interconnected critical infrastructure system level.

Copyright of e & i Elektrotechnik und Informationstechnik is the property of Springer Nature and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Extreme events can damage or destroy multiple supply chain interdependent critical infrastructures elements. Although much research has focused on developing efficient restoration strategies, and/or making critical infrastructures more resilient, practitioners need tools to determine resources necessary to restore such damage. The methodology developed in this research estimates both the resources required to support the repair personnel, and restore different infrastructure elements. This method uses a dynamic mathematical model that establishes a framework to estimate post-disaster restoration costs from a whole system perspective. The model is validated with a case study of the resources required to restore multiple infrastructures that were damaged by the EF-5 tornado that struck Joplin, Missouri on May 22, 2011. Engineering managers, city planners, and policy makers can use the methodologies developed in this research to develop effective disaster planning schemas and to prioritize post-disaster restoration operations. [ABSTRACT FROM AUTHOR]

The relationship of operational domains with various systems based on artificial intelligence is becoming more profound and more diverse. The ability to influence decision-making mechanisms can pose serious risks that need to be identified and interpreted. Cyberspace is the carrier of artificial intelligence, but the latter as an operational domain has not yet been identified. The goal of this study is to examine certain relationships between cyberspace, artificial intelligence, and operational domains from a state-will enforcement perspective, using mostly qualitative tools, combined with quantitative elements. As a result, this paper finds the need to review defence doctrines from a cyber operational perspective and suggests addressing artificial intelligence in a much broader context, especially in the defence and military contexts. [ABSTRACT FROM AUTHOR]

Critical infrastructure protection faces increasing challenges, both in quality and in quantity. Most of the present security systems fully rely on automated mechanisms, which replace human operators, in order to perform computation intensive tasks and/or to work in extreme conditions. However, this solution presents some drawbacks with respect to the system performance. In order to provide effective measures against the pressure of new and sophisticated threats, an interdisciplinary approach, based on suitably coupling machine learning with human judgment, results as the right choice. In fact, this solution is particularly helpful for implementing efficient solutions capable of controlling critical scenarios and reacting effectively towards sophisticated threats. This paper discusses the proposed approach and demonstrates that this approach is the best choice for the effective protection of critical infrastructures.

Recent earthquake events have highlighted the importance of critical infrastructure (CI) resilience, as a strong correlation was found between economic loss and severity of CI damage. CIs are characterized by a complex structure composed of sub-components that are essential for the continuous performance of the system. CI owners and governments allocate ample resources to retrofitting and upgrading CI systems and components to increase the resilience of CIs and reduce risk in case of seismic events. Governments and decision makers must manage and optimize the retrofitting efforts to meet budget and time constraints. This research presents a probabilistic methodology for CI seismic risk mitigation and management. The risk expectancy is appraised according to an FTA-based stochastic simulation. The simulation includes the development of exclusive fragility curves for the CI and an examination of the expected damage distribution as a function of earthquake intensity and fragility uncertainty of the components. Furthermore, this research proposes a novel RMIR (risk mitigation to investment ratio) indicator for the priority setting of seismic mitigation alternatives. The RMIR is a quantitative indicator that evaluates each alternative’s cost-effectiveness in terms of risk expectancy mitigation. Following the alternative’s RMIR value, it is possible to prioritize the alternatives meeting budget and time constraints. This paper presents the implementation of the proposed methodology through a case study of a generic oil pumping station. The case study includes twelve mitigation alternatives examined and evaluated according to the RMIR indicator.

With the ever advancing expansion of the Internet of Things (IoT) into our everyday lives, the number of attack possibilities increases. Furthermore, with the incorporation of the IoT into Critical Infrastructure (CI) hardware and applications, the protection of not only the systems but the citizens themselves has become paramount. To do so, specialists must be able to gain a foothold in the ongoing cyber attack war-zone. By organising the various attacks against their systems, these specialists can not only gain a quick overview of what they might expect but also gain knowledge into the specifications of the attacks based on the categorisation method used. This paper presents a glimpse into the area of IoT Critical Infrastructure security as well as an overview and analysis of attack categorisation methodologies in the context of wireless IoT-based Critical Infrastructure applications. We believe this can be a guide to aid further researchers in their choice of adapted categorisation approaches. Indeed, adapting appropriated categorisation leads to a quicker attack detection, identification, and recovery. It is, thus, paramount to have a clear vision of the threat landscapes of a specific system. [ABSTRACT FROM AUTHOR]

Smart cities aim at improving efficiency while providing safety and security by merging conventional infrastructures with information and communication technology. One strategy for mitigating hazardous situations and improving the overall resilience of the system is to involve citizens. For instance, smart grids involve prosumers—capable of producing and consuming electricity—who can adjust their electricity profile dynamically (i. e., decrease or increase electricity consumption), or use their local production to supply electricity to the grid. This mitigates the impact of peak consumption periods on the grid and makes it easier for operators to control the grid. This involvement of prosumers is accompanied by numerous socio-technical challenges, including motivating citizens to contribute by adjusting their electricity consumption to the requirements of the energy grid. Towards this end, this work investigates motivational strategies and tools, including nudging, persuasive technologies, and incentives, that can be leveraged to increase the motivation of citizens. We discuss long-term and side effects and ethical and privacy considerations, before portraying bug bounty programs, gamification and apps as technologies and strategies to communicate the motivational strategies to citizens. [ABSTRACT FROM AUTHOR]