Keywords

1 Introduction

Critical infrastructure is a broad term that still evolves. Generally speaking critical infrastructure provides the most important services to society such as water, food, financial, ICT, energy, transportation and health services. Any dysfunction of critical infrastructure poses a threat to continuity of functioning of the country and the well-being of citizens [1]. Therefore, effective protection of critical infrastructure is crucial, but it also poses a great challenge, what exemplify recent events. Namely, the Covid-19 pandemic proved that the security of critical infrastructure for a long time has been taken for granted. The pandemic caused the change in demands for critical services, what found many critical infrastructure operators unprepared to respond effectively [2]. It also revealed the importance of vulnerability identification that has been marginalized or not included in risk assessment methodologies [3]. In case of future unexpected or difficult to estimate threats, the identification of root causes of vulnerability of critical infrastructure plays a vital role. However, to comprehend the applicability of the concept of vulnerability of critical infrastructure, it is necessary to first understand the meaning of this term. This would contribute to enhancing the resilience of critical infrastructure by eliminating or reducing the vulnerabilities of critical infrastructure that might contribute to crisis situation or any kind of the incapacitation. The situation caused by Covid-19 can be used as a lesson learnt which might in future contribute to more effective protection of critical infrastructure based on resilience with identification of vulnerabilities and application of appropriate countermeasures.

2 Limitations of the Current Understanding of Vulnerability of Critical Infrastructure

The concept of vulnerability of critical infrastructure is relatively new and it still evolves [4]. Broadly speaking, vulnerability of critical infrastructure is a term which does not have one, common definition. It can be defined as a flaw or weakness in the design, implementation, operation or management of the critical infrastructure which makes it more susceptible to incapacitation when exposed to a threat [5]. ISO 27001 describes vulnerability as “a weakness of an asset or control that could potentially be exploited by one or more threats.” [6]. The perception of vulnerability in this case is evaluative, identifying vulnerability with some kind of an error made at different stages. This however is not always the case. According to other definitions, vulnerability of critical infrastructure can be described as an operational attribute, physical feature that makes critical infrastructure more susceptible to exploitation by a threat, or as a system property focusing on degree of consequences in relation to the impact of a threat, degree of exposure to the threats and degree of resilience [5, 7]. These definitions do not indicate the necessary negative aspect of vulnerability, but rather define it as a feature of the system. This approach seems to be more accurate, especially in case of vulnerabilities resulting from interdependencies between different critical infrastructures or environmental contexts within which the system is embedded [8]. In that event vulnerability should not be understood as a flaw, but rather as an attribute of the system.

It should also be noted that presented definitions suggest the dual nature of vulnerability, namely its physical, technical dimension relating to the vulnerabilities of the hard-components and its operational, social character referring to established procedures and management capabilities. However, due to adopted in many European Union countries understanding of critical infrastructure in terms of assets or hard technologies, the physical as well as operational dimension of vulnerability would relate to vulnerabilities affecting only those critical objects, facilities [9, 10]. Recent events linked to Covid-19 pandemic proved that critical infrastructure has grown in scope to include the network of people who are essential in terms of operating of critical infrastructure, but also in scale. Namely, the crisis spawned by the outbreak of Covid-19 exposed the importance of frontline health care workers as well as the healthcare system dependency on other systems, including transport of necessary equipment such as personal protective equipment or ventilators to hospitals [11]. It demonstrates that critical infrastructure should rather be perceived as an interconnected process, aiming to deliver essential service, which involves various stakeholders. Such understanding of critical infrastructure is in line with the recently proposed European Union Directive on the resilience of critical entities, which defines critical infrastructure as critical entities providing essential services [12]. This shift in defining critical infrastructure as a complex system composed of technological and social components implies the necessity to rethink the notion of vulnerability, which should also be more elaborate and applicable to other domains [10, 13].

Moreover, it should be emphasized that the previously mentioned definitions of vulnerability have one crucial aspect in common, namely the threat-centric perception of vulnerability. Meaning that the vulnerability identification is driven by the set of identified threats to critical infrastructure. The spectrum of threats that could affect critical infrastructure is usually broad, including physical, cyber-attacks, natural disasters or accidents occurring on daily basis [14]. They are however mostly physically, cyber- oriented what also results from aforementioned understanding of critical infrastructure through the prism of objects, assets. Accordingly, the risk management methods focus mostly on asset hardening, physical resistance of critical infrastructure to endure the identified threats and to prevent critical infrastructure from failure [15]. Due to fast changing threat landscape, including the unpredictability of future impacts of climate change on critical infrastructure, state-sponsored hybrid actions, biological threats or new technologies, traditional approach to protection of critical infrastructure based on prevention seems to be ineffective. In case of black swan events, such as the Covid-19 pandemic, difficult to foresee, precisely estimate and prepare for, the overreliance on prepared in advance protection plans with risk assessment based on identification of vulnerabilities to selected threats might endanger the undisturbed continuity of functioning of critical infrastructure [16,17,18].

In addition, due to concentration on identification and assessment of threats, the risk management cycle refers to the vulnerability only in the context of pre-event actions such as prevention, protection and pre-event mitigation. This implies that the drivers of vulnerability would be considered only before the occurrence of the threat and the damage. The vulnerability then would be identified solely in terms of capabilities to detect the possible threats and to determine the scale of potential consequences. This means that the vulnerabilities relating to post-event actions such as mitigation, response and recovery would not be considered [19, 20]. It should be emphasized that the reduction of vulnerabilities before they occur as failures is crucial. Nevertheless, due to increasing level of interdependencies and interconnectivity of critical infrastructure, the capability of critical infrastructure operator to react to and respond to future unanticipated threats as well as adapt to changes rather than only overcome them is becoming more and more important [21]. Furthermore, the growing complexity of critical infrastructure creates additional vulnerabilities to the system which might as well result in indirect, cascading consequences not limited to one domain. Therefore, it is becoming very difficult to precisely analyze all of the components of critical infrastructure and estimate their vulnerabilities prior the adverse event [15]. This suggests the need to focus on vulnerabilities that might negatively influence the response actions and degree of loss after the adverse event [19]. It requires taking into consideration not only current vulnerabilities to specific, identified threats, but also system’s potential vulnerabilities to the future, unknown events, combined with expectation of inability to prevent all threats from occurring and capability to respond to them [8].

3 The Multidimensional Nature of Vulnerability of Critical Infrastructure

To make critical infrastructure more secure, especially in case of future unknown unknowns, the designed and applied countermeasures should focus on enhancing critical infrastructure resilience. The term resilience can be understood as “the ability of an infrastructure to prepare to cope with changing conditions and adapt to them, and to resist and recover rapidly from disruption, including deliberate attacks, accidents or natural events” [22]. The level of resilience of critical infrastructure is largely determined by the process of identification of vulnerabilities. However, the implementation of resilient approach to critical infrastructure protection requires a paradigm shift from the focus on threats towards identification, assessment and management of vulnerabilities [21]. The identification of root causes of vulnerability should consider broader scope of critical infrastructure domains where vulnerabilities might be embedded at different stages of operating, namely before as well as after the occurrence of the adverse event.

Considering critical infrastructure as a complex system, composed of various, interacting components, the root causes of vulnerability can be divided into following factors:

• capacity, which would include mission identification, supporting system identification, dependencies and interdependencies, system reconstitution and related to them infrastructure, equipment and staff;

• competence relating to knowledge and skills of personnel including operation and management attributes such as responsibilities, communication, organization, logistics, knowledge about the environment in which critical infrastructure operates and critical infrastructure endurability;

• performance understood as capability of critical infrastructure to function under all circumstances and public-private cooperation in protection of critical infrastructure [4, 14].

The first factor, referring to capacity of critical infrastructure, aims to identify vulnerabilities related to identification of the critical infrastructure most important functions to fulfil the mission of the delivery of essential service. It requires thorough analysis of the processes, sub-processes and supporting them key assets, systems, networks, hardware, software and also essential staff. This also involves identification of internal and external dependencies and interdependencies between infrastructures. As a result of in-depth analysis of the system, through conduct of the Business Process Analysis (BPA) and Business Impact Analysis (BIA), critical infrastructure operator will be able to identify existing vulnerabilities and apply proper countermeasures or prepare for potential vulnerabilities resulting from identified relationships between infrastructures as cascading failures [23, 24]. The conduct of BIA, defined as: ‘‘a process of analyzing operational functions and the effect that a disruption might have upon them’’ would also enable to gather required information to prepare business continuity plan [25, 26]. The analysis of capacity of critical infrastructure would also involve understanding and estimation of reconstitution time in case of occurrence of the adverse event including acceptable time delays, repair parts requisitions and fix implementation. Moreover, this would enable to prioritize the most important parts of critical infrastructure system, crucial for the delivery of essential services to the country and society under all circumstances. It should also be noted that the critical infrastructure as an entity is not static and therefore requires constant technology upgrades. The recognition of critical infrastructure capacity is crucial not only in order to understand the system better and eliminate the vulnerabilities, but also to be able to react more effectively in case of crisis caused by impossible to mitigate vulnerabilities [14].

The second factor, namely the competence, relates to the importance of organizational resilience. According to ISO 22301 competence is described as an “ability to apply knowledge and skills to achieve intended results” [25]. It involves issues such as internal organization of critical infrastructure, the management skills of the personnel and knowledge about internal and external factors, which might affect critical infrastructure operations. The PESTLE framework can be used to monitor and analyze the environment within which critical infrastructure functions, and notice any changing conditions. The PESTLE acronym stands for Political, Economic, Social, Technological, Legal and Environmental factors which might create vulnerabilities that can affect critical infrastructure [27]. The clear division of roles and responsibilities, as well as implementation of the procedures and policies are crucial, however they should not be overestimated. The competence is directly linked to ability to adapt to unexpected crisis situation for which procedures, rules have not been prepared. To mitigate the possible vulnerabilities caused by this factor, the trainings, exercises are required to test the existing strategies, communication within organization and with other stakeholders as well as the ability of the staff to be creative and innovative when faced with unanticipated problems. These exogenous and endogenous factors need to be addressed in order to facilitate adaptation of critical infrastructure to changing conditions. Moreover, in case of endurability the development and constant update of prepared contingency plans, back-up systems, spares are necessary in order to reduce the effects of adverse events and to maintain the critical functions of critical infrastructure [8, 27].

The performance factor relates to capabilities of critical infrastructure and public-private partnership. The term capability refers to a capacity combined with competence. It relates to comprehensive implementation and management of all resources required for critical infrastructure to operate. It highlights the need of holistic approach to identification of vulnerabilities at different stages, namely before, during and after the adverse event. It directly relates to the required capabilities of critical infrastructure to anticipate, absorb, adapt to and recover from a disruptive event. It includes the onsite and offsite capabilities relating to crisis management. The onside capabilities include measures undertaken by critical infrastructure operator aiming to implement following properties which characterize the resilient system, namely: robustness, redundancy, resourcefulness and rapidity [17, 28]. The offside capabilities involve the interactions, information exchange between critical infrastructure operator and public sector such as law enforcement, emergency medical response, fire response or intelligence services. These actions would help to raise awareness of the complexity of the system, including dependencies and interdependencies between critical infrastructures and thereby prepare suitable strategies, protection plans and programs [29]. The effective cooperation between emergency responders and critical infrastructure operator, based on agreed procedures, joint exercises, trainings would help to eliminate the vulnerabilities which might hinder the coordination and response actions to all disruptive events [20]. In addition, the cross-sectoral partnerships between critical infrastructure operators involving civil society should be established in the process of building resilient critical infrastructure [30].

4 Conclusions

For a long time the identification of vulnerability of critical infrastructure has been underestimated and mostly referred to physical flaws of critical infrastructure. Due to fast changing threat landscape, growing complexity and interconnectedness between critical infrastructures, the protection of critical infrastructure requires a shift from prevention-based approach to resilience-based [9]. It should be highlighted that the resilience of critical infrastructure is largely determined by the process of identification of vulnerabilities. In this case, the vulnerability should rather be understood in terms of features or attributes of the system. The identification of root causes of vulnerability of critical infrastructure should include the wider scope of domains where vulnerabilities might be embedded, taking also into account the post-event stage. This would require the analysis of the following factors, namely the capacity, competence and performance. These factors reflect the complex nature of critical infrastructure, which consists of various, interacting technical and social components, which to manage require adequate skills and knowledge as well as onside and offside capabilities to identify vulnerabilities which might hamper crisis management actions, and also well-functioning public-private cooperation [4, 14]. The proper identification of vulnerabilities would enable to understand the system better and notice any warning signs which might result in crisis situation. Consequently, these actions would contribute greatly to more secure and resilient critical infrastructure.