Critical infrastructure (CI) are defined as systems and assets whether physical or virtual, extremely vital to the country that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, loss of life or adversely affect the national morale or any combination of these matters. After identifying what may be considered as CI, a protection strategy has been stablished to identify which elements of the infrastructure are critical to its function or ones which pose the most significant danger to life and property, based upon two major aspects: - External/Internal Threats: important Central facilities, such as power-plants, central control units etc. are exposed to various threats which may cause considerable damage or even worse catastrophic damage to central infrastructure, causing damage to cities or even to country in which they are located. - Securing Critical Infrastructure: major industries which are supported by critical infrastructure such as transportation, environment, energy, health and more, depend largely on control systems which dictate the requirements.
CI security features may differ significantly from one CI category to another. Each category may contain different critical assets, implement different technologies and tools, and use different protection methods based on the specifically identified threats toward the CI category. With that said, there are shared aspects of security characteristics that have been analyzed in this document: High-Availability, Physical Protection, and Cyber Security. Then, the document presents a detailed review of specific security issues for each of our three pilot scenarios: Transportation, Health, and Environmental monitoring. Financial services domain has been included as well to reach an enhanced perspective. - Transportation. During the last years a change is moving through the sector: digitalization. More and more systems are moving to highly interconnected systems built on COTS components. In transportation, the main target of security is to ensure safety of the system, which also leads to the term “Security for Safety”. The three layers of this approach are detailed in this document: Operation Layer, Interlocking Layer, and Field Element Layer. - Health. There are many subsystems that can be considered critical directly involved in the proper daily functioning of any hospital. In our case, some of these OT and IT subsystems are integrated and managed from the corporative network whilst others (mainly the ones considered more critical) are kept physically isolated from this network security. - Environmental monitoring. Considering a typical environmental monitoring system, it is necessary to protect the monitoring stations, the data collection servers, and the post elaboration, data management and assessment applications. These tree components of the monitoring network are exposed to different kind of risks and have different security needs, so they have been discussed one by one. - Financial services. As the institutions that store and distribute funds, that provide loans and handle transaction processing, banks are potentially very vulnerable. Principles and processes for effective cyber-security in the Financial Service arena could be addressed in seven key dimensions that are introduced and explained in this document.
Market Solutions for CI domains have been reviewed in D1.1 under a technical perspective, whereas D5.1 contains complementary competitors and market analysis sections, business and exploitation-oriented, trying to demarcate CIPSEC potential advantages in its go-to-market strategy. Here, for those market solutions, a cross-domain analysis has been tackled, recognizing elements such as Data, Application, Host, Internal Network, Perimeter, Physical security, Policies, Procedures and Awareness, and Governance, Risk management and Compliance. Industry solutions for Environmental Monitoring, Transportation, and Financial Services have been included as well.