Risk and Interdependencies in Critical Infrastructures: A Guideline for Analysis

249 Pages·2012·6.382 MB·English

by  Ingrid Bouwer Utne, Henrik Hassel (auth.), Per Hokstad, Ingrid B. Utne, Jørn Vatn (eds.)

Springer Series in Reliability Engineering
Series Editor
Hoang Pham
For furthervolumes:
http://www.springer.com/series/6917
Per Hokstad Ingrid B. Utne
•
Jørn Vatn
Editors
Risk and Interdependencies
in Critical Infrastructures
A Guideline for Analysis
123
Editors
Per Hokstad JørnVatn
Safety Research Department of Productionand Quality
SINTEF Engineering
Trondheim Norwegian University ofScience
Norway and Technology
Trondheim
Ingrid B.Utne Norway
Department of MarineTechnology
Norwegian University ofScience
and Technology
Trondheim
Norway
ISSN 1614-7839
ISBN 978-1-4471-4660-5 ISBN 978-1-4471-4661-2 (eBook)
DOI 10.1007/978-1-4471-4661-2
SpringerLondonHeidelbergNewYorkDordrecht
LibraryofCongressControlNumber:2012953014
(cid:2)Springer-VerlagLondon2012
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartof
the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations,
recitation,broadcasting,reproductiononmicrofilmsorinanyotherphysicalway,andtransmissionor
informationstorageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilar
methodology now known or hereafter developed. Exempted from this legal reservation are brief
excerpts in connection with reviews or scholarly analysis or material supplied specifically for the
purposeofbeingenteredandexecutedonacomputersystem,forexclusiveusebythepurchaserofthe
work. Duplication of this publication or parts thereof is permitted only under the provisions of
theCopyrightLawofthePublisher’slocation,initscurrentversion,andpermissionforusemustalways
beobtainedfromSpringer.PermissionsforusemaybeobtainedthroughRightsLinkattheCopyright
ClearanceCenter.ViolationsareliabletoprosecutionundertherespectiveCopyrightLaw.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this
publicationdoesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexempt
fromtherelevantprotectivelawsandregulationsandthereforefreeforgeneraluse.
While the advice and information in this book are believed to be true and accurate at the date of
publication,neithertheauthorsnortheeditorsnorthepublishercanacceptanylegalresponsibilityfor
anyerrorsoromissionsthatmaybemade.Thepublishermakesnowarranty,expressorimplied,with
respecttothematerialcontainedherein.
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
Technology comprises much more than the products and systems that shape our
environment. Today our living, working, transportation, and communication are
based on large coupled networks. The functioning of our society is completely
dependent on these networks or critical infrastructures, such as electricity supply,
water supply, oil and gas production, transportation, banking and finance, and
information and communication technologies (ICT). Risk and vulnerability anal-
ysesareneededtograsptheimpactofthreatsandhazards.However,thesebecome
quite complex, as there are strong interdependencies both within and between the
infrastructure systems.Theinterdependenciescan cause redundantsystemstofail
simultaneouslyduetocommoncausefailures;onesystemcanfailduetofailureof
another system and thereby increased load; and finally, if the service of one
infrastructure is depending on another (say electricity) there can be a direct cas-
cading effect of a failure.
This book provides a theoretical basis and a practical guideline for analyzing
interdependencies and risks in critical infrastructures. Examples and case studies
for several infrastructures are included for illustrating the areas of application.
Various risk and vulnerability analysis techniques are adapted to different infra-
structures. The book describes the identification of hazards that are threatening
infrastructures,andenhancestheunderstandingofhowthesethreatscanpropagate
throughout the system and affect other infrastructures. It is mainly aimed at users
withlimitedexperienceinriskanalysisofcriticalinfrastructures,toenableuseof
the methods in real world problems. The methods are presented describing the
inputs needed for the analysis, the type expertise to draw upon, and expected
results from doing these kinds of analyses.
The book provides essential reading for municipalities and infrastructure
owners who need knowledge about the risks and vulnerabilities of their critical
infrastructures,toavoidhazardouseventsandplanforemergencypreparedness.It
should also be a valuable reading for consultants and researchers in the area, and
couldserveasasupplementarycurriculumandreadingformasterstudentsinrisk
analysis.
v
vi Preface
The book starts out with a couple of introductory chapters. Chapter 1 gives an
overview of some methods and approaches for investigating interdependencies in
critical infrastructures, and some literature is briefly reviewed. Main concepts—
like risk, vulnerability, critical infrastructure, and different types of interdepen-
dencies—arefurtherelaboratedinChap.2.Chapter3outlinesageneric‘‘riskand
vulnerabilityanalysis’’thatcouldserveasabasisforinvestigatingthehazardsand
risks of an infrastructure system. This analysis should conclude with suggesting
risk reducing measures and identification of needs for more detailed analysis
through the use of more advanced methods.
Chapter 4 presents a generic method for identifying and analyzing interdepen-
dencies, and provides an example applied to railway, electricity supply, and ICT
(basedonanactualeventattheCentralstation(railway/bus)ofOslo,Norway).The
modeling of interdependencies is also the topic of Chaps. 5 and 6. A modeling
framework for interdependent technical infrastructures and types of vulnerability
analyses, distinguishing between global vulnerability analysis, critical component
analysis,andgeographicvulnerabilityanalysis,isdescribedinChap.5.Chapter6
utilizes the framework and types of analyses from Chap. 5 and presents two case
studiesonaninterdependentelectricdistributionandwaterdistributionsystemina
cityandonaninterdependentrailwaysysteminsouthernSweden.
Chapters 7 and 8 treat risk analyses of electricity supply systems. Chapter 7
describesananalyticalapproachfortheanalysisofelectricitysupply,investigating
the consequences of supply interruptions, and Chap. 8 presents three case studies
using results of previous chapters in the book. The topic of Chap. 9 is the inte-
gratedurbanwatersupply.Challengesfacedbythewaterutilitiestoprovidesafe,
secure, and reliable service are discussed, and risk analysis models are presented.
The analysis of ICT is treated in Chap. 10. In particular, the dependencies
betweenICTandothercriticalinfrastructuresareaddressed.Further,mainthreats
toward ICT systems are explained, and various risk analysis techniques are pre-
sented. Chapter 11 discusses risk in maritime transport systems and interdepen-
dencies within the transportsystem,aswellastootherinfrastructure systems.An
example on LNG (liquefied natural gas) transport is presented in Chap. 12.
The last two chapters treat challenges for management. Chapter 13 presents
human reliability management and the importance of infrastructure resilience,
illustrated by an empirical study of joint stressful conditions for control room
operatorsinelectricity supplyandwatersupplysystemsinCalifornia.Chapter14
concludes the book by discussing organizational challenges regarding risk man-
agement in critical infrastructures.
Several chapters of the book are to a large extent based on results from the
researchprojectDECRIS(RiskandDecisionSystemsforCriticalInfrastructures),
which was funded by the Norwegian Research Council and carried out in close
cooperation with the municipality of Oslo.
Trondheim, 2012 Per Hokstad
Ingrid Bouwer Utne
Jørn Vatn
Contents
1 A Brief Overview of Some Methods and Approaches
for Investigating Interdependencies in Critical Infrastructures. . . 1
Ingrid Bouwer Utne, Henrik Hassel and Jonas Johansson
2 Defining Concepts and Categorizing Interdependencies . . . . . . . . 13
Jørn Vatn, Per Hokstad and Ingrid Bouwer Utne
3 Risk and Vulnerability Analysis of Critical Infrastructures . . . . . 23
Per Hokstad, Ingrid Bouwer Utne and Jørn Vatn
4 Interdependency Modelling in Risk Analysis. . . . . . . . . . . . . . . . 35
Per Hokstad, Ingrid Bouwer Utne and Jørn Vatn
5 Modelling, Simulation and Vulnerability Analysis
of Interdependent Technical Infrastructures . . . . . . . . . . . . . . . . 49
Jonas Johansson and Henrik Hassel
6 Vulnerability Analyses of Interdependent
Technical Infrastructures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Jonas Johansson and Henrik Hassel
7 Risk Analysis of Electricity Supply . . . . . . . . . . . . . . . . . . . . . . . 95
Gerd Kjølle and Oddbjørn Gjerde
8 Risk of Electricity Supply Interruptions . . . . . . . . . . . . . . . . . . . 109
Oddbjørn Gjerde and Gerd Kjølle
9 Integrated Urban Water System. . . . . . . . . . . . . . . . . . . . . . . . . 127
Rita Ugarelli and Jon Røstum
vii
viii Contents
10 Information and Communication Technology: Enabling
and Challenging Critical Infrastructure. . . . . . . . . . . . . . . . . . . . 147
Maria B. Line and Inger Anne Tøndel
11 Risk-Based Design of Maritime Transport Systems . . . . . . . . . . . 161
Bjørn Egil Asbjørnslett, Inge Norstad and Øyvind Berle
12 Risk of Supply Breaches in Maritime LNG Transport. . . . . . . . . 175
Bjørn Egil Asbjørnslett, Inge Norstad and Øyvind Berle
13 Risk Management of Interconnected Infrastructures:
An Empirical Study of Joint Stress Conditions . . . . . . . . . . . . . . 189
Emery Roe and Paul R. Schulman
14 Organizational Challenges Regarding Risk Management
in Critical Infrastructures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Petter Almklov, Stian Antonsen and Jørn Fenstad
Appendix A: Hierarchy of Hazardous Events. . . . . . . . . . . . . . . . . . 227
Appendix B: Societal Critical Functions (SCF)
and the Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 231
Appendix C: Risk Analysis Methods . . . . . . . . . . . . . . . . . . . . . . . . 237
Author Biography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Chapter 1
A Brief Overview of Some Methods
and Approaches for Investigating
Interdependencies in Critical
Infrastructures
Ingrid Bouwer Utne, Henrik Hassel and Jonas Johansson
Abstract This chapter presents methods for analysing interdependencies in crit-
ical infrastructures. In general, there are three groups of methods for analysing
interdependencies;(1)conceptual,(2)modelandsimulationand(3)empiricaland
knowledge-basedapproaches.Examplesofmethodsbelongingtothesegroupsare
presented.Thelatterpartofthechapterdiscusseschallengesrelatedtomodelling,
focusing on how to deal with complexity, trade-offs between abstraction and
fidelity, choice of consequence measures and obtaining information.
1.1 Introduction
Inrecentyears,severaldifferenttypesofmethodsforanalysinginterdependencies
incriticalinfrastructureshavebeenpublished;see,forexample,Pedersonetal.[1]
foranoverview.Someoftheseanalyseshavebeenusedasinputtotheapproaches
presented in this book, whereas others represent alternatives. Still, researchers
(e.g. Kröger [2]) emphasize the need for more extended analyses of interdepen-
dencies, and pinpoint challenges related to the use of traditional risk analysis
methods in the analysis of large and complex infrastructures.
I.B.Utne(&)
DepartmentofMarineTechnology,NorwegianUniversityofScienceandTechnology
(NTNU),Trondheim,Norway
e-mail:[email protected]
H.Hassel
DepartmentofFireSafetyEngineeringandSystemsSafety,LundUniversity,
Lund,Sweden
J.Johansson
DepartmentofMeasurementTechnologyandIndustrialElectricalEngineering,
LundUniversity,Lund,Sweden
P.Hokstadetal.(eds.),RiskandInterdependenciesinCriticalInfrastructures, 1
SpringerSeriesinReliabilityEngineering,DOI:10.1007/978-1-4471-4661-2_1,
(cid:2)Springer-VerlagLondon2012
2 I.B.Utneetal.
In general, the work related to failures and interdependencies in critical infra-
structures can be divided into three groups:
1. Conceptual approaches, mainly providing definitions and classifications of
importantconceptsrelatedtocriticalinfrastructureandinterdependencies,also
presenting categories of interdependencies and factors affecting these.
2. Model and simulation approaches, using (advanced) quantitative techniques to
investigate interdependencies and visualize effects offailure.
3. Empirical and knowledge-based approaches, providing models and results
based on empirical data and real events in the past.
Mostofthechaptersinthisbookbelongtothegrouptwotypesofapproaches.
Chapter 13 by Roe and Schulman is one exception and can be classified as an
empirical approach. Below some literature related to each of these groups are
reviewed.
1.2 Group 1: Conceptual Approaches: Definitions
and Classifications
There are several publications that treat the subject of defining and classifying
what constitutes critical infrastructures and the concept of interdependencies.
Belowanoverviewofsomeofthemostinfluentialworkwithinthisareaisgiven.
Rinaldi et al. [3] refer to the following definition of critical infrastructure:
Theframeworkofinterdependentnetworksandsystemscomprisingidentifiableindustries,
institutions(includingpeopleandprocedures)anddistributioncapabilitiesthatprovidea
reliableflowofproductsandservicesessentialtothedefenceandeconomicsecurityofthe
UnitedStates,thesmoothfunctioningofgovernmentsatalllevels,andsocietyasawhole.
Luiijf and Klaver [4] refer to the EU communication on critical infrastructure
protection (2004), which defines critical infrastructures as ‘‘those physical and
informationtechnologyfacilities,networks,servicesandassetswhich,ifdisrupted
or destroyed, have a serious impact on the health, safety, security or economic
well-beingofcitizensortheeffectivefunctioningofgovernments’’.TheEUGreen
Paper [5] includes the sectors; energy, ICT, water, food, health, financial, public
and legal order and safety, civil administration, transport, chemical and nuclear
industry and space and research, as critical infrastructures.
There are various types of interdependencies discussed in the literature. Some
papers distinguishbetweendependenciesandinterdependencies.Rinaldietal.[3]
define interdependencies between infrastructures as a bidirectional relationship
anddependenciesasunidirectional.Bidirectionalrelationshipsmeansthatthestate
of one infrastructure affects or is correlated according to the state of another
infrastructure. The infrastructure characteristics focus on the system hierarchy,
timescales, operating procedures, training and redundancy, as well as ownership
andregulations.Failurescanbecascading,escalatingandcommoncauseandstate
of operation may vary from optimal operation to total failure.
1 ABriefOverviewofSomeMethodsandApproaches 3
Rinaldietal.[3]presentaframeworkofsixdimensionstodescribeandanalyse
interdependencies: (1) type of interdependencies, (2) surroundings, (3) coupling
and response behaviour, (4) infrastructure characteristics, (5) type offailures and
(6) state of operation.
They also define four categories of interdependencies:
1. Physical interdependency—physical coupling between inputs and outputs, for
example, a commodity produced/modified by an infrastructure is required by
another infrastructure to function.
2. Cyber interdependency—the state of the infrastructure depends on the infor-
mation transmitted through the information infrastructure.
3. Geographical interdependency—one or several elements of infrastructures are
in close proximity so that one event (e.g. fire) creates disturbances to the
infrastructures.
4. Logical interdependency—two or more infrastructures have reciprocal effects
without any physical, geographical or cyber interdependency.
Zimmerman [6, 7] distinguishes between spatial and functional interconnec-
tedness and dependency. Spatial interconnectedness refers to proximity between
infrastructuresasthemostimportantrelationshipbetweenthesystems.Functional
interconnectednessrefers toa situationin which an infrastructure is necessary for
operation of another infrastructure, for example, the pumps in a water treatment
systems needing electricity in order to function. There are also commonly situa-
tionswithbothtypesofinterconnectedness,forexample,wirelesscommunication.
Zimmerman [7] describes three important factors related to interdependency
between infrastructures:
1. Interconnectedness/couplings, which affect how failures propagate through the
systems.
2. Redundancy, affecting alternative ways of restoring system functioning.
3. System knowledge, which, for example, enables identification of threats.
Bagheri and Ghorbani [8] present a framework which attempts to unify and
consolidate current research on analysis of interdependencies. The framework is
five-dimensional,consistingofsystemanalysis(e.g.riskmanagement),behaviour
analysis (e.g. simulation models), knowledge discovery (e.g. hypothesis testing),
visualization (e.g. visualization of analysis data) and information sharing (e.g.
rules and regulations).
1.3 Group 2: Model and Simulation Approaches
Several advanced approaches model or simulate the behaviour of a group of
coupled infrastructures in order to evaluate how disturbances cascade through the
systems and impact the different infrastructures involved.
A risk-based interdependency assessment process for infrastructures is pre-
sented in Brown et al. [9]. The iterative process can be supported by different