identifying critical infrastructure sectors and their dependencies: an indian scenario

Available online at www.sciencedirect.com

www.elsevier.com/locate/ijcip

i n t e r n a t i o n a l j o u r n a l o f c r i t i c a l i n f r a s t r u c t u r e p r o t e c t i o n ] ( ] ] ] ] ) ] ] ] – ] ] ]

http://dx.doi.org/101874-5482/& 2014 El

nCorresponding aE-mail address: s

Please cite this ascenario, Interna

Identifying critical infrastructure sectors and theirdependencies: An Indian scenario

Abhishek Narain Singha,n, M.P. Guptaa, Amitabh Ojhab

aDepartment of Management Studies, Indian Institute of Technology Delhi, New Delhi 110016, IndiabResearch Design and Standards Organization, Lucknow 226011, India

a r t i c l e i n f o

Article history:

Received 9 July 2012

Received in revised form

16 October 2013

Accepted 4 April 2014

Keywords:

Critical infrastructure sectors

Identification

India

Interpretive structural modeling

MICMAC

Critical infrastructure dependencies

.1016/j.ijcip.2014.04.003sevier B.V. All rights res

[email protected]

rticle as: A.N. Singh, etional Journal of Critica

a b s t r a c t

Across the globe, critical infrastructures constantly face the risk of cyber and/or other

attacks from hostile and malicious entities as well as damage inflicted by natural disasters.

This paper seeks to identify the critical infrastructure sectors of a country, namely India,

and to explore the dependencies existing among them. The research draws on the extant

literature as well as expert opinion and judgments to identify the critical infrastructure

sectors. Following this, the interpretive structural modeling (ISM) technique is employed to

discover the relationships and dependencies existing among the identified critical infra-

structure sectors. Next, cross-impact matrix multiplication applied to classification

(MICMAC) analysis is used to categorize the critical infrastructure sectors into four sub-

groups based on their driving power and dependence on other sectors. Policy implications

for government entities and businesses in India are also discussed.

& 2014 Elsevier B.V. All rights reserved.

1. Introduction

The protection of the critical infrastructure, which includespower, transportation, telecommunications, banking, informa-tion and communications technology, from cyber and/otherattacks by hostile or malicious entities as well as naturaldisasters continues to be a serious concern across the globe.Definitions of the term “critical infrastructure” as appearing inthe literature (Table 1) hold good for this paper as well. Sinceinfrastructure assets are owned and/or managed by the publicand private sectors, the protection of these infrastructureresources is no longer an issue that concerns governmentsalone. Further, the various critical infrastructure sectors inmodern economies are so interconnected and interdependentthat a disruption of one critical infrastructure can impair oradversely affect the functioning of several other critical infra-structures. Imagine a scenario where the power grid as well as

erved.

(A.N. Singh).

t al., Identifying critical Infrastructure Protecti

backup power supply in a region goes down because of a naturalcalamity or sabotage. In such a situation, telecommunications,banking, manufacturing, etc. would all be crippled, potentiallyproducing serious economic and social consequences for theaffected region.

A classic example is the Hyogoken-Nanbu earthquake thatstruck Kobe, Japan and surrounding areas on January 17, 1995.The earthquake resulted in more than 6000 deaths and 30,000injuries, and accounted for an estimated economic loss of 200billion USD [1]. Trains were derailed and a power failure leftapproximately one million people without electricity [2]. Anotherexample is the 2005 Hurricane Katrina in the United States,which caused severe floods and critical infrastructure collapsethat completely paralyzed New Orleans, Louisiana and severelyaffected several Gulf Coast states. More recently, in July 2012,a number of power grids failed in India, resulting in powerblackouts in most of the northern and north-eastern states.

l infrastructure sectors and their dependencies: An Indianon (2014), http://dx.doi.org/10.1016/j.ijcip.2014.04.003

http://dx.doi.org/10.1016/j.ijcip.2014.04.003





mailto:[email protected]





Table 1 – Definitions of critical infrastructure.

Definition Reference

“…Critical infrastructures are organizational and physical structures and facilities of such vital importance to a nation’ssociety and economy that their failure or degradation would result in sustained supply shortages, significant disruptionof public safety and security, or other dramatic consequences.”

FOIS (BSI), Germany [5]

“…Critical infrastructure means an asset, system or part thereof located in Member States which is essential for themaintenance of vital societal functions, health, safety, security, economic or social wellbeing of people, and the disruptionor destruction of which would have a significant impact in a Member State as a result of the failure tomaintain those functions.”

Council Directive-EuropeanUnion [6]

“…Those physical facilities, supply chains, information technologies and communication networks that, if destroyed,degraded or rendered unavailable for an extended period, would significantly impact the social or economic wellbeingof the nation or affect Australia’s ability to conduct national defence and ensure national security.”

CIRS-Australia [7]

“…Critical infrastructure includes systems and assets so vital to the United States that their incapacity or destructionwould have a debilitating impact on national security. Key resources are resources essential to the minimal operationsof the economy and government.”

GAO-USA [8]

i n t e r n a t i o n a l j o u r n a l o f c r i t i c a l i n f r a s t r u c t u r e p r o t e c t i o n ] ( ] ] ] ] ) ] ] ] – ] ] ]2

The blackouts and their crippling effects on the other criticalinfrastructures affected the lives of approximately six hundredmillion people [3].

Motivated by these examples, this paper seeks to identifythe critical infrastructure sectors in India and discover thedependencies existing among them. Drawing on expert opi-nion and judgment, a list of thirteen critical infrastructuresectors are identified and the interpretive structural modeling(ISM) technique is used to demonstrate the dependenciesexisting among the thirteen critical infrastructure sectors.The primary justification for this India-focused study is thatthe understanding of the critical infrastructure and thedevelopment of critical infrastructure protection strategiesin India are still in an evolving stage.

While the threat of physical attacks has always existed invarying degrees, critical infrastructures now increasingly facethe threat of cyber attacks. The emerging scenario has beenelegantly stated by Richard George, former Technical Director ofInformation Assurance at the U.S. National Security Agency:“…there will never be another war in which the critical infrastructureis not both, a cyber and physical target” [4]. Although this paper hasbeen motivated by the increasing risk of cyber attacks, theresearch results are certainly relevant to other types of attackson the critical infrastructure.

The next section reviews the major initiatives undertakenworldwide in the area of critical infrastructure protection aswell as the measures adopted by India. Section 3 presents theresearch methodology and data analysis using ISM and MIC-MAC (matrice d’impacts croisés multiplication appliqués à unclassement, i.e., cross-impact matrix multiplication applied toclassification). Section 4 discusses the ISM and MICMAC analy-sis results vis-à-vis previous research findings, the implicationsfor government and business, and the research contribution.Expert viewpoints are summarized in Section 5. Section 6discusses the limitations of the research and identifies avenuesfor future work. The final section presents the conclusions.

2. Literature review

In keeping with focus of the paper on critical infrastructuredependencies and cyber security concerns, the literature onthe mutual dependency of critical infrastructures as well as

Please cite this article as: A.N. Singh, et al., Identifying criticascenario, International Journal of Critical Infrastructure Protecti

cyber attack motives and countermeasures are brieflyreviewed. Following this, the extant literature is explored toclarify the measures undertaken by India with regard tocyberspace security.

2.1. Types of dependencies and shared vulnerabilitiesand threats

Dependencies among critical infrastructures have their uniquecharacteristics and effects. Rinaldi et al. [9] have groupedinfrastructure dependencies into four categories: (i) physicaldependencies; (ii) cyber dependencies; (iii) geographical depen-dencies; and (iv) logical dependencies. However, more recentresearch has suggested that vulnerabilities or threats shared bytwo infrastructures should not be treated as a dependency [10];according to this point of view, the geographical factor shouldnot be considered to be a dependency. The present research ismotivated by critical infrastructure vulnerability concerns thatarise from cyber dependencies.

2.2. Critical infrastructure dependencies, cyber attackmotives and countermeasures

The task of securing the critical infrastructure of a country isextremely difficult due to the multifaceted functions anddependencies of the various critical infrastructure sectors.Indeed, the dependencies among critical infrastructures ren-ders them more complex as well as more vulnerable. Accordingto Setola et al. [11], the dependencies are often hiddenand not well recognized even by infrastructure operators.In other research, Little [12] has captured the dependencies ofelectric power, water, oil, transportation, natural gas andtelecommunications sectors using directional graphs, alongwith their causes. Several researchers [13,14] have designedinteractive visualization tools to analyze the dependenciesexisting among critical infrastructures. Numerous sector-specific studies have been carried out by scholars across theglobe to understand the complexities of various infrastruc-ture sectors (see Table 2). The dependencies among criticalinfrastructures and their cascading effects have been inves-tigated by Rahman [34]. Theoharidou et al. [35] have devel-oped a common body of knowledge for information security





Table 2 – Selected sector-specific studies related to critical infrastructure protection.

Sectors Issues References

Banking and Finance U.S. financial sector and its dependence on other sectors [15]Transportation U.S. railway infrastructure [16]Energy U.S. liquid pipelines [17]

Managing risk responses for petroleum industry in Norway [18]U.S. electric grid infrastructure protection [19]Impacts of climate change on the European power sector [20]Power grid and electrical sectors [21–23]Dependencies between the electrical and informationinfrastructures

[24]

Information Technology/Information andCommunications Technology

Securing supervisory control and data acquisition (SCADA) systemsagainst malware attacks

[25,26]

Telecommunications infrastructure in Brazil [27]Industrial communications networks [28]

Water Supply SCADA security in the Dutch drinking water sector [29]Emergency Services IP-based next generation emergency services architectures [30]

IP multimedia system for emergency calling/reporting [31]Defense Industrial Base Dependencies in social network environments [32]Chemical Industry Integrity and denial-of-service attacks on control systems [33]

Fig. 1 – Milestone initiatives related to critical infrastructure protection.

i n t e r n a t i o n a l j o u r n a l o f c r i t i c a l i n f r a s t r u c t u r e p r o t e c t i o n ] ( ] ] ] ] ) ] ] ] – ] ] ] 3

Please cite this article as: A.N. Singh, et al., Identifying critical infrastructure sectors and their dependencies: An Indianscenario, International Journal of Critical Infrastructure Protection (2014), http://dx.doi.org/10.1016/j.ijcip.2014.04.003





and critical information infrastructure protection. Morriset al. [36] have developed a control system testbed to helpdiscover various cyber-related vulnerabilities in critical infra-structures, their implications for physical control systems,and the corresponding mitigation techniques [36].

Attacks on critical infrastructures can be attributed tospecific causes and motives. Gandhi et al. [37] have dividedthe motives behind such attacks into three broad categories:(i) political; (ii) socio-cultural; and (iii) economic. The pursuitof political influence and power within a country or outside itis the major cause underlying politically-motivated cyberattacks. Whereas religious beliefs and extremism are behindsome socio-culturally motivated attacks, the vast majority ofattacks are economically motivated, basically to gain compe-titive advantages over businesses and/or governments. TheU.S. Federal Bureau of Investigation [38] has identified severalcategories of threat agents for critical infrastructures. Thesecategories include: criminal groups, foreign intelligence ser-vices, hackers, hacktivists, insiders and virus writers.

The intensifying cyber security threats have led countriesto take a variety of countermeasures to protect their criticalinfrastructures. Based on a survey of the research literature,government documents, industry reports, magazines, etc., wehave compiled a chronological list of milestone initiativesfocused on cyber security that have been undertaken world-wide. Fig. 1 presents the principal cyber security initiatives.Note that the list of initiatives is indicative and is by nomeans exhaustive.

2.3. Measures taken by India to secure cyberspace

The rapid growth of the information technology/informationand communications technology and business process out-sourcing sectors in India has inevitably increased the risk ofcyber attacks against government and business. The sophis-ticated use of technology in the 26/11 Mumbai terror attacksis a pointer to the havoc that can be wreaked by cyber terrorattacks on the critical infrastructure. Data released by theNational Crime Records Bureau (NCRB) [39] shows that thenumber of cyber crime cases registered in 2009 was 420, andthe number more than doubled in just one year to 966 in2010. Meanwhile, the Indian Computer Emergency ResponseTeam (CERT-In) [39] tracked 219 cases of government websitedefacement by various hacker groups during the ten monthsfrom January to October, 2011.

As a first step towards information technology security inIndia, The Information Technology Act was set to law in June2000; this act was subsequently amended in February 2009.The act provides the legal framework to control cyber crimein India. In August 2007, the Standardisation Testing andQuality Certification (STQC) Directorate (an office of theDepartment of Electronics and Information Technology, Gov-ernment of India) [40] issued guidelines for Indian govern-ment organizations covering eleven steps for implementing acomplete information security management program withISO/IEC 27001 certification. In January 2009, the NationalInformatics Centre (NIC) of the Department of InformationTechnology, Ministry of Communications and InformationTechnology released comprehensive guidelines for Indiangovernment websites.


Motivated by the heightened cyber threat and increasingnumbers of attacks on critical infrastructures in India andabroad, in March 2011, the Ministry of Communications andInformation Technology of the Government of India releaseda draft National Cyber Security Policy (NCSP) [41]. The draftpolicy aims at creating a centralized unit for the managementof cyber security of critical infrastructures. The policy iden-tifies agencies that would protect Indian systems and cyberspace against cyber threats, vulnerabilities and attacks.Table 3 lists the stakeholder agencies involved in the protec-tion of India's critical infrastructure as described in the draftpolicy.

The draft policy recommends the creation of a NationalCyber Security Coordinator, who would report to the NationalSecurity Advisor, to oversee a cyber plan with three compo-nents that segregate responsibilities and authority. Theexisting CERT-In would be tasked to handle the commercialaspects of cyber security, including 24�7 proactive responsesto hackers, cyber attacks, intrusions and restoration ofaffected systems. The second aspect of the cyber plan is thecreation of a technical-professional body that certifies thesecurity of networks to ensure the overall health of govern-ment systems. The third aspect of the plan is the cyberdefense of critical infrastructure networks that are vulnerableto hostile foreign governments and their proxies.

NASSCOM (a non-profit, non-government organizationthat promotes the growth of information technology andoutsourcing industries in India) and the Data Security Councilof India (an independent self-regulatory organization set upby NASSCOM for acting as a focal body for data protection inIndia) have created a Cyber Security Advisory Group (CSAG) towork on recommendations for public–private partnershipsrelated to capacity building and policy making in the area ofcyber security in India. The CSAG's April 2012 report entitled“Securing Our Cyber Frontiers” [42] provides ten key recom-mendations to government and industry for safeguardingIndia's cyber space and critical infrastructure. The recom-mendations are to: (i) create a national structure for cybersecurity; (ii) design and implement a competency framework;(iii) create and maintain an inventory of the critical informa-tion infrastructure; (iv) establish a center of excellence forbest practices in cyber security; (v) establish a national threatintelligence center; (vi) build the capacity of law enforcementagencies; (vii) build lawful interception capabilities for balan-cing national security and economic growth; (viii) establish acenter of excellence for cyber security research; (ix) set uptesting laboratories for the certification of information andcommunications technology products; and (x) establish acyber command within the military to defend India’s cyber-space. The CSAG report also discusses global and Indianinitiatives related to cyber security and highlights learningsand imperatives for India.

3. Research methodology and data analysis

Thirteen Indian critical infrastructure sectors were identifiedin this study. The ISM technique was employed to discoverthe dependencies existing among the thirteen critical infra-structure sectors. MICMAC analysis was used to divide the





Table 3 – Stakeholder agencies recommended for the protection of India's critical infrastructure.

� National Information Board (NIB): NIB is an apex agency headed by the National Security Advisor with representatives from relevant departmentsand agencies that form part of the critical minimum information infrastructure in the country. NIB has the responsibility of enunciatingthe national policy on information security and coordinating all aspects of information security governance in the country.

� National Crisis Management Committee (NCMC): NCMC is an apex body of the Government of India that deals with major crisis incidentsthat have serious national ramifications.

� National Security Council Secretariat (NSCS): NSCS is the apex agency that focuses on political, economic, energy and strategic security concernsin India.

� Ministry of Home Affairs (MHA): MHA issues security guidelines from time to time to secure physical infrastructures in India.� Ministry of Defence (MoD): MoD is the nodal tri-services agency at the national level for cyber security incident response with respect

to defense sector.� Department of Information Technology (DIT): DIT, which falls under the Ministry of Communications and Information Technology of the

Government of India, strives to make India a global player in information technology and ensure that the benefits of informationtechnology impact every walk of life.

� Department of Telecommunications (DoT): DoT, which falls under the Ministry of Communications and Information Technology of theGovernment of India, is responsible for coordinating with all ISPs in India. It also provides guidelines to private service providersregarding network availability and safeguarding networks against physical attacks.

� National Cyber Response Centre – Indian Computer Emergency Response Team (CERT-In): CERT-In monitors India's cyberspace and coordinates alertsand warnings of imminent attacks and detection of malicious attacks targeting public and private entities in the country.

� National Information Infrastructure Protection Centre (NIIPC): NIIPC is an agency designated to protect India's critical information infrastructure.It gathers intelligence and monitors emerging and imminent cyber threats in strategic sectors, including national defense.

� National Disaster Management Authority (NDMA): NDMA is the apex body for disaster management in India and is responsible for creatingan enabling environment to resolve and mitigate the damage and destruction caused by natural and man-made disasters.

� Standardisation, Testing and Quality Certification (STQC) Directorate: STQC is a DIT agency and an assurance service providing organization. STQChas established a nationwide infrastructure and has developed competence to provide quality assurance and conformity assessment servicesin the information technology sector, including information security and software testing/certification.

� Sector CERTs: Sector CERTs in various sectors (e.g., Defense, Finance (IDRBT), Railways, Petroleum and Natural Gas) would interactand work closely with CERT-In to mitigate crises that affect their constituencies.

Table 4 – Identified critical infrastructure sectors and vital products or services in India.

No. Critical infrastructure sector Vital products or services

1 Agriculture and Food Production, Processing and Distribution2 Banking and Finance Banks, Financial Services and Taxation3 (Tele) Communications Mobile, Radio and Satellite Communications and Permanent Telecommunications

Infrastructure4 Critical Manufacturing

IndustriesChemicals, Metals, Machinery and Electrical Equipment

5 Defense Industrial Base Defense Research and Production6 Emergency Services Police, Fire Brigade, Ambulance and Disaster Management7 Energy Electricity, Nuclear Plants, Gas, Oil, Dams8 Healthcare Healthcare Services and Systems9 Information Technology Data Centers, Internet Infrastructure and Access

10 National Icons and Monuments Parliament, Museums, National Monuments11 Postal and Shipping Mail and Courier Services12 Transportation Roads, Highways, Bridges, Railways, Airways, Ports, Waterways and Pipelines13 Water Supply Drinking Water and Irrigation water


set of critical infrastructure sectors into four categories.This section describes the research methodology and dataanalysis.

3.1. Critical infrastructure sector identification

A systematic and rigorous process was applied to arrive at thelist of thirteen critical infrastructure sectors for the Indiancontext (Table 4). The process involved three distinct phases:exploring relevant literature on the subject, brainstormingsessions with experts, and one-on-one interviews withexperts. To elicit a wide range of perspectives, a blend ofexperts from industry, academia and government were


involved in the process. Details of the three phases of theprocess are given below.

Phase 1 (Literature Review): Relevant journal articles, gov-ernment documents and industry reports were consultedand a comprehensive list of 22 critical infrastructuresectors was drawn up (Table 5). The list of thirteen criticalinfrastructure sectors for the Indian context was, however,identified independently through the brainstorming ses-sions (Phase 2) and interview sessions (Phase 3). Thesethirteen critical infrastructure sectors were also found tobe present in the list of 22 critical infrastructure sectorsidentified during the literature review (Phase 1).





Table 5 – Sources used to identify India's critical infrastructure sectors.

No. Critical infrastructure sectors Literature sources

1 Agriculture and Food Rinaldi et al. [9]; Yusufovna et al. [48]; Fisher and Norman [49]; FOIS-Germany [5];US-GAO [8]; CPNI-UK [50]; CIRS-Australia [7]

2 Banking and Finance Rinaldi et al. [9]; Yusufovna et al. [48]; Fisher and Norman [49]; US-GAO [8];FOIS-Germany [5]; CPNI-UK [50]; CIRS-Australia [7]

3 Central/State Government FOIS-Germany [5]4 Chemical Industry Rinaldi et al. [9]; Fisher and Norman [49]; US-GAO [8]5 Commercial Facilities Fisher and Norman [49]; US-GAO [8]6 (Tele) Communications/Information and

Communications TechnologyRinaldi et al. [9]; Fisher and Norman [49]; FOIS-Germany [5]; US-GAO [8];CPNI-UK [50]; CIRS-Australia [7]

7 Critical Manufacturing Yusufovna et al. [48]; Fisher and Norman [49]; US-GAO [8]8 Dams Fisher and Norman [49]; US-GAO [8]9 Defense Industrial Base Fisher and Norman [49]; US-GAO [8]

10 Energy Resources Rinaldi et al. [9]; Yusufovna et al. [48]; Fisher and Norman [49]; FOIS-Germany [5];US-GAO [8]; CPNI-UK [50]; CIRS-Australia [7]

11 Emergency/Rescue Services Fisher and Norman [49]; US-GAO [8]; CPNI-UK [50]12 Government Services Yusufovna et al. [48]; Fisher and Norman [49]; US-GAO [8]; CPNI-UK [50]13 Healthcare Services/Public Health Rinaldi et al. [9]; Yusufovna et al. [48]; Fisher and Norman [49]; FOIS-Germany [5];

US-GAO [8]; CPNI-UK [50]; CIRS-Australia [7]14 Intellectual Property Yusufovna et al. [48]15 Law and Legislation Yusufovna et al. [48]16 Media and Culture FOIS-Germany [5]17 National Monuments and Icons Yusufovna et al. [48]; Fisher and Norman [49]; US-GAO [8]18 Nuclear Reactors, Materials and Waste Fisher and Norman [49]; US-GAO [8]19 Oil and Natural Gas Production Rinaldi et al. [9]20 Postal and Shipping Fisher and Norman [49]; US-GAO [8]21 Transportation/Logistics/Distribution Rinaldi et al. [9]; Yusufovna et al. [48]; Fisher and Norman [49]; FOIS-Germany [5];

US-GAO [8]; CPNI-UK [50]; CIRS-Australia [7]22 Water Supply Rinaldi et al. [9]; Fisher and Norman [49]; FOIS-Germany [5]; US-GAO [8];

CPNI-UK [50]; CIRS-Australia [7]


Phase 2 (Brainstorming Sessions): Panels of subject matterexperts were assembled and three brainstorming sessionswere conducted with them. The expert panels comprisedsenior officials from various government departments,executives and managers from industry, and academicswith specialties in the subject areas. Each of the threesessions involved a different panel of experts. Views weresolicited on how the critical infrastructure sectors mightbe related and might be dependent on each other.A summary profile of experts is provided in Table 6.To preserve their privacy, the identities and affiliationsof the experts are not listed.Phase 3 (One-to-One Interviews): Interviews were conducted tofurther explore and clarify the dependencies existing amongthe critical infrastructure sectors. Open-ended questions wereasked to help identify the various critical infrastructuresectors and to discover the dependencies existing amongthem, keeping in mind the Indian context. The brainstormingand interview sessions helped elucidate the relationshipsexisting among the identified critical infrastructure sectors,which served as input to the ISM technique.

3.2. Interpretive structural modeling

ISM, first proposed by Warfield in 1973 [43], is a computer-assisted learning process that enables individuals or groups


involved in a complex situation to identify relations in theform of dependencies. It reveals the driving and dependentelements of a situation or scenario. Furthermore, it dividesthe elements into certain hierarchies and provides a graphi-cal representation based on the driving and dependentnature of the elements.

3.2.1. MethodologyThe following seven steps are involved in the ISM methodology:

Step 1: Contextual relationships are established amongthe identified critical infrastructure sectors.Step 2: A structural self-interaction matrix (SSIM) isdeveloped, which indicates dependencies among the cri-tical infrastructure sectors under consideration.Step 3: A reachability matrix is developed from the SSIMand this reachability matrix is checked for transitivity (i.e.,if A is related to B and B is related to C, then A isnecessarily related to C).Step 4: The reachability matrix obtained in Step 3 ispartitioned into different levels. A directed graph is drawnbased on the relationships and the transitive links areremoved.

Step 5: The diagraph obtained in Step 4 is converted into anISM by replacing infrastructures with notional elements.

Step 6: The ISM developed in Step 5 is checked forconceptual inconsistencies and the necessary modifica-tions are made.





Table 6 – Profiles of experts who participated in the brainstorming and interview sessions.

Experts Expert profile/designation Work experience Expert category

Expert 1 Professor, Management Information System 420 Years AcademiaExpert 2 Professor, Information Technology and Security 10–15 YearsExpert 3 Professor, Risk Analysis and Management 10–15 YearsExpert 4 Professor, Organizational Behavior 15–20 YearsExpert 5 Professor, Systems Design and Architectural Planning 15–20 YearsExpert 6 Professor, Organization Management 420 YearsExpert 7 Assistant Professor, Information Systems Security 5–10 Years

Expert 8 CEO, IT/ICT Company “VBZ” 420 Years IndustryExpert 9 CEO, Advisory and Support Company “SDH” 420 YearsExpert 10 CISO, IT Company “ABC” 15–20 YearsExpert 11 CEO, Telecommunications Company “XYZ” 10–15 YearsExpert 12 Director, Consulting Firm “ASD” 420 YearsExpert 13 VP-Technical, Infrastructure Solutions Company “LKP” 10–15 YearsExpert 14 Senior Consultant, World Bank 15–20 YearsExpert 15 e-Gov Consultant, Company “QCU” 10–15 YearsExpert 16 Manager Operations, Telecommunications Company “NOP” 10–15 YearsExpert 16 Information Security Manager, Systems Company “SXA” 5–10 YearsExpert 18 Security Expert, Bank “VBD” 10–15 YearsExpert 19 System Analyst, Financial Advisory Firm “HUD” 10–15 YearsExpert 20 Senior Database and Security Administrator, Technology Firm “POT” 15–20 Years

Expert 21 Director, CERT-In 420 Years GovernmentExpert 22 Director, Sector CERT-In Division 420 YearsExpert 23 Inspector General, Police Department “PQR” 15–20 YearsExpert 24 Technical Director, Government Department “DEF” 420 YearsExpert 25 Retired Air Commodore, Defense Forces 420 YearsExpert 26 Executive Director, Indian Railways Division “RST” 15–20 YearsExpert 27 Scientist C, Government Security Agency “XQH” 10–15 YearsExpert 28 Senior Engineer, Architecture Planning, Department “DFG” 10–15 YearsExpert 29 Consultant e-Gov, Ministry “ZXV” 10–15 YearsExpert 30 Senior Programmer, Government Division “ORP” 5–10 Years


Step 7: MICMAC analysis is conducted, during which thethirteen critical infrastructure sectors are classified intofour groups: (i) autonomous; (ii) dependent; (iii) linkage;and (iv) independent (driver).

3.2.2. Developing hierarchal relationshipsA structural self-interaction matrix (SSIM) is created in orderto develop the hierarchical relationships among the ele-ments. In particular, the SSIM is used to define the natureof relationship between any two elements. The processinvolves determining whether or not a relationship existsbetween two infrastructures i and j, and determining thedirection of association if a relationship exists. Table 7specifies the infrastructure relationships and the directionsof the relationships obtained based on expert knowledge andjudgments.

Next, the SSIM is transformed into a binary matrix, calledthe initial reachability matrix, by checking for transitivityaccording to Step 3 above. Table 8 shows the final reachabilitymatrix obtained after considering all the transitive relation-ships. The rules for substituting 1 and 0 values in the finalreachability matrix are as follows:

�

Ps

If the (i, j)th entry in the SSIM is V, then the (i, j)th entry inthe reachability matrix becomes 1 and the (j, i)th entrybecomes 0.

lease cite this article as: A.N. Singh, et al., Identifying criticacenario, International Journal of Critical Infrastructure Protecti

�

l inon

If the (i, j)th entry in the SSIM is A, then the (i, j)th entry inthe reachability matrix becomes 0 and the (j, i)th entrybecomes 1.

�
If the (i, j)th entry in the SSIM is X, then the (i, j)th entry inthe reachability matrix becomes 1 and the (j, i)th entry alsobecomes 1.
�
If the (i, j)th entry in the SSIM is O, then the (i, j)th entry inthe reachability matrix becomes 0 and the (j, i)th entry alsobecomes 0.
Having obtained the final reachability matrix, the drivingpower and dependence of each element (critical infrastruc-ture sector) are computed. The driving power of an element isthe total number of critical infrastructure sectors (includingitself) that depend on the element. The dependence is thetotal number of critical infrastructure sectors on which anelement depends. Fig. 2 shows the driving power and depen-dence of the critical infrastructure sectors in the form of a2�2 matrix. The matrix divides the critical infrastructuresectors into four groups based on their driving power anddependence on other sectors.

It is evident from Fig. 2 that the Energy, InformationTechnology and (Tele) Communications sectors have a higherdriving power than the other sectors. Since these sectorsdrive others, the wellbeing of the other sectors is very much

frastructure sectors and their dependencies: An Indian(2014), http://dx.doi.org/10.1016/j.ijcip.2014.04.003




Table 7 – SSIM matrix for critical infrastructure sectors (V: infrastructure j depends on infrastructure i; A: infrastructure i depends on infrastructure j; X: infrastructures i andj are interdependent; O: infrastructures i and j are unrelated).

Elements (j) (i) 13 12 11 10 9 8 7 6 5 4 3 2 Critical infrastructure sectors

1 A A O O A O A O O O A O 1 Agriculture and Food2 O O O O A O A O O O A 2 Banking and Finance3 O V V V X V A V V V 3 (Tele) Communications4 O A O O A O A O O 4 Critical Manufacturing5 O A O O A O A O 5 Defense Industrial Base6 O O O V A V A 6 Emergency Services7 V V V V V V 7 Energy8 O O O O A 8 Healthcare9 O V V V 9 Information Technology

10 O O O 10 Monuments and Icons11 O A 11 Postal and Shipping12 O 12 Transportation

13 Water Supply

Table 8 – Final reachability matrix constructed from the SSIM.

Elements (j) (i) 1 2 3 4 5 6 7 8 9 10 11 12 13 Driving power Critical infrastructure sectors

1 1 0 0 0 0 0 0 0 0 0 0 0 0 1 Agriculture and Food2 0 1 0 0 0 0 0 0 0 0 0 0 0 1 Banking and Finance3 1 1 1 1 1 1 0 1 1 1 1 1 0 11 (Tele) communications4 0 0 0 1 0 0 0 0 0 0 0 0 0 1 Critical Manufacturing5 0 0 0 0 1 0 0 0 0 0 0 0 0 1 Defense Industrial Base6 0 0 0 0 0 1 0 1 0 1 0 0 0 3 Emergency Services7 1 1 1 1 1 1 1 1 1 1 1 1 1 13 Energy8 0 0 0 0 0 0 0 1 0 0 0 0 0 1 Healthcare9 1 1 1 1 1 1 0 1 1 1 1 1 0 11 Information Technology10 0 0 0 0 0 0 0 0 0 1 0 0 0 1 Monuments and Icons11 0 0 0 0 0 0 0 0 0 0 1 0 0 1 Postal and Shipping12 1 0 0 1 1 0 0 0 0 0 1 1 0 5 Transportation13 1 0 0 0 0 0 0 0 0 0 0 0 1 2 Water SupplyDependence 6 4 3 5 5 4 1 5 3 5 5 4 2

international

journal

of

critical

infrastructure

protection

](]]]])]]]–]]]

8

Pleasecite

this

articleas:

A.N

.Sin

gh,et

al.,Iden

tifying

criticalinfrastru

cture

sectors

and

their

dep

enden

cies:An

Indian

scenario

,Intern

ational

Journ

alofCritical

Infrastru

cture

Protectio

n(2014),

http

://dx.d

oi.o

rg/10.1016/j.ijcip.2014.04.003




Fig. 2 – Driving power and dependence of critical infrastructure sectors.

Table 9 – Final iteration results and level partitioning.

Iteration Elements (CI sectors) selected Levels

1 1 and 8 I2 6 and 10 II3 4, 5 and 11 III4 2, 12 and 13 IV5 3 and 9 V6 7 VI


dependent on the proper functioning of these sectors. Othersectors such as Transportation, Emergency Services, Bankingand Finance, and Critical Manufacturing have higher depen-dence values, which indicate the dependence of these sectorson other sectors.

Next, the final reachability matrix in Table 8 is partitionedinto different levels by assessing the reachability and theantecedent sets for each element. In our case, the process iscompleted in six iterations. Table 9 shows the final levelvalues of the sectors. These levels express the hierarchy ofthe critical infrastructure sectors.

In the next step, a structural model is generated on thebasis of the partitioned levels. The resulting graph that isproduced is called a diagraph. Upon removing all the transi-tivity, the diagraph is finally converted to the ISM modelshown in Fig. 3.

The ISM diagram in Fig. 3 shows that the Energy sector atLevel VI is the highest depth driver among all the criticalinfrastructure sectors (because it is at the very bottom of thehierarchy). This sector drives all the other sectors that areconnected to it directly or indirectly in the hierarchy. TheInformation Technology and (Tele) Communications sectorsare at Level V in the hierarchy. These two sectors have thenext highest driving power for the sectors above them in thehierarchy. As we move up the hierarchy from Level VI toLevel I, the driving nature of the critical infrastructure sectorsdecreases and their dependence the critical infrastructuresectors below them increases. Sectors in the middle of thehierarchy (Levels IV and III) help drive the sectors above them


in the hierarchy, but at the same time are dependent on thesectors below them in hierarchy. Finally, the sectors at LevelsI and II are highly dependent on the other critical infrastruc-ture sectors because they are at the top of the hierarchy.

3.3. MICMAC analysis

MICMAC analysis is conducted to obtain new insights intothe dependencies existing among the critical infrastructuresectors identified by the ISM technique. Developed in 1973 byDuperrin and Godet [44], MICMAC enables a systematicanalysis of complex issues. The objective of MICMAC analysisis to examine the elements on the basis of their driving powerand dependence [45] and to cluster them accordingly.To obtain the key variables in a system, MICMAC classifiesthe elements depending on their relationships and the levelsto which they affect one another. Researchers have usedMICMAC analysis in a variety of fields, including logistics,supply chain and risk analysis [44].

MICMAC analysis requires a direct relationship matrix, asshown in Table 10, which is obtained by examining the directrelations between elements (critical infrastructure sectors inour case) in the ISM diagraph. This matrix is then multipliedwith itself 2, 3, 4,…, n times to find the interconnectinginfluence paths of the 2nd, 3rd, 4th,.…, nth order. Theiteration is terminated when the resultant matrix becomesstable in terms of the driving power and dependence ranks ofthe elements. In our analysis, the direct relationship matrixbecomes stable after the second iteration (Table 11).

Following this, the thirteen critical infrastructure sectorsare classified into four clusters based on their driving powerand dependence ranks. The results are shown in Fig. 4. Thefirst cluster consists of critical infrastructure sectors thathave low driving power but high dependency. Because of thisnature, they are termed as “dependent critical infrastructuresectors” (Cluster I). The infrastructures in these sectors aremore vulnerable because they are highly dependent on theirsupport infrastructures. Our analysis reveals that Bankingand Finance, Transportation, Emergency Services, Agriculture





Fig. 3 – ISM diagram of the critical infrastructure sectors.


and Food, Critical Manufacturing, Postal and Shipping,Defense Industrial Base, Healthcare, and National Icons andMonuments lie in Cluster I. Indeed, nine of the thirteenidentified critical infrastructure sectors lie in this cluster,which is problematic because of the high dependence ofthese sectors and their potential vulnerability.

The second cluster, Cluster II, consists of critical infrastruc-ture sectors that have low driving power and low dependence.These sectors are relatively disconnected from the overallcritical infrastructure and are, therefore, referred to as “auton-omous critical infrastructure sectors.” The sectors includeWater Supply, (Tele) Communications, and Information Tech-nology. Further, it can be seen in Fig. 4 that the InformationTechnology and (Tele) Communications sectors are locatednear the central line of driving power rank; this is indicativeof the relatively high driving property of these sectors. This isalso evident in the ISM graph shown in Fig. 3. Indeed, Informa-tion Technology and (Tele) Communications provide backboneinfrastructure support for the other sectors and, therefore, thetwo sectors stand out as potential targets for malicious entities.

Sectors in Cluster III, referred to as “linkage criticalinfrastructure sectors,” have high driving power and highdependency characteristics, which render them unstable.No critical infrastructure sectors are found in Cluster III.However, this is a matter of sector definition and the assign-ment of sectors to this cluster also depends on the analyticalapproach. If the critical infrastructure sectors are brokendown into their constituent vital products or services, it ispossible that some of the sectors assigned to other clustersmight be placed in Cluster III. However, such an analysis isbeyond the scope of this paper because the principal objec-tive is to identify the Indian critical infrastructure sectors andto clarify their dependencies.


Sectors in Cluster IV, called “independent or driver criticalinfrastructure sectors,” have high driving power and lowdependence. The Energy sector lies in this cluster. In fact,the ISM diagram in Fig. 3 also reveals that Energy is a highdepth driver (Level VI) for the other critical infrastructuresectors. Because of its high driving power, any disruption ofthe Energy sector can lead to adverse impacts to othersectors. This was evident during the massive power gridfailures in India in July 2012 [3].

Thus, the MICMAC analysis adds valuable insights to theISM results. The most connected infrastructure sectors in theISM diagraph in Fig. 3 are precisely the sectors that are highlycritical according to the MICMAC analysis.

4. Discussion

This section discusses the ISM and MICMAC results and theirimplications

4.1. Analysis of results

The ISM results are consistent with the key empirical findingof Luiijf et al. [46] that Energy and Telecommunications(in descending order) are the main cascade initiating sectors.The ISM diagram in Fig. 3 also has hierarchical dependenciesbetween critical infrastructure sectors that are generallyconsistent with the framework presented by Rinaldi et al. [9].It must be noted, however, that the conceptual framework ofRinaldi et al. [9] focuses on the effects at the level of concreteinfrastructure objects/services, whereas this research focusesat a higher level of abstraction involving entire critical infra-structure sectors.





Tab

le10

–Direc

trelation

ship

matrix.

Elem

ents

(j)(i)

12

34

56

78

910

1112

13Drivingpow

erCritica

linfras

tructure

sectors

10

00

00

00

00

00

00

0Agriculture

andFo

od

20

00

00

00

00

00

00

0Ban

kingan

dFinan

ce3

11

01

11

01

11

11

010

(Tele)

Communications

40

00

00

00

00

00

00

0Critica

lMan

ufacturing

50

00

00

00

00

00

00

0Defen

seIndustrial

Bas

e6

00

00

00

01

01

00

02

Emerge

ncy

Services

71

11

11

10

11

11

11

12En

ergy

80

00

00

00

00

00

00

0Hea

lthca

re9

11

11

11

01

01

11

010

Inform

ation

Tec

hnology

100

00

00

00

00

00

00

0Monumen

tsan

dIcons

110

00

00

00

00

00

00

0Po

stal

andSh

ipping

121

00

11

00

00

01

00

4Transp

ortation

131

00

00

00

00

00

00

2W

ater

Supply

Dep

enden

ce5

32

44

30

42

44

31



The MICMAC analysis results (Fig. 4) are generally consis-tent with the categorization of Luiijf et al. [46] of criticalinfrastructure failure events as: cascade initiating, cascaderesulting and independent. For example, Cluster I (low driv-ing power and high dependence) contains critical infrastruc-ture sectors that have cascade resulting events, since theseare dependent critical infrastructure sectors. On the otherhand, Cluster II (low driving power and low dependence)sectors have independent failure events because of theirautonomous nature. Also, Cluster IV (high driving powerand low dependence) sectors are cascade initiating becauseof their driving nature. Although the Information Technologyand (Tele) Communications sectors fall in Cluster II (inde-pendent cascade events), they are relatively close to the highdriving power cluster.

4.2. Implications for government and businesses

While every critical infrastructure sector is vital to a country'seconomic and societal wellbeing, in the face of budgetaryconstraints, it is necessary to prioritize the allocation ofresources for critical infrastructure protection. The ISM resultsin Fig. 3 reveal that that the Energy, Information Technologyand (Tele) Communications sectors can generate cascadeinitiating events that would adversely affect the other criticalinfrastructure sectors. For this reason, India's federal, stateand local governments should assign relatively high priority toprotecting critical infrastructure assets in the three sectors.Organizations operating in these critical infrastructure sectorsalso must assess their vulnerability to cyber and other attacks,and implement the appropriate protection measures.

The critical infrastructure sectors that exhibit high degreesof dependence (e.g., Agriculture and Food, and Healthcare)would inevitably remain vulnerable to cascade initiatingevents in sectors such as Energy, Information Technologyand (Tele) Communications. Therefore, measures that wouldincrease the fault tolerance of highly dependent criticalinfrastructure sectors to failures of other critical infrastruc-ture sectors and services should be implemented. It isimportant to note that the degrees of criticality of highlydependent critical infrastructure sectors and services aretypically not uniform across a country. For example, adisruption of suburban railway services in a metropolis likeMumbai is a much more serious event than a disruption ofcompressed natural gas (CNG) based bus services in a smalltown. Policy makers and other stakeholders must considerthis aspect when prioritizing the protection of highly depen-dent critical infrastructure sectors and services.

Upon reviewing the ISM results, it is clear that severalcritical infrastructure sectors (e.g., Energy, (Tele) Communi-cations and Healthcare) involve public sector and privatesector entities. A few decades ago, the state had almost acomplete monopoly in India's Energy and (Tele) Communica-tions sectors, among others. However, this situation haschanged considerably, and increasing numbers of privatesector entities are entering most critical infrastructuresectors. Therefore, government entities will need to engagewith private sector entities, especially with regard to theprotection of critical infrastructure assets that are underprivate control. But this may not be an easy task because





Table 11 – Matrix stabilization (DP: driving power; D: dependence).

No. Critical infrastructure sectors Ranks

M1 M2 M3 M4 M5

DP D DP D DP D DP D DP D

1 Agriculture and Food 3 1 3 1 3 1 3 1 3 12 Banking and Finance 3 3 3 2 3 2 3 2 3 23 (Tele) Communications 2 4 2 3 2 3 2 3 2 34 Critical Manufacturing 3 2 3 1 3 1 3 1 3 15 Defense Industrial Base 3 2 3 1 3 1 3 1 3 16 Emergency Services 3 3 3 2 3 2 3 2 3 27 Energy 1 5 1 4 1 4 1 4 1 48 Healthcare 3 2 3 1 3 1 3 1 3 19 Information Technology 2 4 2 3 2 3 2 3 2 3

10 Monuments and Icons 3 2 3 1 3 1 3 1 3 111 Postal and Shipping 3 2 3 1 3 1 3 1 3 112 Transportation 3 3 3 2 3 2 3 2 3 213 Water Supply 3 5 3 4 3 4 3 4 3 4

Fig. 4 – MICMAC analysis results (driving power and dependence ranks).


private entities could, on grounds of confidentiality, refuse toreveal information to the government about their criticalinfrastructure protection efforts. For this reason, appropriatelegal and regulatory frameworks will have to be created toensure that all the participating entities and the variousstakeholders are cognizant of and fulfill their obligationswith respect to critical infrastructure protection.

4.3. Research contribution

Previous research has focused on the identification of criticalinfrastructure sectors and strategies for critical infrastructureprotection in the context of developed countries. However, inIndia, because vast segments of the infrastructure are them-selves being constructed at a rapid pace, the designation ofassets as critical infrastructures and the protection of thesecritical infrastructures are essentially “moving problems.”Viewed in this light, the current research is important


because it provides a methodology for continually identifyingcritical infrastructure assets and exploring their dependen-cies, and thereby stimulating critical infrastructure efforts inthe Indian environment.

5. Expert viewpoints and suggestions

During the course of the brainstorming sessions and inter-views, the participating experts provided several viewpointsand suggestions. The following expert viewpoints and sug-gestions would be interest to researchers and policy planners.

5.1. Identification of critical infrastructures anddependencies

�

l inon

An exhaustive list of critical infrastructure sub-sectors,and their services and dependencies must be identified.

frastructure sectors and their dependencies: An Indian(2014), http://dx.doi.org/10.1016/j.ijcip.2014.04.003





�
A separate designated authority must coordinate infra-structure protection measures for each critical infrastruc-ture sector.
5.2. Policy, legislation and implementation

�

Ps

Organizations must define policies for protecting theirinfrastructures across all of their units.

�
Challenges associated with policy frameworks, laws andgovernance must be reviewed at the national and inter-national levels. All gaps must be addressed in a timelymanner.
�
Policy implementation and monitoring should be auto-mated to the extent possible.
�
The implementation of ad hoc solutions for cyber securityshould be stopped and organizations should adopt inter-national standards and best practices for cyber security.
�
Regulations should be formulated that mandate organiza-tions to follow a minimum set of rules, laws, standardsand guidelines related to critical infrastructure protection.
�
In the face of financial and other resource constraints inimplementing cyber security measures, it is important torank and prioritize critical infrastructure sectors and services.
�
The Internet and developments such as cloud computinghave removed the physical boundaries of data. Appropri-ate arrangements must be put in place to deal with legalissues regarding data/information protection across inter-national boundaries.
�
To deal with disasters in an effective manner, the relevantpublic and private sector entities must develop contin-gency plans for critical infrastructure sectors and services.
5.3. Engagement of key players and internationalcooperation

�
Since critical infrastructures are owned by public andprivate sector entities, appropriate mechanisms are requiredto promote interactions between the two types of entities.Previous research [46,47] has highlighted the need for strongpartnerships between governments, private stakeholders, andresearch and development organizations.
�
An international organization should be set up for improvedcoordination among countries on cyber security issues.
6. Limitations and future work

This research has some limitations. First, the study primarilyengaged experts with specialties in information systems andcyber security. Future research should attempt to incorporatedomain experts and stakeholders from across the variouscritical infrastructure. A second limitation is that the ISMand MICMAC models used in the study focused on criticalinfrastructure sectors at a macro level; such an approachobscures the dependencies existing among critical infrastruc-ture services. Future research should attempt to explore

lease cite this article as: A.N. Singh, et al., Identifying criticacenario, International Journal of Critical Infrastructure Protecti

dependencies at the level of critical infrastructure services;the investigation of dependencies could employ a processmodel approach as suggested by Nieuwenhuijs et al. [10].

Other avenues for research include assembling empiricaldata about cascading critical infrastructure failure events thathave occurred in India and utilizing the data to verify the ISMand MICMAC results obtained in this research. The expertviewpoints presented in the previous section also represent arich set of ideas to explore in future research. Finally, futureresearch efforts should attempt to apply formal qualitativemethods when engaging with critical infrastructure expertsand stakeholders in order to produce results and recommen-dations that have increased fidelity.

7. Conclusions

This study has sought to identify India's critical infrastruc-ture sectors and understand the dependencies that existamong the sectors. Based on input received from experts,the critical infrastructure sectors were identified and an ISMmodel was developed to bring out the hierarchical depen-dencies existing among the identified critical infrastructuresectors. Next, MICMAC analysis was conducted to cluster theidentified critical infrastructure sectors. The ISM and MIC-MAC analysis results generally agree with the results ofprevious research conducted in other countries.

The results of the study broadly show that the Energy,Information Technology and (Tele) Communications sectorshave a high driving power and are, therefore, capable ofaffecting many other dependent critical infrastructuresectors. The results of the study can help strategize protec-tion efforts and prioritize the protection of critical infrastruc-ture sectors. This study is a vital initial step in the study ofIndia's critical infrastructure sectors and their dependencies.It is hoped that the work will stimulate much needed researchon understanding the nature of India's critical infrastructureand developing cost-effective protection schemes for assetsand services across India's critical infrastructure sectors.

r e f e r e n c e s

[1] R. Chung, January 17, 1995 Hyogoken-Nanbu (Kobe) Earthquake:Performance of Structures, Lifelines and Fire ProtectionSystems, National Institute of Standards and Technology,Gaithersburg, Maryland, 1996 (NIST Special Report 901).

[2] B.B.C. News, 1995, Earthquake devastates Kobe (news.bbc.co.uk/onthisday/hi/dates/stories/january/17/newsid_3375000/3375733.stm), January 17, 1995.

[3] SBWire, July 2012 Power blackout in Northern India, ⟨www.sbwire.com/press-releases/july-2012-power-blackout-in-northern-india-newreport-175721.htm⟩, October 31, 2012.

[4] R. George, Critical infrastructure protection, Int. J. Crit.Infrastruct. Prot. 1 (2008) 4–5.

[5] Federal Office for Information Security, Cyber SecurityStrategy for Germany, Berlin, Germany, ⟨www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/CyberSecurity/Cyber_Security_Strategy_for_Germany.pdf?_blob=publica-tionFile⟩, 2011.


http://refhub.elsevier.com/S1874-5482(14)00024-9/sbref1




www.sbwire.com/press-releases/july-2012-power-blackout-in-northern-india-newreport-175721.htm





www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/CyberSecurity/Cyber_Security_Strategy_for_Germany.pdf?_blob=publicationFile








[6] Council of the European Union, Council Directive 2008/114/EC of 8 December 2008, Off. J. Eur. Union L 345 (2008) 75–82.

[7] Australian Government, Critical Infrastructure ResilienceStrategy, Canberra, Australia, ⟨www.tisn.gov.au/Documents/AustralianþGovernmentþsþCriticalþInfrastructureþResilienceþStrategy.pdf⟩, 2010.

[8] Government Accountability Office, Critical InfrastructureProtection: DHS has Taken Action Designed to Identify andAddress Overlaps and Gaps in Critical Infrastructure SecurityActivities, Briefing to Congressional Requesters, May 12,2011, GAO-11-537R, Washington, DC, ⟨www.gao.gov/new.items/d11537r.pdf⟩, 2011.

[9] S. Rinaldi, J. Peerenboom, T. Kelly, Identifying understandingand analyzing critical infrastructure interdependencies, IEEEControl Syst. 21 (6) (2001) 11–25.

[10] A. Nieuwenhuijs, E. Luiijf, M. Klaver, Modeling dependenciesin critical infrastructures, in: M. Papa, S. Shenoi (Eds.),Critical Infrastructure Protection II, Springer, Boston,Massachusetts, 2008, pp. 205–213.

[11] R. Setola, S. Porcellinis, M. Sforna, Critical infrastructuredependency assessment using the input-output inoperabilitymodel, Int. J. Crit. Infrastruct. Prot. 2 (4) (2009) 170–178.

[12] R. Little, Controlling cascading failure: understanding thevulnerabilities of interconnected infrastructures, J. UrbanTechnol. 9 (1) (2002) 109–123.

[13] J. Thomas, K. Cook (Eds.), Illuminating the Path: TheResearch and Development Agenda for Visual Analytics, IEEEComputer Society Press, Los Alamitos, California, 2005.

[14] W. Tolone, Interactive visualizations for criticalinfrastructure analysis, Int. J. Crit. Infrastruct. Prot. 2 (3)(2009) 124–134.

[15] T. Macaulay, Assessing operational risk in the financialsector using interdependency metrics, Int. J. Crit. Infrastruct.Prot. 1 (2008) 45–52.

[16] M. Hartong, R. Goel, D. Wijesekera, Security and the U.S. railinfrastructure, Int. J. Crit. Infrastruct. Prot. 1 (2008) 15–28.

[17] C. Restrepo, J. Simonoff, R. Zimmerman, Causes, costconsequences and risk implications of accidents in U.S.hazardous liquid pipeline infrastructure, Int. J. Crit.Infrastruct. Prot. 2 (1–2) (2009) 38–50.

[18] M. Jaatun, E. Albrechtsen, M. Line, I. Tondel, O. Longva, Aframework for incident response management in the petroleumindustry, Int. J. Crit. Infrastruct. Prot. 2 (1–2) (2009) 26–37.

[19] B. McKay, Lessons to learn for U.S. electric grid criticalinfrastructure protection: organizational challenges forutilities in Identification of Critical Assets and AdequateSecurity Measures, in: Proceedings of the Forty-FourthHawaii International Conference on System Sciences, 2011.

[20] D. Rubbelke, S. Vogele, Impacts of climate change onEuropean critical infrastructures: the case of the powersector, Environ. Sci. Policy 14 (1) (2011) 53–63.

[21] W. Allen, D. Fletcher, K. Fellhoelter, Securing criticalinformation and communication infrastructures throughelectric power grid independence, in: Proceedings of theTwenty-Fifth International Telecommunications EnergyConference, 2003, pp. 170–177.

[22] Edison Electric Institute, EEI Principles for Cyber Security andCritical Infrastructure Protection, Washington, DC, 2010.

[23] S. Chiaradonna, F. Giandomenico, P. Lollini, Definition,implementation and application of a model-basedframework for analyzing interdependencies in electric powersystems, Int. J. Crit. Infrastruct. Prot. 4 (1) (2011) 24–40.

[24] M. Beccuti, S. Chiaradonna, F. Di Giandomenico, S. Donatelli,G. Dondossola, G. Franceschinis, Quantification of depen-dencies between electrical and information infrastructures,Int. J. Crit. Infrastruct. Prot. 5 (1) (2012) 14–27.

[25] V. Igure, S. Laughter, R. Williams, Security issues in SCADAnetworks, Comput. Secur. 25 (7) (2006) 498–506.


[26] I. Nai Fovino, A. Carcano, M. Masera, A. Trombetta,An experimental investigation of malware attacks on SCADAsystems, Int. J. Crit. Infrastruct. Prot. 2 (4) (2009) 139–145.

[27] E. Bezerra, E. Nakamura, S. Ribeiro, Criticaltelecommunications infrastructure protection in Brazil, in:Proceedings of the First IEEE International Workshop onCritical Infrastructure Protection, 2005.

[28] J. Rrushi, An exploration of defensive deception in industrialcommunication networks, Int. J. Crit. Infrastruct. Prot. 4 (2)(2011) 66–75.

[29] E. Luiijf, M. Ali, A. Zielstra, Assessing and improving SCADAsecurity in the Dutch drinking water sector, Int. J. Crit.Infrastruct. Prot. 4 (3–4) (2011) 124–134.

[30] H. Tschofenig, M. Arumaithurai, H. Schulzrinne, B. Aboba,How secure is the next generation of IP-based emergencyservices architecture?, Int. J. Crit. Infrastruct. Prot. 3 (1) (2010)41–50.

[31] Y. Rebahi, T. Thanh, M. Tong, F. Lopez, J. Lopez, L. Teixeira,N. Blanco, An IP based platform for emergency calls andreporting, Int. J. Crit. Infrastruct. Prot. 4 (3–4) (2011) 137–153.

[32] F. Hare, J. Goldstein, The interdependent security problem in thedefense industrial base: an agent-based model on a socialnetwork, Int. J. Crit. Infrastruct. Prot. 3 (3–4) (2010) 128–139.

[33] Y. Huang, A. Cardenas, S. Amin, Z. Lin, H. Tsai, S. Sastry,Understanding the physical and economic consequences ofattacks on control systems, Int. J. Crit. Infrastruct. Prot. 2 (3)(2009) 73–83.

[34] S. Rahman, Impact of natural disasters on criticalinfrastructures, Presented at The First BangladeshEarthquake Symposium, 2005.

[35] M. Theoharidou, D. Xidara, D. Gritzalis, A CBK forinformation security and critical information andcommunication infrastructure protection, Int. J. Crit.Infrastruct. Prot. 1 (2008) 81–96.

[36] T. Morris, A. Srivastava, B. Reaves, W. Gao, K. Pavurapu,R. Reddi, A control system testbed to validate criticalinfrastructure protection concepts, Int. J. Crit. Infrastruct.Prot. 4 (2) (2011) 88–103.

[37] R. Gandhi, A. Sharma, W. Mahoney, W. Sousan, Q. Zhu,P. Laplante, Dimensions of cyber-attacks: social, political,economic and cultural, IEEE Technol. Soc. 30 (1) (2011) 28–38.

[38] Government Accountability Office, Critical InfrastructureProtection: Challenges in Securing Control Systems, GAO-04-140T, Washington, DC ⟨www.gao.gov/assets/120/110405.pdf⟩,2003.

[39] Press Information Bureau, Cyber Attacks, Release ID: 77958,Ministry of Communications and Information Technology,Government of India, New Delhi, India, ⟨www.pib.nic.in/newsite/erelease.aspx?relid¼77958⟩, November 30, 2011.

[40] Standardisation Testing and Quality CertificationDirectorate, Information Security Management System,New Delhi, India ⟨www.stqc.gov.in/content/information-security-management-system-isms#CP⟩, 2011.

[41] Department of Information Technology, Discussion Draft onNational Cyber Security Policy, Ministry of Communicationsand Information Technology, Government of India, NewDelhi, India ⟨www.mit.gov.in/sites/upload_files/dit/files/ncsp_060411.pdf⟩, 2011.

[42] Data Security Council of India, NASSCOM-DSCI CyberSecurity Advisory Group Report: Securing Our CyberFrontiers, New Delhi, India ⟨www.dsci.in/node/1092⟩, 2012.

[43] J. Saxena, Sushil, P. Vrat, Policy and Strategy Formulation:An Application of Flexible Systems Methodology, GlobalInstitute of Flexible Systems Management, GIFT Publishing,New Delhi, India, 2006.

[44] H. Hu, S. Chiu, T. Yen, Modified IPA for order-winner criteriaimprovement: a MICMAC approach, J. Appl. Sci. 9 (21) (2009)3792–3803.




www.tisn.gov.au/Documents/Australian+Government+s+Critical+Infrastructure+Resilience+Strategy.pdf








www.gao.gov/new.items/d11537r.pdf

www.gao.gov/new.items/d11537r.pdf















































































www.gao.gov/assets/120/110405.pdf

www.stqc.gov.in/content/information-security-management-system-isms#CP

www.stqc.gov.in/content/information-security-management-system-isms#CP

www.mit.gov.in/sites/upload_files/dit/files/ncsp_060411.pdf

www.mit.gov.in/sites/upload_files/dit/files/ncsp_060411.pdf

www.dsci.in/node/1092












[45] C. Han, L. Liu, M. Rong, Addressing criticality levels in criticalinfrastructure system, in: Proceedings of the IEEEInternational Conference on Systems, Man and Cybernetics,2009, pp. 3965–3970.

[46] E. Luiijf, A. Nieuwenhuijs, M. Klaver, M. van Eeten, E. Cruz,Empirical findings on critical infrastructure dependencies inEurope, in: R. Setola, S. Geretshuber (Eds.), CriticalInformation Infrastructure Security, Springer, Berlin,Heidelberg, Germany, 2009, pp. 302–310.

[47] E. Luiijf, M. Klaver, Protecting a nation’s criticalinfrastructure: the first steps, in: Proceedings of the IEEEInternational Conference on Systems, Man and Cybernetics,vol. 2, pp. 1185–1190, 2004.


[48] F. Yusufovna, F. Alisherovich, M. Choi, E. Cho,F. Abdurashidovich, T. Kim, Research on criticalinfrastructures and critical information infrastructures, in:Proceedings of the Symposium on Bio-Inspired Learning andIntelligent Systems for Security, pp. 97–101, 2009.

[49] R. Fisher, M. Norman, Developing measurement indices toenhance protection and resilience of critical infrastructureand key resources, J. Bus. Contin. Emerg. Plan. 4 (3) (2010)191–206.

[50] Centre for the Protection of National Infrastructure, TheNational Infrastructure, London, United Kingdom, ⟨www.cpni.gov.uk/about/cni⟩.











www.cpni.gov.uk/about/cni

www.cpni.gov.uk/about/cni


