CI-3 Dependency and Interdependency Considerations for Critical Infrastructure

Transcription

1 CI-3 Dependency and Interdependency Considerations for Critical Infrastructure Prepared for: GovSec West 2011 Critical Infrastructure and Key Assets Protection & Response November 15, 2011 Lori Eaton Infrastructure Analyst Associate Infrastructure Assurance Center Argonne National Laboratory Argonne, IL

2 Argonne National Laboratory Multi program science and research center managed by The University of Chicago for the U.S. Department of Energy Located 25 miles southwest of Chicago Staff of about 4,000 (1,800 scientists and engineers) Active infrastructure assurance programs for 15 years Infrastructure Assurance Center helps to protect and assure critical infrastructures and key resources Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 2

3 Argonne Infrastructure Assurance Center (IAC) Goal to provide methodologies, information, analyses, tools, and technologies to inform decisions about infrastructure protection and resilience Capabilities built on 20+ years of critical infrastructure protection support to DOE, DoD, President s Commission on Critical Infrastructure Protection (PCCIP), EMP Commission, DHS, and other organizations Part of Transition Team to standup DHS Large interdisciplinary staff to support infrastructure assurance work Engineers Methodologies Computer scientists Analyses Infrastructure Protection and Resilience Technologies Information and cyber security specialists Geospatial analysts Economists Social scientists Information Tools Argonne Staff, Other National Labs, Academia, Research Centers, Private Sector, Lawyers Regulatory analysts and public policy experts Risk management professionals Decision analysts Educators Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 3

4 COLERAIN-SWITCH-STN.-230 KINGSLAND-230/115 Substation 230-kV Transmission Line 115-kV Tranmission Line FLORIDA CROOKED-RIVER-115 GEORGIA US-NAVAL-SUB-SUPPLY-#2-230 US-NAVAL-SUB-SUPPLY-#1-230 ST.-MARYS-115 Core Capabilities and Expertise Applied to Infrastructure Protection Risk and resilience methodology development and assessment National Regional Local Metrics development and analysis Infrastructure and interdependencies modeling & analysis LEGEND NAVAL SUBMARINE BASE KINGS BAY GIS/visualization tools Decision support systems Training (e.g., risk analysis) Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 4

5 Presentation Outline Definition of Dependencies and Interdependencies Importance to Risk Interdependencies are Complex Types of Interdependencies Effects of Interdependencies Illustrative Infrastructure Interdependencies Interdependencies Lessons Learned Current Interdependencies Research GIS demo Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 5

6 Infrastructure Outages Have Caused Interdependence Problems

7 The Interdependencies Concern Interdependencies lead to the possibility that our infrastructures may be vulnerable in ways they never have been before Physical Cyber Threats Complexity Interdependencies A series of incidents could interact (cascade) across critical infrastructures to degrade the service upon which all depend Intentional exploitation of these new vulnerabilities could have severe consequences for our economy, security, and way of life

8 Infrastructure Interdependencies Dependency and Interdependency are related Dependency refer to the a linkage or connection between two infrastructures through which the state of one influences the state of the other Interdependencies refers to a bidirectional relationship between infrastructures dependent on the other creating a systems of systems Infrastructure linkages vary significantly in scale and complexity The new economy (Internet, e commerce) has important interdependence implications Understanding interdependencies requires identifying how each infrastructure depends on, or is supported by, each of the other infrastructures

9 Definition of Interdependencies The multi or bi directional reliance of an asset, system, network, or collection thereof, within or across sectors, on input, interaction, or other requirement from other sources in order to function properly* Goods/Services Infrastructure j Infrastructure k Goods/Services *United States Department of Homeland Security National Infrastructure Protection Plan

10 Dependencies vs. Interdependencies Interdependencies Bidirectional Dependencies Unidirectional

11 Interdependencies Are Complex Synergies emerge when large sets of components interact with one another Complexity makes prediction of what will happen difficult to predict

12 Dimensions of Interdependencies State of Operation Normal Coupling and Response Behavior Type of Failure Repair/ Restoration Stressed/ Disrupted Business Security Legal/ Regulatory Technical Health/ Safety Environment Infrastructure Characteristics Organizational Operational Cascading Linear/ Complex Loose/ Tight Temporal Escalating Common Cause Spatial Physical Adaptive Inflexible Cyber Public Policy Logical Economic Geographic Types of Interdependencies Social/ Political

13 Types of Infrastructure Interdependencies Physical (e.g., output of one infrastructure used by another) Cyber (e.g., electronic, informational linkages) Geographic (e.g., common corridor) Logical (e.g., dependency through financial markets)

14 Physical Interdependencies Railroads Electricity signals, switches, control centers Locomotives (electrified rail) Physical Linkage Coal for fuel Delivers repair parts Coal Power Plant 14

15 Cyber Interdependency Monitors Controls Collects Data SCADA Supervisory Control And Data Acquisition system Computerized Systems

16 Close spatial proximity Geographic Interdependency (Common Corridor) Pipeline & Electric Transmission Lines Airport Tank Farms Rail & Transmission Lines Pipeline & Highway Telecom & Sewer 16

17 Logical Interdependency No direct physical, cyber or geographic connection Seasonal weather conditions Human decisions/habitual behaviors Public Policy (i.e. environmental regulations) Economic Impacts: Government Regulations consumer prices utility companies External market prices Lack of investments to meet growing demand (i.e California Energy Crisis) 17

18 Illustrative Petroleum Dependencies

19 Three Effects of Interdependency Failures Common cause failure A disruption of two or more infrastructures at the same time because of a common cause Cascading failure A disruption in one infrastructure causes a disruption in a second infrastructure Escalating failure A disruption in one infrastructure exacerbates a disruption of a second infrastructure

20 Disruptions Could CASCADE Through the Electric Infrastructure 1 Control Center 2 Private Microwave Network 3 Generating Plant Transmission Substation Public Networks Distribution Substation Transportation Loads Commercial Loads Industrial Loads

21 Disruptions Could ESCALATE (Increase) Repair and Restoration Times Control Center Private Microwave Network Distribution Substation 3 Generating Plant Transmission Substation Public Networks DELAY Repair Crews Transportation Loads Commercial Loads Industrial Loads

22 Multiple Infrastructures Need to be Considered* Critical Infrastructure Sectors Energy Transportation Systems Banking and Finance Chemical Postal and Shipping National Monuments and Icons Agriculture/Food Water Public Health Emergency Services Defence Industrial Base Information Technology Telecommunications Key Resources Commercial Nuclear Reactors Dams Government Facilities Commercial Facilities *Homeland Security Presidential Directive 7

23 Significant Electric Power Interdependencies Nuclear Power Plants Cooling Water controlled shutdown within one day Transmission sudden loss of transmission capacity can cause plant shutdown Process Control will shut down (if possible) Fossil Fuel Power Stations Fuel Supply may reduce or shut down power plant Cooling Water, Transmission, Process Control as above Transmission Telecommunication important for substation and dispatch center operations Distribution Similar to Transmission

24 Significant Commercial Building Interdependencies Utilities Electric Power most large commercial buildings have single distribution circuit from single utility substation Potable Water many buildings have only one source of potable water, typically supplied by municipality, inadequate onsite water storage Sewer may require building evacuation if shut down Telecommunications only if no redundant external sources are unavailable Check for redundancy and emergency backup capability

25 Interdependencies Can be Considered at Multiple Levels Facilities/Assets End to End Systems Networks Regions Communities 25

26 A Systems Representation is Used to Understand Interdependencies 26

27 Interdependencies Change during Events Pre Event Trans Event Post Event Projected Storm Track New Orleans Flooding Damaged Storage Facility Projected Impacts Natural Gas Oil Refinery Impacts Natural Gas Production Days After Landfall 27

28 A Defendable Process is Essential for Making Infrastructure Decisions Entering HILLSVILLE FOUNDED 1802 ALTITUDE 620 POPULATION 3700 TOTAL 6122

29 Modeling/Visualization Tools Improve Understanding of Interdependencies CAS Visualization

30 Service Restoration Is an Important Aspect of Interdependencies Analysis Tool developed: Restore * Purpose: estimate service restoration time (i.e., the amount of time required to restore a system to an operational state) Motivation: Impacts of disruptions vary as a function of the outage duration Duration of outages is uncertain Estimates of outage duration are important in making decisions about system operations and strategies for mitigating vulnerabilities

31 Restore Provides a Framework for Examining Interdependencies and Restoration Uncertainty Range and Likelihood of Outage Time (Probability Density) Critical Critical Outage Outage Time Time Probability Density Total Outage Time (hr)

32 Restore Example: Repair and Restoration of a Ruptured Natural Gas Pipe Probability Density Time Until Area Is Safe Probability Density 0 5 t 1 (hrs) 0 5 t 2 (hrs) Blowdown of pipe contents Replacement of Damaged Pipeline new pipeline segment Initiating Event Occurs Additional Accessibility Time for Crew Probability Density 0 3 t 3 (hrs) Repeat repair if test fails. Location (urban, rural, remote) affects access time. Hydrostatic Testing Probability Distribution over Restoration Time Probability Density Hours Service Restored Natural Gas Probability Density 0 10 t 6 (hrs) Purging of Pipeline Inert gas & air Inert gas Inert gas Probability Density 0 30 t + t (hrs) 5 5+

33 Repair and Restoration of a Ruptured Gas Pipe A Restore Transition Diagram (portion) Dependence on Transportation (Road) Dependence on Telecommunications

34 Results for Repair and Restoration of a Damaged NG Pipeline Telecom Operational This graph tells us that: Outage duration range is about hrs Most likely value is about 90 hrs Probability that duration > 115 hours is ~5%

35 Results for Repair and Restoration of a Damaged NG Pipeline Telecom Disrupted Previous graph said: Outage duration range is about hrs Most likely value is about 90 hrs Probability that duration > 115 hours is ~5% This graph tells us that: Outage duration range is about hrs Most likely value is about 150 hrs Probability that duration > 200 hours is ~5%

36 Over the Past Several Years, Argonne Staff Have Developed the Following Restore Models Natural Gas Gas Pipelines Diameters: Diameters: 12, 12, 16, 16, Pressures: Pressures: psig, psig, >250 >250 psig psig Variable Variable repair repair lengths lengths Fail Fail & foul foul weather weather Time Time of of day, day, day day of of week week Type Type of of terrain terrain Location: Location: urban, urban, suburban, suburban, rural rural City City Gate Gate POL POL Pumping Station Compressor Station Propane Air Air Peaking Station NG NG Separator Underground Storage Facility Large substation transformer

37 GIS Demo Julie Muzzareli s GIS piece Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 37

38 Benefits of Interdependencies Analysis Tools Facilitate understanding of how disruptions: - Propagate (cascade) among infrastructures - Exacerbate repair and restoration problems Identify critical components and vulnerabilities from interdependencies perspective (transcends single infrastructure perspective of asset criticality) Determine consequences of disruptions (e.g., economic impacts) Allow what if analyses Support exercises, training, and education

39 Infrastructure Interdependencies Present Challenges for Security and Reliability Need to identify infrastructure assets that, if lost or degraded, could adversely affect the performance of other infrastructures Normal and stressed operations Disruptions (including coincident events) Repair and restoration Need to identify how interdependencies change as a function of outage duration, frequency, and other factors Need to identify how backup systems or other mitigation mechanisms can reduce interdependence problems

40 Interdependencies-related Lessons Learned Vulnerabilities resulting from infrastructure interdependencies are generally not as well understood as other vulnerabilities Single point failures (due to interdependencies) can lead to multiple infrastructure disruptions Interdependencies can exacerbate repair and restoration problems Facilities that have experience with natural disasters typically have a better understanding of infrastructure interdependencies more likely to have contingency plans to deal with outages You are only as secure as your suppliers and distributors

41 Moving Toward Cascading Failure Solutions Identify internal and external infrastructure assets, systems, and networks that, if lost or degraded, could adversely affect performance Study natural disasters and incidents to gain insight into interdependencies problems and solutions Develop contingency plans to deal with cascading outages Identify how backup systems and other mitigation mechanisms can reduce interdependencies problems implement as appropriate Address security in contractual arrangements Collaborate, cooperate, participate Avoid failure of imagination

42 Interdependencies Influence all Components of Risk Risk = f(threat, Vulnerability, Consequence) T = f(capability, Intent) Innovative Targeting to Exploit Interdependencies V = f(physical, Cyber, Human) Expanded Set of Vulnerabilities Due to Interdependencies Vulnerabilities Threats Risk Consequences C = f(deaths, Economic Losses, Strategic Mission Impacts, Psychological Impacts, ) Cascading and Escalating Interdependent Consequences Interdependencies: Risk Multiplier 42

43 Summary Interdependencies are complex and multi dimensional There is no one solution to analyzing interdependencies Infrastructure dependencies and interdependencies should be factored into risk decisions Interdependencies is a growing research area with great need for enhanced capability and innovation

44 Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 44

45 Lori Eaton Infrastructure Analyst Associate Infrastructure Assurance Center Argonne National Laboratory Go to Insert (View) Header and Footer" to add your organization, sponsor, meeting name here; then, click "Apply to All" 45