Portugal ∙ Resilience of Critical Infrastructures: The Portuguese Government Protection of Pharmaceutical and Medical Devices Industries Falls Short

The necessity of protecting critical infra­structure is an extremely important task for the normal functioning of the national states, especially taking into account modern threats related to military actions, natural disasters, cyberattacks, pandemics, etc. The aim of the research is to substantiate and characterize the organizational and legal conditions for ensuring the resilience of critical infrastructure, using the example of the EU, NATO countries and Ukraine. The articleʼs hypo­thesis is that the resilience of critical infrastructure depends on the level of institutional support, which is capable of adapting to the conditions of modern threats and risks, particularly during wartime, and involves comprehensive interaction between state institutions, the private and international orga­nizations. To achieve the aim of the research, a complex of general scientific and special methods was used, including methods of systematization and generalization, tabular methods, as well as analysis and synthesis. The main regulatory legal acts ensuring the resilience of critical infrastructure in the EU have been identified and analyzed, highlighting the importance of coordinated efforts among EU member states to enhance the resilience and protection of critical infrastructure, especially in response to cross-border threats. NATO approach to ensuring the resilience of critical infrastructure has been analyzed that focuses primarily on crisis preparedness and ensuring the continuity of governance and essential functions even in the event of military aggression or hybrid threats. The regulatory legal acts on ensuring the resilience of critical infrastructure in Ukraine have also been examined, and the main tasks of the authorities responsible for ensuring the resilience of critical infrastructure identified. The levels and manage­ment bodies of Ukraineʼs national system for protecting critical infrastructure have been defined. The main determinants of the resilience of critical infrastructure entities include physical resilience, functional resilience, organizational resilience, infor­mational resilience, social resilien­ce, economic resi­lience, and environmental resi­lience. These deter­minants are interconnected and collectively impact the ability of critical infrastruc­ture entities to ensure continuous operation in crisis situations.

This short paper is a result of several intense days of discussion following a talk at the NATO Advanced Research Workshop “Resilience-Based Approaches to Critical Infrastructure Safeguarding”, which took place in Ponta Delgada, Portugal on June 26–29, 2016. This piece elaborates on the definition of resilience, the need for resilience in critical interdependent infrastructures, and on resilience quantification. An integrated metric for measuring resilience is discussed and strategies to build resilience in critical infrastructures are reviewed. These strategies are presented in the context of the research work carried out at the Reliability and Risk Engineering Laboratory, ETH Zurich, namely, (a) planning ahead for resilience during the design phase, (b) carrying out effective system restoration, (c) quickly recovering from the minimum performance level, (d) self-healing, adaptation and control, and (e) exploiting interdependencies among infrastructures. This paper embraces a fundamentally engineering perspective and is by no means an exhaustive examination of the matter. It particularly focusing on technical aspects and does not touch upon the rich work on community resilience and the possible measures to strengthen the response of communities to disasters.

One of the directions of state policy in the field of ensuring national security is the development of a multi-level effective national security and resilience system for critical infrastructure. A key factor in any system, whether in the field of national security or in other spheres, is human capital, its ability to analyze risks and threats, identify vulnerabilities, master newtechnologies, and find innovative solutions to address modern challenges. Thus, an important aspect becomes the training of qualified professionals who possess systemic knowledge and skills. The need to provide systemic knowledge to specialists and managers directly addressing the tasks of ensuring the protection and resilience of critical infrastructure has been established. The current state of the training system for specialists in the field of critical infrastructure protection in Ukraine has been identified, and the main forms of organizing training and personnel preparation in this area have been analyzed. Tasks have been established based on an analysis of existing professions and labor market demand to determine a set of professions that are expedient to involve in ensuring the security and resilience of critical infrastructure. An analysis of the training and qualification enhancement of specialists in the field of critical infrastructure protection and resilience has shown the necessity and possibility of creating a national education and training system on critical infrastructure protection and resilience in Ukraine. Professions and labor market demand have been analyzed, and a set of professions expedient to involve in ensuring the security and resilience of critical infrastructure has been determined. After their final approval, these professions could include: the head of a structural unit responsible for the protection and resilience of critical infrastructure and a specialist in the protection and resilience of critical infrastructure. Developed or updated professional standards in the field of critical infrastructure protection and resilience will serve as a basis for adapting educational programs of higher education institutions according to the labor market demand.

There are a wide range of different frameworks and methodologies for analysing Critical Infrastructure (CI) resilience, covering organisational, technological and social resilience. However, there is a lack of a clear methodology combining these three resilience domains into one framework. The final goal of the ongoing EU-project IMPROVER, ‘Improved risk evaluation and implementation of resilience concepts to Critical Infrastructure,’ is to develop one single improved and easy-to-use critical infrastructure resilience analysis tool which will be applicable within all resilience domains and to all types of critical infrastructure. This article presents part of this work, in which IMPROVER comprehensively evaluated, by demonstration and comparison, a selection of existing resilience methodologies in order to integrate their best features into the new methodology. The selected methodologies were The Benchmark Resilience Tool (BRT) (Lee et al., 2013), Guidelines for Critical Infrastructures Resilience Evaluation (CIRE) (Bertocchi et al., 2016) and the Critical Infrastructure Resilience Index (CIRI). The latter was developed within the consortium (Pursiainen et al., 2017). The results show that it is hard to evaluate and compare the different methodologies considering that the methodologies are not aiming to achieve the same thing. However, this evaluation shows that all the methodologies have pros and cons, and that the IMPROVER project should aim at combining, in so far as is possible and commensurable, the identified pros while avoiding the identified cons into a Critical Infrastructure resilience assessment framework compatible with the current guidelines for risk assessment in the Member States.

The integrity and resilience of Critical Infrastructures (CIs) are fundamental to the security, well-being and economic prosperity of Europe. However, the increasing complexity and interconnectedness of CIs pose new challenges, as disruptions in one CI can have cascading effects across multiple sectors and countries. ATLANTIS addresses these challenges by evaluating and addressing systemic risks against major natural hazards and complex attacks that could disrupt vital functions of European society. The project focuses on improving the resilience of interconnected CIs exposed to large-scale, combined Cyber-Physical-Human (CPH) threats and hazards. By providing sustainable security solutions, ATLANTIS aims to ensure the continuity of vital operations while minimising cascading effects and enhancing the protection of the involved population and the environment. ATLANTIS will be validated and demonstrated in three large-scale cross-border and cross-sector pilots (LSPs), with a focus on improving the security of the information exchange at different levels of operation: inside individual CIs, across CIs in a national security environment and across borders between CI operators.

A Decision Support System for the Resilience of Critical Transport Infrastructure to Extreme Weather Events

This paper reviews experience in implementing risk-based multiobjective tradeoff analysis and decision making for water resources, multimodal and maritime transportation, and related topics. The paper addresses principally situations in which the decision space of risk management is large and combinatorial, engaging the decision maker in the allocation of resources to the security, robustness, and resilience of critical infrastructures. The applications are hurricane preparedness and resilience of multimodal transportation systems; optimal disaster protection of interdependent floodplain industry sectors; redundancy, robustness, and resilience of critical water resources infrastructure; priority setting of transportation systems that are vulnerable to extreme events; use of uncertain benefit-to-cost ratios to support tradeoff analysis in resource allocation to infrastructure improvements; requirements identification for major navigation structures that are vulnerable to accidents and natural hazards; and addressing the criteria of multiple stakeholders in management of the risk of extreme events for navigation structures. We address the relevance, lessons, and implications of the above for sustaining and improving the security and environmental security of ports and related critical infrastructures.

Exploring the concept of public-private partnership in building critical infrastructure resilience against unexpected events: A systematic review

Background . The Law of Ukraine "On Critical Infrastructure" defines the task of ensuring the security and resilience of critical infrastructure. The practice of implementation of the Law provisions shows the need to introduce a system of education and training of personnel in this area. The observed tendencies of increasing of the range of threats to critical infrastructure, in particular during armed conflict, only emphasize the urgency of raising the level of knowledge and skills of personnel in this area. The purpose of the article is to review potential formats of education and identification of fields of knowledge and specialties within which it is appropriate to reflect issues of critical infrastructure protection in the educational process. Among the important tasks of the article are: a review of research on the problems and the practice of implementation of the educational process in this field, an analysis of legislative and organizational opportunities for the introduction of educational programs, a review of higher education standards and programs, identification of basic competencies of graduates and program results of studies in this area. Methods . There were used methods of theoretical-methodological and comparative analysis for the developing conceptual approaches to the organization of education process on the issues of security and resilience of critical infrastructure. The system-functional analysis of the tasks of the subjects responsible for critical infrastructure protection was used to determine the fields of knowledge and specialties in which it is appropriate to train specialists. Methods of system analysis to form a list of program results of training in this area. Results . The article proposes a methodical approach to determining the necessary competencies, knowledge and skills of the personnel of the subjects of the national system of critical infrastructure protection. The list of specialties in which it is expedient to train specialists by higher education institutions of Ukraine has been defined. A set of competencies and program learning outcomes have been developed, which could serve as basic for developing educational standards and educational programs. A set of educational disciplines is offered that can be a component of the educational process in selected specialties. Conclusions . The article substantiates the legislative conditionality and scientific and practical relevance to establish the system of specialists training in the field of critical infrastructure protection. Though, the training system can cover various forms and methods of training, at the current stage of development of the national critical infrastructure protection system of Ukraine, it is advisable to introduce separate educational programs within the framework of existing educational programs of defined set of specialties. There has been developed the competencies and program outcomes for graduates. A set of educational disciplines that can be a component of the educational process in selected specialties is also proposed. In future, it is necessary to continue research on the development of specific educational programs on the security and resilience of critical infrastructure for various specialties.

No element of a nation's Critical Infrastructure (CI) is more essential than the electric Grid—the system that generates and delivers electricity to power homes, businesses, industry, other Critical Infrastructure, and a nation's Strategic Asset Supply Chains (SASCs). Grid resilience—the Grid's ability to anticipate, absorb, adapt to, and recover from major disruptions, and to rapidly restore electric service in the wake of them—is a matter of paramount importance. This paper examines the potential for nuclear power (and particularly the development of a new generation of resilient Nuclear Power Plants, or “rNPPS”) to transform Grid, CI, and SASC resilience via deployment of rNPPs in resilient Critical Infrastructure Islands, or “rCIIs.” The nature of society's dependence on electricity and the Grid that generates and delivers electricity to consumers is briefly examined. The scope of natural hazards and malevolent human threats to the Grid are summarized. The concept of Grid resilience is next introduced. The role of current‐generation nuclear power plants in the Grid and in achieving Grid resilience is assessed. The two defining attributes and Six Functional Requirements of resilient Power Plants (rPPs) and resilient Nuclear Power Plants (rNPPs) are presented. Next, the results of a small survey and preliminary evaluation of the resilience attributes of some new Small Modular Reactor (SMR) and Micro Modular Reactor (MMR) nuclear power plant concepts are described. It is concluded that some SMR and MMR concepts are likely to exhibit some or all of the Six Functional Requirements of rNPPs. Barriers to development and deployment of rCIIs and rNPPs are briefly summarized. Finally, a few recommendations for efforts that can refine our understanding of the efficacy of rNPPs and rCIIs, and enable their development and deployment, are offered.

Critical infrastructure resilience requires disintegrating traditional silos of stakeholders to form collaborative network such as a public-private partnership. Critical infrastructure resilience is mostly influenced by the relationship between public (government institutions/agencies) and private sector (private institutions/agencies). Public-private partnership is recognized as a medium to build the resilience of critical infrastructure. In this study, a scientometric review was conducted using VOSviewer and Gephi to identify the publication trend and gaps in the public-private partnership in critical infrastructure resilience research domain. A total of 87 publications were retrieved from a literature search on Scopus. It was identified that more studies have acknowledged the use of public-private partnership to build critical infrastructure resilience. However, majority of the public-private partnership in critical infrastructure resilience research papers were on cyber security. Some of the gaps identified included, limited studies on the responsibilities of the public sectors and private sectors in CIR, risks in using public-private partnership to build critical infrastructure resilience, the structure of PPP in CIR in different infrastructure sectors, and critical resilience strategies applicable to a public-private partnership in building critical infrastructure resilience. The outcome of this research will be beneficial to researchers where the gaps identified can be explored for further studies.

As climate change accelerates, the frequency and intensity of flood events are rising, creating significant challenges for critical infrastructure systems worldwide. Transportation, energy, and communication networks are particularly vulnerable, and their resilience to such disastersis crucial for minimizing long-term impacts. This study examines five recent flood events—Germany (2021), Belgium (2021), Sydney (2022), Auckland (2023), and Italy (2023)—to explore the effects of these floods on critical infrastructure and identify best practices for enhancing resilience. The research focuses on answering the central question:How do recent flood events impact critical infrastructure, and what best practices can be identified for improving resilience?Due to the recent nature of these floods, data collection was a pivotal aspect of the study, with information sourced from public news reports, research journals, government reports, and interviews. A Multi-Criteria Decision Making (MCDM) method- the Vikor, was employed to rank hazards, vulnerabilities, and the resilience of critical infrastructure in each case study. This approach provided a systematic evaluation of shared vulnerabilities and region-specificdifferences in disaster response and infrastructure resilience.The findings highlight the importance of multi-stakeholder collaboration, early warning systems, and adaptive infrastructure solutions in mitigating flood impacts. Best practices were identified across all phases of disaster management—pre-disaster preparedness, immediate emergency response, and long-term recovery. These practices emphasize the need for innovative infrastructure adaptations, community engagement, and coordinatedgovernance to build more resilient systems.This research offers valuable insights for policymakers, urban planners, and disaster management professionals. By analyzing these five flood events, the study provides transferable lessons on how to enhance infrastructure resilience and integrate adaptive strategies into policy frameworks. Ultimately, this research contributes to the broader global discourse on climate adaptation and disaster risk reduction, aiming to strengthen preparednessfor future flood events.Keywords: Flood resilience, critical infrastructure, case study analysis, MCDM, disaster management, data collection, best practices

Flooding is frequent on the Nantes ring road and disrupts users dependent on this mode of transport directly or indirectly. To deal with them, the road operator has defined preventive and curative measures based essentially on the flow of the river involved in the submergence of the roadway. The RESIIST (Resilience of Interconnected Infrastructures and Systems) research project aims to develop a methodology and tools to assess the resilience of Critical Infrastructures (within the meaning of European Directive 2008/114/EC), of which we find the ring road. In order to test them, a scenario will be used to simulate the events likely to cause flooding, characterise the disturbances caused by these events and the interactions with adjacent road infrastructures and present a decision aidingbased on the road operator's criteria. RESIIST can contribute to improving the resilience of critical infrastructures by enabling stakeholders to continuously monitor data from the context, to interpret them and deduce the disruption’s risks on infrastructure and territory and finally to benefit from proposals for solutions adapted and corresponding to their decision criteria. More modestly, this scenario could serve as a support in discussions on possible work concerning the ring road and the crisis management protocols.

The Industrial Internet of Things (IIoT) is a paradigm that enables the integration of cyber-physical systems in critical infrastructures, such as power grids, water distribution networks, and transportation systems. IIoT devices, such as sensors, actuators, and controllers, can provide various benefits, such as performance optimization, efficiency improvement, and remote management. However, these devices also pose new security risks and challenges, as they can be targeted by malicious actors to disrupt the normal operation of the infrastructures they are connected to or to cause physical damage or harm. Therefore, it is essential to develop effective and intelligent solutions to detect and prevent attacks on IIoT devices and to ensure the security and resilience of critical infrastructures. In this paper, we present a comprehensive analysis of the types and impacts of attacks on IIoT devices based on a literature review and a data analysis of real-world incidents. We classify the attacks into four categories: denial-of-service, data manipulation, device hijacking, and physical tampering. We also discuss the potential consequences of these attacks on the safety, reliability, and availability of critical infrastructures. We then propose an expert system that can detect and prevent attacks on IIoT devices using artificial intelligence techniques, such as rule-based reasoning, anomaly detection, and reinforcement learning. We describe the architecture and implementation of our system, which consists of three main components: a data collector, a data analyzer, and a data actuator. We also present a table that summarizes the main features and capabilities of our system compared to existing solutions. We evaluate the performance and effectiveness of our system on a testbed consisting of programmable logic controllers (PLCs) and IIoT protocols, such as Modbus and MQTT. We simulate various attacks on IIoT devices and measure the accuracy, latency, and overhead of our system. Our results show that our system can successfully detect and mitigate different types of attacks on IIoT devices with high accuracy and low latency and overhead. We also demonstrate that our system can enhance the security and resilience of critical infrastructures by preventing or minimizing the impacts of attacks on IIoT devices.

Spatial heterogeneity for environmental performance and resilient behavior in energy and transportation systems