Critical Infrastructure Industries Research Articles

Identifying essential critical infrastructure workers during the COVID-19 pandemic using standardized industry codes.

BackgroundThe Cybersecurity and Infrastructure Security Agency (CISA) produced an advisory list identifying essential critical infrastructure workers (ECIW) during the coronavirus disease 2019 (COVID‐19) response. The CISA advisory list is the most common national definition of ECIW but has not been mapped to United States (U.S.) Census industry codes (CICs) to readily identify these worker populations in public health data sources.MethodsWe identified essential critical infrastructure industry designations corresponding to v4.0 of the CISA advisory list for all six‐digit North American Industry Classification System (NAICS) codes and cross‐walked NAICS codes to CICs. CICs were grouped as essential, non‐essential, or mixed essential/non‐essential according to component NAICS industries. We also obtained national estimated population sizes for NAICS and Census industries and cross‐tabulated Census industry and occupation codes to identify industry‐occupation pairs.ResultsWe produced and made publicly available spreadsheets containing essential industry designations corresponding to v4.0 of the CISA advisory list for NAICS and Census industry titles and codes and population estimates by six‐digit NAICS industry, Census industry, and Census industry‐occupation pair. The CISA advisory list is highly inclusive and contains most industries and U.S. workers; 71.0% of Census industries comprising 80.6% of workers and 80.7% of NAICS industries comprising 87.1% of workers were designated as essential.ConclusionsWe identified workers in essential critical infrastructure industries as defined by CISA using standardized industry codes. These classifications may support public health interventions and analyses related to the COVID‐19 pandemic and future public health crises.

Incorporating Environmental Protection Requirement in Industrial IoT Access Control Security Using Arduino Technology MQ2 and DHT11 Sensor Networks

This paper presents the development of environmental monitoring mechanism based on Arduino Sensor Technology for Industrial Internet of Things (Industrial IoT) Critical Infrastructure (CI) Protection in an Access Control role. Access control of hazardous substances is one of the most vulnerable aspects of Industrial IoT CI. The idea behind this study is to harden environmental security through live ecological monitoring of Temperature, Humidity and emitted hazardous substances or gases due to Industrial activities and processes in Smart CI places such as Nuclear Processing Plant, Thermal Generation Power Industries, Fossil Processing Plant, Military Chemical warfare plant, food processing factory, Agriculture Chemical Manufacturing Plant and many other CI industries. Live monitoring is one of the most important security requirements for any cyber-Access Control Mechanism. The literature revealed that similar systems were developed and implemented in different organizations and with different System Requirements and specifications. However, most CI industries have not automated environmental monitoring requirements and integrated the requirement into a broad institution security continuum. The consequence of neglecting environmental security is climate change. Furthermore, Toxic gas pollution affects millions of people around the world and contributes to about 5.4 percent of deaths worldwide. Pollution kills more people than the combination of malaria, AIDS, and tuberculosis hence the development of security mechanisms to monitor pollutants in the atmosphere. The main objective of this study was to develop a computer-based application for monitoring environmental hazardous substances such as extreme temperature, humidity, carbon dioxide (CO2), carbon monoxide (CO), and Smoke in the atmosphere surrounding Industrial IoT CI Industries. The system development approach employed was the Arduino engineering process model. To achieve this objective, cheaper ecological sensor Networks that include MQ2 and DHT11 Arduino Sensors are connected to Arduino Uno Microcontroller through a solderless breadboard Arduino component. The backend database was MySQL Relational database management system. The developed prototype application produced a number of results including live monitoring of temperature, humidity, CO2, CO, Smoke, and many others. A system evaluation process was conducted and the result indicated 99.999% accuracy levels. The results, it evidence that the developed prototype application can improve environmental security in Industrial IoT CI institutions.

An Investigation of Cryptojacking: Malware Analysis and Defense Strategies

Cybercriminals are capitalizing on the global interest in speculative cryptocurrencies for their own gain. By exploiting vulnerabilities in web browsers and client systems on a large scale, such new operating model named as cryptojacking allows cybercriminals to siphon computational resources from their victims to illicitly generate cryptocurrency. The authors analyze cryptojacking malware samples using both static and dynamic methods and discuss their potential impacts on services running on enterprise servers and operating systems including critical infrastructure industries. The paper further providesstrategies for how to detect and defend against these threats.

Still Vulnerable in 2011

Terror attacks on innocent people have continued around the world since 11 September 2001, but not on the scale of the 2001 attack on the United States, which claimed more than 2500 lives. That disaster made us realize our vulnerabilities in many sectors. When a critical industry, such as transportation, communications, energy, or water services, is disrupted in a disaster, it may also cause collateral damage to other services. For example, the 2003 Northeast blackout cut off power to 55 million people. This not only cut off electricity to homes and offices—trains stopped, water purification failed, cell phones went uncharged, and factories shut down. Clearly, attention needs to be paid to improving the resilience of the most critical infrastructure industries.

Environmental Review & Case Study: NERC's Cybersecurity Standards for the Electric Grid: Fulfilling Its Reliability Day Job and Moonlighting as a Cybersecurity Model

The electric industry is experiencing notable changes with the implementation of communication and automation technology, many of which are part of the smart grid movement. Similar to other critical infrastructure industries such as banking, transportation, and the cross-sector critical information infrastructure industry, the electric industry must protect itself from intentional and unintentional security breaches and incidents to ensure uninterrupted operations of essential services. Of the critical infrastructure industries, the electric industry is the only private-sector industry subject to government-enforced mandatory cybersecurity standards. This article presents an overview of the eight mandatory cybersecurity standards by the North American Electric Reliability Corporation. As an example of how standards are evolving, it discusses CIP-002 (Critical Cyber Asset Identification) in depth because it establishes whether the remaining seven standards apply. This article then compares the North American Electric Reliability Corporation regulatory framework against critical information infrastructure goals. The comparison finds that, at least on a basic level, the electric industry's mandatory cybersecurity standards meet the critical information infrastructure goals and work to secure information networks, resources, and systems from cyber and physical threats. The mandatory cybersecurity standards promote an increase in technological products, better security management, personnel and public education, and trust in the industry. Even though the electric industry's mandatory standards are imperfect, the fact it satisfies the goals of the cross-sector critical information infrastructure indicates that the framework is sound. The electric industry's experience with mandatory cybersecurity standards is a valuable source of information, and the regulatory framework itself can be a helpful model for other industries looking to develop their own security protection systems.Environmental Practice 13:250–264 (2011)

A control system testbed to validate critical infrastructure protection concepts

This paper describes the Mississippi State University SCADA Security Laboratory and Power and Energy Research laboratory. This laboratory combines model control systems from multiple critical infrastructure industries to create a testbed with functional physical processes controlled by commercial hardware and software over common industrial control system routable and non-routable networks. Laboratory exercises, functional demonstrations, and lecture material from the testbed have been integrated into a newly developed industrial control system cybersecurity course, into multiple other engineering and computer science courses, and into a series of short courses targeted to industry. Integration into the classroom allows the testbed to provide a workforce development function, prepares graduate students for research activities, and raises the profile of this research area with students. The testbed enables a research process in which cybersecurity vulnerabilities are discovered, exploits are used to understand the implications of the vulnerability on controlled physical processes, identified problems are classified by criticality and similarities in type and effect, and finally cybersecurity mitigations are developed and validated against within the testbed. Overviews of research enabled by the testbed are provided, including descriptions of software and network vulnerability research, a description of forensic data logger capability developed using the testbed to retrofit existing serial port MODBUS and DNP3 devices, and a description of intrusion detection research which leverages unique characteristics of industrial control systems.

Information Sharing in Critical Infrastructure Industries: Understanding the Behavioral and Economic Impediments

This paper is a specialized version, abbreviated and focused on application to critical infrastructure protection, of our paper titled Overcoming Impediments to Information Sharing. Impediments to information sharing between firms operating critical infrastructure have been identified as a key security concern in the recently promulgated National Strategy for the Physical Protection of Critical Infrastructures and Key Assets. This paper identifies economic and behavioral impediments to information sharing among rivals in general, and rivals operating critical infrastructure in particular. The paper then assesses conditions affecting the severity of these impediments. Finally, the paper takes first steps in developing a framework that will predict more accurately when private information sharing would be suboptimal and suggest how better to align private information sharing with social optimality.