Critical Infrastructure

Bridging the Gaps to
Ensure Protection
of Vital Assets

Critical infrastructure provides the foundation that nations need for societies to function; the systems that underpin what people need to live and businesses require to operate. These are the assets and systems — that if destroyed or disrupted — would have a debilitating impact on a nation's economy or its health and safety. And they are increasingly under attack. The world’s critical infrastructure remains worrisomely vulnerable because of a failure to coordinate protection activities and a lack of persistent investment in security. To meet mounting threats, collaborations are necessary: between government agencies and private businesses, public and private security, and among different departments at operators of critical infrastructure. The Ligue drives projects to forge an effective collective approach to ensure the safety of societies, recognizing that security is truly a shared responsibility between many stakeholders.

Critical infrastructure encompasses more business sectors than is commonly understood, which governments must recognize in efforts to strengthen national security, as attacks on privately held, often unregulated critical infrastructure operators pose growing risks for societies.

There has been a notable rise in attacks on critical infrastructure, including a doubling of attacks on some segments of society’s core assets, and predictions are for the rise in attacks to continue, driven by a multitude of motivations, including nation state conflict, greed, and extremist ideologies.

Our adversaries don’t care who runs critical infrastructure. If they can get in through the weakest link—and [if] that’s a small municipal authority or a private vendor—that’s what they’re going to target. — U.S. Rep. Chris Deluzio

To arrive at an appropriate security response considering the risks, critical infrastructure operators need to be inclusive and strategic in their approach, starting with a willingness to conduct an honest self-assessment.

Critical infrastructure security is not a solution that can be implemented, it is a process that must be nurtured, requiring money and commitment. By governments, certainly, but it also requires private sector operators to make investments in security. It is necessary for all operators to look across their enterprise and ask, ‘do I have the right skills and expertise and capabilities to start this program?"

There is typically a complicated division of responsibility for protecting critical infrastructure facilities and enhancing security requires better cooperation at every level, including between government agencies and private business.

The security of nations and citizens are at stake. Given today’s threat environment, the world requires greater government and private sector attention to security issues and persistent investment in solutions—and it requires collaboration between the two entities.

Cyber-Physical Security

Security threats faced by critical infrastructure today aren’t cyber or physical, they’re both—and, just as often, necessary countermeasures aren’t one or the other. Yet, this convergence hasn’t been matched in how security is managed at the world’s critical infrastructure. With an expanding threat surface and persistent adversaries, critical infrastructure security requires a coordinated approach that accounts for both cyber and physical security risk. It is hard to overstate how critical this issue is, as even small security failures in connected environments can have cascading effects and devastating impacts on society.  

Roadmap to Protection

A joint Ligue-CoESS report on critical infrastructure security is freely available with the goal of helping to protect societies by enhancing the resilience of the world’s critical systems. Relevant for operators and owners of critical infrastructure, policymakers and regulators, and other stakeholders, the report details the oversight and management strategies required to protect nations and societies in the era of connected systems and hybrid threats.