CRISP Type 1/Collaborative Research: Lessons Learned from Decades of Attacks against Critical Interdependent Infrastructures

电网、供水网络和交通网络等相互依存的关键基础设施是为现代生活提供最基本服务的大型系统。传统上，对这些基础设施的保护侧重于防止事故造成的故障；然而，人们越来越关注防止由物理和网络攻击引发的故障。例如，最近关于关键基础设施网络安全的13636号行政命令及时提醒人们，日益需要改进我们的关键基础设施的安全态势和抵御攻击的能力，特别是呼吁采取行动，确定有充分记录和经过检验的安全最佳做法。这个关键的弹性相互依存的基础设施系统和流程(CRISP)合作研究项目的目标是确定关键基础设施遭受持续攻击的国家的成功做法和经验教训，并将这些经验教训纳入社会和技术解决方案，美国可以利用这些解决方案更好地了解威胁的性质，并激励公共和私营部门采取更好的姿态，保护美国关键基础设施免受物理和网络攻击。这项研究将利用50年来哥伦比亚关键基础设施遭受持续攻击的经验，并研究该国政府和行业的反应和最佳做法。它还将根据收集的这些攻击数据开发新的算法和安全解决方案。这些课程将被转化为一门专注于恐怖主义、关键基础设施和网络安全的新课程，目标是开发一个多学科的网络冲突和恐怖主义硕士课程，面向从事公共政策工作的学生以及关键基础设施领域的商业领袖和利益相关者。结果将在学术和工业会议以及保护关键基础设施的公共和私人合作伙伴关系中传播，例如由NIST和DHS领导的合作伙伴关系。一些关于关键基础设施的拦截或相互依赖的分析和理论模型仍然是抽象和推测的，这不仅是因为关于对关键基础设施的攻击的数据稀缺，还因为更容易考虑简单的模型或假设，以便使问题在分析或计算上易于处理。对如何计划和实施对关键基础设施的攻击的证据和经验数据对于研究其对关键基础设施的影响以及确定保护这些系统的技术和社会方面至关重要。将基于真实攻击的新的对手模型和防御机制结合起来，并从这些数据集中提取统计数据到拦截或控制相互依赖的数学模型中，将需要算法和优化方法方面的新理论发展。例如，哥伦比亚电网运营商对电力系统的重新配置可以被视为一种移动目标防御，将这种动态方面纳入拦截游戏需要以前从未研究过的新配方。此外，考虑到天然气、水、电信和电力等相互依赖的基础设施的拦截方案将需要不同的“启动事件”模型和不同的恢复过程模型。同样，纳入控制问题的相互依赖的基础设施模型可以在同步标准中增加一些优势，并可能提高同步性和稳定性。本文将研究当一个基础设施受到攻击时，相位内聚性和频率同步的数学条件。最后，提取政策和战略趋势以及影响数据集中观察到的结果的因素将需要对复杂的社会技术组成部分进行广泛分析，其中多个利益攸关方(政府、资产所有者、服务业和供应商)具有影响其行动和决策的不同因素。

Critical interdependent infrastructures such as the power grid, water distribution networks, and transportation networks are large-scale systems that provide the most essential services to modern life. Traditionally, the protection of these infrastructures has focused on preventing failures caused by accidents; however, there is a growing concern about preventing failures initiated by physical as well as cyber attacks. For example, the recent Executive Order 13636 on critical infrastructure cyber-security is a timely reminder on the growing need to improve the security posture and resiliency of our critical infrastructures against attacks, and in particular, a call of action for identifying well-documented and tested security best practices. The goal of this Critical Resilient Interdependent Infrastructure Systems and Processes (CRISP) collaborative research project is to identify the successful practices and lessons learned by countries subject to persistent attacks on their critical infrastructures, and incorporate these lessons into social and technical solutions that the U.S. can use to better understand the nature of the threat, and to motivate better public and private sector postures for the protection of U.S. critical infrastructures from physical as well as cyber-attacks. The research will leverage the experience of five decades of sustained attacks against the critical infrastructures of Colombia and study the government and industry responses and best practices in that country. It will also develop new algorithms and security solutions informed by the data collected on these attacks. These lessons will be translated into a new course focusing on terrorism, critical infrastructures, and cyber-security, with the goal of developing a multidisciplinary Masters on cyberconflict and terrorism targeted to students working in public policy as well as business leaders and stakeholders in our critical infrastructures. The results will be disseminated in academic as well as industrial conferences and in public and private partnerships for the protection of critical infrastructures such as those led by NIST and DHS.Several analytical and theoretical models for interdiction or interdependencies of critical infrastructures remain abstract and speculative not only because there is scarce data on attacks to critical infrastructures, but also because it is easier to consider simple models or assumptions in order to keep the problem analytically or computationally tractable. Evidence and empirical data of how attacks on critical infrastructures are planned and executed are essential for studying their impact on critical infrastructures, and for identifying the technical and social aspects for protecting these systems. Incorporating new adversary models and defense mechanisms based on real attacks and extracting statistics from these datasets into mathematical models of interdiction, or control interdependencies will require new theoretical developments in algorithms and optimization methods. For example the reconfiguration of power systems done by the operators of the power grid in Colombia can be considered as a moving target defense, and incorporating this dynamic aspect into interdiction games requires new formulations that have not been studied before. In addition, interdiction formulations considering interdependent infrastructures such as gas, water, telecommunications, and electricity will require different models of the "initiating events" and different models of the restoration processes. Similarly the inclusion of interdependent infrastructure models for control problems can add some advantages in the synchronization criteria and might improve synchronizability and stability. The mathematical conditions for phase cohesiveness and frequency synchronization when one infrastructure is subject to attacks will be studied in this research. Finally, extracting policy and strategic trends, and factors that have influenced the outcomes observed in datasets will require extensive analysis of a complex socio-technical component where multiple stakeholders (government, asset owners, services industry, and vendors) have different factors influencing their actions and decisions.