Critical Infrastructure Protection

Critical infrastructure represents the category of assets whose security the Security Consulting function must address with the most consequential governance priority available, because the disruption of the systems that society depends upon for its basic functions, including the power generation and distribution, the water treatment and supply, the telecommunications, the financial systems, the transportation networks, and the healthcare delivery infrastructure, creates consequences that extend far beyond the organisation whose systems have been compromised to affect the communities, the economies, and the public safety whose dependence on the critical infrastructure the systems’ designation reflects.

The security governance failure that allows a critical infrastructure attack to succeed is not merely the organisation’s security programme’s failure but the failure of the governance framework that society has relied upon to protect the systems whose availability the public welfare requires. The Security Consulting function that advises critical infrastructure operators must understand this elevated responsibility and govern its advisory with the strategic seriousness that the public consequence of the security failure demands, recognising that the governance standards applicable to critical infrastructure security exceed the generic enterprise security programme’s requirements by the distance that the societal consequence creates between the ordinary business continuity objective and the public safety imperative.

The Critical Infrastructure Security Landscape #

Critical infrastructure security differs from the enterprise security programme in several dimensions whose understanding the Security Consulting function must bring to the advisory with the specificity that the regulatory framework, the operational characteristic, and the threat profile of the critical infrastructure environment create.