Raymond Chan

Kam-Pui Chow

FORENSIC ANALYSIS OF A SIEMENS PROGRAMMABLE LOGIC CONTROLLER

Keywords: Control systems, programmable logic controllers, forensic analysis

Programmable logic controllers are widely used in industrial control systems and supervisory control and data acquisition (SCADA) systems. As the potential of cyber attacks on programmable logic controllers increase, it is important to develop robust digital forensic techniques for investigating potential security incidents involving programmable logic controllers. This chapter focuses on the logging mechanism of a Siemens programmable logic controller, specifically the Siemens Total Integrated Automation Portal V13 program (Siemens TIA Portal, also called Siemens Step-7).

Introduction

Industrial control systems are vital to the operation of the critical infrastructure. Programmable logic controllers (PLCs), which are among the most commonly used components of industrial control systems, are used to monitor processes and perform control actions. Programmable logic controllers are usually connected to human-machine interfaces (HMIs) to enable remote realtime monitoring and control by human operators. Although modern industrial control systems have been used for several decades, little research has focused on forensic analysis methodologies for investigating security incidents involving control systems. The discovery of Stuxnet [START_REF] Zetter | Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon[END_REF] in 2010 has significantly increased efforts to develop sophisticated and reliable forensic techniques for industrial control systems, including programmable logic controllers. These techniques are vital to understand the nature and scope of security incidents and attacks, extract evidence and potentially identify the perpetrators.

This chapter focuses on a Siemens programmable logic controller, namely the Siemens Total Integrated Automation Portal V13 program (Siemens TIA Portal, also called Siemens Step-7), one of the systems targeted by Stuxnet. In particular, this chapter discusses the information available in the Siemens TIA Portal that could support forensic investigations and presents a forensic analysis methodology for the Siemens programmable logic controller.

Related Work

Forensic analyses of industrial control systems are challenging due to the lack of access to and knowledge about proprietary devices and protocols [START_REF] Ahmed | SCADA systems: Challenges for forensic investigators[END_REF]. Taveras [START_REF] Taveras | SCADA live forensics: Real time data acquisition process to detect, prevent or evaluate critical situations[END_REF] has proposed a high-level model for live SCADA system forensics. Spyridopoulos et al. [START_REF] Spyridopoulos | Incident analysis and digital forensics in SCADA and industrial control systems[END_REF] have discussed the implementation of logging capabilities in a typical SCADA system architecture to support forensic investigations. Eden et al. [START_REF] Eden | A forensic taxonomy of SCADA systems and approach to incident response[END_REF] have presented an incident response taxonomy that includes possible attacks and forensic analysis methodologies for SCADA systems. Wu et al. [START_REF] Wu | Towards a SCADA forensics architecture[END_REF] have proposed a forensic capability for the Siemens S7 programmable logic controller that uses the Siemens TIA Portal to monitor changes to data. Patzlaff [START_REF] Patzlaff | on Forensic Analysis for Industrial Systems[END_REF] has developed a forensic analysis framework for industrial control systems that covers programmable logic controllers as well as host computers and workstations.

SCADA network forensics is also a topic of considerable interest among researchers and practitioners. Kilpatrick et al. [START_REF] Kilpatrick | An architecture for SCADA network forensics[END_REF] have proposed a SCADA network forensic architecture for analyzing TCP/IP traffic between control devices. Valli [START_REF] Valli | Snort IDS for SCADA networks[END_REF] has developed a Snort intrusion detection system for SCADA networks, which is able to detect and respond to common network attacks.

Analyzing programmable logic controller firmware is also of value in incident response and forensic investigations. Basnight et al. [START_REF] Basnight | Analysis of programmable logic controller firmware for threat assessment and forensic investigation[END_REF] have discussed techniques for reverse engineering programmable logic controller firmware. However, the task is extremely time consuming and, due to the proprietary nature of the hardware and security mechanisms, it may not be possible to extract useful information for forensic investigations.

Little, if any, research has focused on practical approaches for performing forensic analyses on programmable logic controllers. To address the gap, this chapter presents a practical methodology for analyzing a Siemens programmable logic controller along with a computer workstation installed with the Siemens TIA Portal.

Forensic Analysis Methodology

Figure 1 summarizes the forensic analysis methodology. First, the forensic investigator identifies the computer workstations (PCs) and programmable logic controllers (PLCs) involved in the security incident. Next, evidence is extracted from the workstations and programmable logic controllers for analysis. Further analysis has to be performed on the workstations that have the Siemens Total Integrated Automation Portal V13 program (Siemens TIA Portal, also called Siemens Step-7) installed. The identified programmable logic controllers must be connected to the Siemens TIA Portal for further analysis. This section focuses on the forensic examination of the Siemens TIA Portal installed on a workstation and a method for examining the diagnostics buffer in an affected programmable logic controller.

Analyzing the Siemens TIA Portal

The Siemens TIA Portal is an integrated development environment for configuring and developing programs, and monitoring the status of the Siemens programmable logic controller. As such, it provides valuable information for forensic investigations.

3.2

Analyzing the PEData.plf File

The PEData.plf project file is generated by the Siemens TIA Portal. It contains information about the programmable logic controller program and configuration. The PEData.plf file is generated when a new programmable logic controller project is created. Because, the PEData.plf file records the programmable logic controller information in plaintext, any forensic tool (e.g., WinHex) can be used to examine the information. Analysis of the file contents revealed that all the project actions are stored in the project file. Whenever the programmable logic controller program is modified, a PLUSBLOCK is appended to the end of the project file. The PLUS-BLOCK provides information about the changes made to the programmable logic controller program. By comparing the variable tags and the ladder logic regions in the PLUSBLOCK, a forensic investigator can obtain details about the modifications made to the programmable logic controller program.

Figure 2 shows the file structure of the PEData.plf file; the actions and modifications are marked as COMMIT. It is possible to reconstruct the changes that have been applied to the project file.

Figure 3 shows the MAC times (last modification time, last accessed time and creation time) of the PEData.plf file. The information is used to determine the modification time, last access time and creation time of the project.

Figure 4 shows the locations of the ladder logic program and tags in the PLUSBLOCK file. This information also enables a forensic investigator to examine the changes made to the programmable logic controller program.

Analyzing the Program Block Metadata

Programmable logic controller programs are represented as program blocks in the Siemens TIA Portal. Each program block has its own metadata and attributes. The information includes the size of the binary file, last compilation date and last modified date of the programmable logic controller program.

After an incident occurs, a forensic investigator needs to verify the correctness of the timestamp information provided by the programmable logic controller. Several timestamps are provided by the Siemens TIA Portal. Figure 5 shows the compilation timestamp and the size of the program in memory.

Figure 6 shows several useful timestamps associated with a programmable logic controller program. The timestamps are: The compilation time (compilation timestamp in Figure 5) and last loaded time (load-relevant timestamp in Figure 6) enable a forensic investigator to ascertain when a program was compiled and loaded on the programmable logic controller. In a normal situation, the last loaded time should be after the compilation time. If the last loaded time is earlier than the compilation time, then the program was (possibly updated and) compiled, but not yet loaded on the programmable logic controller.

Analyzing the Diagnostics Buffer

The Siemens programmable logic controller has a diagnostics buffer that records its behavior and interactions with the Siemens TIA Portal. For each event, the diagnostics buffer records the timestamp, event id and detailed description of the event. Since the buffer is read-only, it is not possible for an attacker to modify its contents. Due to the limited memory in the programmable logic controller, the diagnostics buffer can only record about 1,300 to 3,000 recent events. During normal operation, the diagnostics buffer should be able to record an adequate number of programmable logic controller events for forensic analysis. During an investigation, a forensic professional should switch the programmable logic controller from the RUN mode to the STOP mode before examining the diagnostics buffer. Omitting this step may cause information about the earliest events to be overwritten by new events. Figure 7 shows the event log maintained by the diagnostics buffer.

Starting and Stopping the Controller

The Siemens programmable logic controller has three modes: (i) STARTUP; (ii) STOP; and (iii) RUN. When the programmable logic controller starts up with a pre-loaded program, the diagnostics buffer records the mode change from STARTUP to RUN. If no program has been pre-loaded, then the mode change from STARTUP to STOP is recorded. The Siemens TIA Portal can send commands to the programmable logic controller to change its mode. Two events are recorded after a STOP command is sent to the programmable logic controller and three events are recorded after a RUN command is sent to the programmable logic controller. Figure 8 shows the diagnostics buffer event log after the STOP and RUN commands are sent to the programmable logic controller.

Uploading a New Program

In order to upload a new program to the programmable logic controller, the Siemens TIA Portal has to change the programmable logic controller from the RUN mode to the STOP mode, overwrite the existing program with the new program and change the programmable logic controller mode to STARTUP. After the program is successfully uploaded to the programmable logic controller, the Siemens TIA Portal issues a WARM RESTART command to change the mode from STARTUP to RUN, thereby enabling the newly-installed program to execute. The diagnostics buffer records a total of seven events until the upload action is completed. Figure 9 shows the corresponding event log in the diagnostics buffer.

Analyzing Engineer-Defined Events

Other information is available that may be useful to determine the state of the programmable logic controller. For example, an engineer can set the diagnostics buffer to log events related to the running status of the programmable logic controller that are helpful in investigating incidents. Figure 10 shows examples of engineer-defined events that can be logged by the programmable logic controller.

Case Study

This section describes a hypothetical, albeit realistic, security incident in which the proposed forensic analysis methodology is used to conduct the investigation.

An engineer was dismissed from his position at a water supply company as a result of unsatisfactory performance. On December 26, 2015, the company incident response team received a call that the water supply system was down due to a malfunctioning programmable logic controller. The incident response team was requested to investigate whether or not the system was attacked.

After examining the CCTV recording, the dismissed engineer was identified as the primary suspect. Specifically, he was seen to access a workstation with the Siemens TIA Portal installed. The incident response team believed that the engineer had modified the programmable logic controller program, which caused the water supply system failure. The incident response team was tasked with identifying the actions performed by the engineer and their times by examining the digital traces left in the Siemens TIA Portal and the diagnostics buffer of the programmable logic controller.

The incident response team hypothesized that the engineer modified the program in question using the workstation and then uploaded the program to the programmable logic controller. The team performed the following actions and retrieved the following evidence according to the proposed methodology:

The incident response team examined the workstation used by the engineer, which had the Siemens TIA Portal was installed. In the Siemens TIA Portal, the team discovered that the last modification time of the programmable logic controller program was 8/12/2015 3:05:58 PM, the compilation time was 8/12/2015 5:46:36 PM and the last loaded time was 8/12/2015 5:46:38 PM. These timestamps enabled the team to identify when the program had been modified and uploaded to the programmable The incident response team proceeded to identify the programmable logic controller with the abnormal behavior. After connecting to the pro- grammable logic controller, the team extracted the event log in the diagnostics buffer and discovered that the programmable logic controller had been stopped and the modified program was executed on 26/12/2015 4:18:57 AM. The information provided by the diagnostics buffer proved that the program was modified on 8/12/2015, which matched the date of the water supply system failure. Figure 13 shows a screenshot of the diagnostics buffer in the malfunctioning programmable logic controller.

Using the proposed forensic analysis methodology, the incident response team successfully extracted the programmable logic controller program modification time and compilation time from the Siemens TIA Portal to confirm when the program had been changed. By retrieving the event log from the diagnostics buffer in the programmable logic controller, the incident response team confirmed the time when the programmable logic controller was restarted. Upon comparing the program retrieved from the malfunctioning programmable logic controller with the original program, the incident response team was able to discover exactly how the program was modified and exactly what caused the programmable logic controller to malfunction. All the events were placed on a timeline by comparing the MAC times corresponding to the original program and the modified program.

Conclusions

The discovery of Stuxnet in 2010 has significantly increased efforts to develop sophisticated forensic techniques for industrial control systems. These techniques are vital to understand the nature and scope of security incidents and attacks, extract evidence and potentially identify the perpetrators. The proposed methodology for performing forensic analyses of programmable logic controllers is effective and practical. In particular, it focuses on a Siemens programmable logic controller along with a computer workstation installed with the Siemens TIA Portal, one of the systems targeted by Stuxnet. Future research will extend the forensic analysis methodology to cover other programmable logic controller models and their associated firmware and software.

Figure 1 .

 1 Figure 1. Forensic analysis methodology.

Figure 2 .

 2 Figure 2. Hex representation of the PEData.plf file.

Figure 3 .

 3 Figure 3. MAC times of the PEData.plf file.

Figure 4 .

 4 Figure 4. Storage locations of the ladder logic program and tags in PEData.plf.

Figure 5 .

 5 Figure 5. Program compilation information.

Figure 6 .

 6 Figure 6. Program timestamp information.

Figure 7 .

 7 Figure 7. Diagnostics buffer event log.

Figure 8 .

 8 Figure 8. Event log generated by sending a STOP command.

Figure 9 .

 9 Figure 9. Event log generated by uploading a program.

Figure 10 .

 10 Figure 10. Engineer-defined events recorded by the diagnostics buffer.

Figure 11 .

 11 Figure 11. Program block timestamps in the Siemens TIA Portal.

Figure 12 .

 12 Figure 12. Program compilation/uploading timestamps in the Siemens TIA Portal.

Figure 13 .

 13 Figure 13. Diagnostics buffer in the malfunctioning programmable logic controller.


Carol Romanowski

Rajendra Raj

Jennifer Schneider

Sumita Mishra

Bernard Brooks

Jessica Pardee

Bharat Bhole

Nikolaus Robalino

A Multidisciplinary Predictive Model for Managing Critical Infrastructure Disruptions

Keywords: Infrastructure disruptions, emergency management, predictive model

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

A comprehensive and effective response structure in communities subjected to disruptive events may be viewed as being composed of two interconnected systems: (i) a formal professional system comprising emergency services professionals such as police and fire, and auxiliary services professionals such as the Red Cross and National Guard that are called as needed; and (ii) an ad hoc community system that is formed by the community itself when the professional response is delayed or is inadequate. This community system typically persists until the professional system can take over completely or until the community is operational in some capacity.

However, the capacity and effectiveness of a community response system is neither well understood nor well utilized. For instance, during a November 2014 snow disruption, residents of Buffalo (New York) worked together to clear four to seven feet of snow from their neighborhood streets before city and county plows could reach them [START_REF] Miller | Picture of Hamburg shoveling party goes viral[END_REF]. If the area emergency managers knew of this available and functional capacity, they would have been able to assign resources more effectively, reflecting the increased capability and change in the environment. For example, they could have assigned smaller plows to the area because much of the cleanup work had been done or they could have diverted the assigned resources to a different area where such efforts had not taken place or they could have taken over the response from the residents. At present, such community resource systems are underutilized or even actively discouraged by professional responders because the capacity is unknown, but a failure to take these resources into account reduces the overall response efficacy.

A better understanding of the interplay between these two systems is needed to improve and ensure effective overall responses to disruptions. This chapter describes an agent-based model integrated with cellular automata that is designed to study how the interrelationships between professional and community systems affect changes in response and recovery processes during disruptions. As a proof-of-concept, the model focuses on how these systems influence and support community resilience in the context of three of the sixteen critical infrastructure/key resource (CI/KR) sectors defined by the U.S. Department of Homeland Security (DHS) [START_REF]Critical Infrastructure Sectors[END_REF]: emergency services, information technology and communications.

Background

Although the professional system is characterized by known capabilities (such as specialized, systematic training and structured communications networks) and defined resources (human and equipment), community systems have unknown capabilities and uncertain resources. Professional systems, with their defined procedures and protocols, have relatively predictable responses to disruptions whereas community systems display more stochastic responses with probabilities of various actions dependent on the socioeconomic backgrounds of the actors. The U.S. Federal Emergency Management Agency (FEMA) has a whole community approach, which acknowledges that technological advances in community infrastructure, especially communications and information access, cultural diversity and grassroots engagement, affect how communities thrive and react to disasters [START_REF]Federal Emergency Management Agency, A Whole Community Approach to Emergency Management: Principles, Themes and Pathways for Action, FDOC 104-008-1[END_REF].

Several studies have explored the changing landscape of emergency response in the light of social change and localized problem solving [START_REF] Liu | From cultures of participation to the rise of crisis mapping in a networked world[END_REF][START_REF] Lopez-Marrero | From theory to practice: Building more resilient communities in flood-prone areas[END_REF]. Trainor and Barsky [START_REF] Trainor | Reporting for Duty? A Synthesis of Research on Role Conflict, Strain and Abandonment among Emergency Responders during Disasters and Catastrophes[END_REF] note that it is in the "best interest of the community" to use trained and untrained human resources. Currently, the Federal Emergency Management Agency uses the "all hazards" planning taxonomy [START_REF] Johansson | A Literature Review on Community Approaches Involving the Public in Crisis Management: Fostering Community Resilience through Coproduction by Response Organizations and Citizens, Public Empowerment Policies for Crisis Management Project FP7-284927[END_REF], based on a set of 37 target capabilities, to provide an operational framework for response as part of the National Incident Management System (NIMS). The taxonomy was created to assess and document potential gaps in local response and recovery within a standard framework.

The Federal Emergency Management Agency requires communities to measure response capabilities -which is a start, but certainly not the whole picture -particularly for communities that rely on a mix of paid and volunteer responders. As the initial reaction of a community to a disruptive event is socially driven, especially when professional response is delayed or absent [START_REF] Zakour | Social capital and increased organizational capacity for evacuation in natural disasters[END_REF], further investigation of this system is warranted. Community responses are often no less and, possibly, more effective than professional responses. The effectiveness of community systems is tied to the social capital of the community as well as its perception of its own abilities [START_REF]National Disaster Recovery Framework: Strengthening Disaster Recovery for the Nation[END_REF], in conjunction with the traditional capabilities assessed through professional emergency planning requirements [START_REF] Romanowski | Information management and decision support in critical infrastructure emergencies at the local level[END_REF][START_REF] Schneider | Decision making to support local emergency preparation, response and recovery[END_REF].

As the Federal Emergency Management Agency "all hazards" taxonomy is linked to the probability of event occurrence, experience plays a major role in identifying, understanding and mitigating risk [START_REF] Dynes | Social capital: Dealing with community emergencies[END_REF]. To the extent that the residents or responders understand the scope of the event, they can then increase their capacity to act whether or not the professional response plan is initiated. The ability to self-organize and act is driven by many factors, including the knowledge of the event and the need, in conjunction with local geography, economics, demographics, natural resources and imminent threats [START_REF] Boteler | Building disaster-resilient families, communities and businesses[END_REF][START_REF] Flint | Natural resource-based communities, risk and disaster: An intersection of theories[END_REF][START_REF] West | Race, gender and communications in natural disasters[END_REF]. The need to act is driven by the degree to which normal community systems have broken down and cannot cope with, or be resilient to, the hazard. These systems include infrastructure systems (physical, operational and virtual) as well as human systems (collective capabilities) that make up a functional community -in other words, they are systems of systems.

Proposed Model

A major goal of the proposed model is to support the measurement and assessment of the interactions between professional and community system responses to disruptive events. It integrates agent-based modeling with cellular automata and uses examples based on emergency management, information technology and communications flows. The demographic data from the Rochester (New York) metropolitan statistical area (MSA) [START_REF]Department of Housing and Urban Development, State of the Cities Data Systems (SOCDS)[END_REF] includes more than one million people with a range of ethno-racial, wealth and age demograph-ics, and a high youth population in the inner city [START_REF]Census Bureau[END_REF], making it a reasonable representative of a mid-sized U.S. urban area. The proposed model is designed to be flexible and generalizable to similar regions.

Model Design

Agent-based modeling can help capture the highly integrative and complex nature of interactions between professional and community responders within the context of concurrent emergency management, information technology and communications systems. This versatile modeling approach has been employed in similar studies of human systems [START_REF] An | Exploring complexity in a human-environment system: An agent-based spatial model for multidisciplinary and multiscale integration[END_REF][START_REF] Torrens | Cellular automata and multi-agent systems as planning support tools[END_REF] and addresses the weaknesses of other techniques while maintaining their strengths. For example, the geospatial distribution of responders, resources and population might be assessed through a system of partial differential equations or the high importance of communications could be assessed using graph theory. Such mathematical modeling techniques, however, tend to separate the modelers from the subject matter experts. In contrast, agent-based modeling uses agents whose behaviors are governed by rules created in concert with subject matter experts. For instance, communications experts help frame the rules governing communications modes and connections between agents that represent people, while socioeconomic experts create decision rules to be used by community responders from different demographic backgrounds. Agent-based modeling thus supports simple, but required, connections between subject matter experts and mathematical models. Complex systems and behaviors arise out of multidisciplinary, albeit simple, rules obeyed by the agents -this forms the backbone of the proposed model.

In the proposed model, agents are distributed in a two-dimensional domain that incorporates the geospatial aspects of a metropolitan setting, along with heterogeneous distributions of demographics, needs, abilities and resources. The geographic region is divided into cells distributed on a grid. The cells have differing attributes such as built environment characteristics, proximity to major roads, demographics and population density.

Each cell has needs, resources and abilities, and communications links to other cells. The needs vector elements measure quantities such as injuries and hazards. The resources vector elements measure supplies and equipment such as winches, trucks and generators. The abilities vector elements measure essential skills such as doctors, electricians, law enforcement and heavy equipment licenses. The state of each cell is a composite of these three vectors. Figure 1 presents an example of a cellular grid. Cell 1,1 is negatively affected by a disruptive event and receives resources and assistance from Cell 1,2 and Cell 2,1 that are adjacent to it. Note that N denotes needs, R resources and A ability.

At each time step (unit of time in the model), the agents in a cell respond to the needs and requests from its neighboring cells according to a set of rules.

Example rules are:

If a cell has an emergency but no emergency resources, then the need can be addressed using emergency resources located at an adjacent cell. For example, a fire truck will move beyond its designated area to help fight a fire in a neighboring area.

After receiving official communications from the authorities, cells containing personnel with heavy equipment licenses (abilities) may transfer the abilities to nearby cells with heavy equipment resources. For example, a local fire chief may ask individuals who can drive bulldozers to go to where the bulldozers are parked.

Cells with medical needs do not mobilize their heavy equipment operators even after communications from the authorities. For example, an individual whose child is injured stays with the child and does not report to the heavy equipment yard.

Cells with varying characteristics such as population density and socioeconomic status respond differently to disruptive events and recovery efforts; their agents draw their behavior choices from separate probabilistic sets. The purpose of the rules is to simulate the real-life decision-making patterns of response behavior, while using the model to assess how alternative response mitigation plans and resource activations may alter the behavior patterns to optimize response and expedite recovery.

One of the powerful features of the model is that, during each time step, the needs vector, resource vector and ability vector are updated according to rules informed by local situations and subject matter experts. Rules may contain a stochastic element, enabling the cellular automata to operate as a large Monte Carlo simulation.

The distribution of resources and abilities is based on the critical infrastructure/key resource assets in the region and knowledge of the characteristics of the metropolitan statistical area such as population density, vacant housing percentage and per capita income. A database containing this information was created during a previous Department of Homeland Security project [START_REF] Romanowski | Information management and decision support in critical infrastructure emergencies at the local level[END_REF].

To represent the official, or professional, response to a disaster event, a threelayered network spans the entire grid. Each layer of the network corresponds to one of the three critical infrastructure sectors selected in this investigation: (i) emergency management services; (ii) information technology; and (iii) communications.

Emergency Management Services Layer: This layer represents the network of first responders (police, fire and emergency medical services), hospitals, clinics and critical personnel that make up the emergency management system of a region. The proper operation of this layer is highly dependent on information technology and communications because the correct resources must be routed to the exact locations as quickly as possible during an incident. Conversely, a lag in, or interruption of, information flow from the scene of an incident back to the centralized emergency operations center leaves decision makers with incomplete knowledge about the state of the event or scene.

Information Technology Layer: Security and privacy management in dynamic information management environments is challenging, yet critical, for an effective response. For example, data integrity has to be maintained for professional as well as community responses. Errors in geographical coordinates or loss of key pieces of information can prove to be life-threatening. Without a robust information technology infrastructure, data modification and loss (both accidental and malicious) cannot be prevented; this can lead to catastrophic situations.

Communications Layer: Robust communications reduce the time to bring the right resources to the right locations while poor communications limit the quality of information available to those who have the resources. Individuals at the scene of a disruptive event have rich information over a small footprint while professional responders and incident command have a broad, but relatively shallow, view of the situation.

Interdependencies Between Layers: The three sectors were chosen for model development because they are highly dependent on each other, especially during disruptive events. In addition, when disruptions occur, all three sectors can be supported by professional and community response systems.

Modeling Process

The metropolitan statistical area of a mid-sized city like Rochester covers a much larger geographical area relative to population than that of a major city such as New York, Los Angeles or Chicago. Therefore, to study the problem of regional resilience for the approximately 62 metropolitan statistical areas in the United States that are anchored by a mid-sized city, several cellular models of varying sizes are needed to represent municipalities in the counties that neighbor the anchoring city. Figure 2 shows an example of how such a regional resilience study of the Rochester metropolitan statistical area might be configured as a graph whose edges are the connections between large towns and county seats within the metropolitan statistical area and the anchoring city. Note that all the nodes are connected to the major city, but are not necessarily connected to every other node. In essence, the region can also be expressed as a cellular agent-based model where the cells represent municipalities. Since a neighborhood is essentially a subset of a community, each community cell can be divided into n neighborhoods as shown in Figure 2.

The proposed model helps increase the understanding of how social and economic characteristics such as ethno-racial, class, gender and age distributions impact recovery performance for various critical infrastructure/key resources, especially when the socioeconomic characteristics shape community response capabilities.

The independent variables in the model include:

Level of interaction between the two response systems.

Types of critical infrastructure/key resource assets involved in the event.

Amount of disruption to the performance of the assets.

Geographical scope of the crisis.

Socioeconomic network factors, community capabilities and resources that affect community response capacity.

The approach provides for the testing of key dependent variables such as:

Transfer time from community to professional systems (to assess critical infrastructure/key resource assets and human capacity).

Changes in the operational capacity of the involved critical infrastructure/key resource assets.

Resource allocation by the professional system.

Model Viability and Validation

A two-part approach was used to establish the viability and validity of the model. First, experiments were conducted at a granular level and the results were analyzed to check if the model is viable. Second, approaches were explored to establish the validity of the model in real-world critical infrastructure protection scenarios.

Model Viability

To establish a baseline, the dependent variables were first assessed with professional responders only, a fully functional critical infrastructure and the following three levels of event severity:

1: The event is highly isolated, easily contained and needs only a few responders (e.g., a car accident).

Level 2: The event has a large impact area and more victims or a few hard-to-reach victims (e.g., a building collapse or multi-car pileup).

Level 3:

The event impacts more than half of a community (e.g., a flood event, power outage in combination with another event or events where first responders are already responding en masse at the site of another major event).

After a baseline is established, the model parameters (see Table 1) may be modified to analyze the effects of each component on resilience and recovery under various initial conditions. For instance, it may be necessary to learn how community systems respond in the absence of the professional response. If first responders are unable or slow to respond, community networks may be formed to deal with the event. The model is used to test group formation and efficiency of response at the same levels as the baseline, but without the professional response element. During a higherlevel disruptive event, response capacity is anticipated to rapidly diminish as the community becomes overwhelmed. Efficient crisis management is highly dependent on a functioning critical infrastructure. In the proposed model, the critical infrastructure is represented by the emergency services, information technology and communications sectors. By varying the capabilities of the sector layers, it is possible to understand the effects of critical infrastructure loss.

The model may also be extended to study the effects of uneven resource distribution. For example, an event that occurs in a working-class neighborhood may, in fact, have a more effective response given the higher density of first responders who live in the neighborhood. Similarly, an event that requires physicians may have a fast response time if it occurs near a hospital. A rural area may have fewer professional responders, but a more robust community response. By focusing on how certain types of disruptive events in specific locations in the modeled region can affect the dependent variables, it is possible to create the foundation for policies that encourage even access to response and recovery systems in the face of social, economic and resilience inequalities in the region.

Model Validation

As discussed above, several elements involved in modeling professional and community emergency responses require a multi-pronged approach to validation. Qualitative and quantitative approaches have been developed for model validation. Validation is intended to demonstrate that the proof-of-concept model and the results for subsequent variations of the model provide reasonable representations of real-world professional and community responses.

Approaches that are used traditionally for model validation include the use of expert intuition, data analytics, empirical analyses and theoretical analyses. The first two model validation approaches are used for the most part in this work. However, as discussed below, other approaches may be employed where appropriate and feasible:

Expert Intuition: To informally validate the model, a set of use cases are developed that provide a narrative of common, previously-known interactions between the professional and community responses. These use cases establish that the model can effectively describe the identified functions; this is verified using experts from the stakeholder communities.

Identifying and using stakeholders as subject matter experts is the key to this model validation approach. The authors of this chapter have strong relationships with local, state and national emergency response organizations, as well as community organizations that typically provide community response. These relationships have helped identify experts who guide the development of the model and help validate it.

Data Techniques: Previous research using 911 emergency call data involved the analysis of typical disaster events that occur in the Rochester metropolitan statistical area, including time-based features, resource allocation and event classification [START_REF] Romanowski | Regional response to large-scale emergency events: Building on historical data[END_REF]. The scenario outputs of the agent-based model are compared against expected outcomes for these events at reasonable confidence levels.

The validation of complex models, especially where real-world systems with real-time constraints are involved, has many open research questions regarding utility and correctness. A thorough discussion of validation methods is outside the scope of this work; however, the analysis and comparison of validation approaches is a topic for future research.

Base Model Framework

This section presents a limited scope model using existing critical infrastructure asset data and a set of simple rules based on extensive experience with the Rochester area and its emergency response environment. The limited model can be incrementally built up to a full-scale model with reasonable confidence that the system works as it should.

Figure 3 shows the basic model consisting of two communities divided into nine neighborhoods. Both the communities are centered on an event at N 2,2 . All the parameter values in the model are between zero and one.

The communications layer response capacity at time is denoted by C t . Let I t and E t be the independent capacity values at time t for the information technology and emergency management layers, respectively. Then, IL t , the information technology layer response capacity at time t, is computed as:

IL t = C t • I t (1)
and EL t , the emergency layer response capacity at time t, is computed as:

EL t = IL t • E t (2)
The link between the community system and the professional system is represented by two parameters that modify the emergency response levels. The first parameter K t is the amount of information that the professional responders receive about community efforts at each time step. The second parameter Tr t expresses the level of trust that the first responders have in the accuracy of the community network information.

The community system parameters reflect their resource levels at time t (N i,j,t ), the probability that a neighborhood will assist the affected area at time t (H i,j,t ) and the percentage of resources that that neighborhood N i,j will share at time t (S i,j,t ): N i,j,t : Neighborhood N i,j resource level at time t.

H i,j,t : Probability that neighborhood N i,j will assist N 2,2 at time t. S i,j,t : Maximum amount of resources that neighborhood N i,j will share with N 2,2 at time t.

Note that, in the base model, the sharing parameter S i,j,t is treated as a constant, although it would vary dynamically in a real-world model.

The two cells in the model operate using the same rules for how neighborhoods respond to an affected area and how the professional system responds. Table 2 presents a partial list of rules used in the base model; these rules must be satisfied for the community or professional network to respond.

If the rules are satisfied, then a neighborhood N i,j responds with S i,j,t level of assistance. The professional network also responds with one unit of assistance (10% of capacity) when there are no communications between the layers. However, if communications are taking place, then the professional responders can reduce their response level. This professional response level PR comm is computed as:

PR comm = 0.1 -K t • Tr t • n i=1 S i,j,t AF (3)
where AF is an adjustment factor that represents the effectiveness of neighborhood response. For example, an AF value of 2 indicates that two units of community medical response equal one unit of professional medical response. This is because medical response by community members may not be as complete or effective as response by trained emergency medical technicians with the appropriate equipment. Table 3 shows the progression of response to an event by professional responders (with and without communications) and by neighbors. The following thresholds were used in the model execution:

Minimum neighborhood health threshold = 0.5.

Minimum help probability threshold = 0.5. S i,j,t (assistance a neighborhood shares with the affected cell) = 0.1. Initial values for all the other parameters were randomly generated. The information technology and communications layer capacity values at each time step were also random values.

Table 3 shows the event values for the two cells in the model. In the example, the overall neighborhood response was computed using an adjustment factor AF = Therefore, two units of neighborhood are equal to one unit of professional response. The first two columns of the table track the capacity of the emergency response layer with and without adjusting for neighborhood response.

Figure 4 shows the results. In this short-duration event, it can been seen that the emergency management capacity is preserved when there are communications between the layers.

The basic model example makes some assumptions that are definitely not valid in the real world. For example, the model assumes that the emergency management capacity is "used up" and is not renewable. It also assumes that the neighborhood health values only decrease when resources are shared with an affected area. Additionally, the health of the affected area does not decrease in the model.

Figure 5 shows the first five time steps of one cell in the base model. The figure is formatted according to the rules in Table 2. Bold text indicates that a rule is satisfied while normal text indicates otherwise. Since no rules are specified for the information technology and communications layers, the corresponding values are not formatted; neither is the central neighborhood N 2,2 where the event has occurred. In this run of the model, the professional responders only sent assistance at time t = 0. The neighborhoods N 1,2 , N 1,3 , N 2,3 and N 3,3 show decreasing health values, reflecting that assistance was sent to the affected cell N 2,2 .

The example involves a two-cell model. The complete model contains many more cells and rules conditioned on the data available for the Rochester area. The methodology is, however, generalizable to any region or response hierarchy. Indeed, the model framework is generic -only the rules and underlying geospatial and critical asset distributions are specific to a region. Other metropolitan statistical areas can easily create model frameworks based on their own data.

Conclusions

The proposed methodology is designed to assess the interplay between professional and community response networks for varying levels of community disruption. Central to the methodology is the approach used to understand how emergency response is enhanced or hampered by regional characteristics and community behaviors. The major contributions are the application of the base model and its use to create comprehensive models for real-world scenarios. It is hoped that this work will stimulate renewed efforts at ensuring effective, timely and efficient emergency response and management during disruptions ranging from short, minor perturbations to long-term, major disasters.

Figure 1 .

 1 Figure 1. Cellular grid.

Figure 2 .

 2 Figure 2. Cellular agent-based model of the five-county Rochester area.

Figure 3 .

 3 Figure 3. Neighborhood grid.

Figure 4 .

 4 Figure 4. Example model results.

Figure 5 .

 5 Figure 5. Cell 1 event timeline.

Table 1 .

 1 Model elements and goal of experiments.

	Model	Key	Levels	Assessment
	Component Parameters
	Operations	Event scope	Severity levels 1-3	Event size
	Infrastructure Communications,	Fully operational,	Infrastructure
	Layer	EMS capability,	partially operational, resilience
		IT systems	non-operational
	Resources	Needs, abilities	None, moderate,	Sociological/
		and resources	high	economic effects of
		vectors		resource variation
	Community	vector Low, medium, high	Variations in
				community response

Table 2 .

 2 Example rules.

	Response Type Rule
	Community	Ni,j,t -S > minimum health threshold
	Community	Ni,j,t > N2,2,t
	Community	Hi,j,t > minimum help threshold
	Professional	ELt -0.1 > minimum capacity threshold

Table 3 .

 3 Two-cell model event values.

	Time Emergency Emergency Cell 1	Cell 1	Cell 2	Cell 2
		Capacity	Capacity	Health Overall Health Overall
		without	with		Neighbor		Neighbor
		Comm.	Comm.		Response		Response
	0	0 . 9	0 . 9	0 . 4 0	0 . 2 0	0 . 1 1	0
	1	0 . 8	0 . 9	0 . 5 8	0	0 . 1 1	0 . 0 5
	2	0 . 8	0 . 9	0 . 5 8	0 . 1 5	0 . 2 3	0 . 1 5
	3	0 . 8	0 . 9	0 . 6 4	0 . 1 0	0 . 2 9	0 . 0 5
	4	0 . 8	0 . 9	0 . 6 8	0	0 . 3 1	0 . 0 5


Stig Johnsen

MITIGATING EMERGENT VULNERABILITIES IN OIL AND GAS ASSETS VIA RESILIENCE

Keywords: Oil and gas assets, emergent vulnerabilities, safety, security, resilience

This chapter discusses digital vulnerabilities and resilience in the Norwegian oil and gas infrastructure. The Norwegian oil and gas sector is a part of the European Union's critical infrastructure because Norway supplies approximately 10% of the European Union's oil and 30% of its gas. Hidden, dynamic and emergent risks are considered and resilience engineering is suggested as a framework for handling, recovering from and adapting to unexpected incidents.

Introduction

Analyzing digital vulnerabilities and enhancing resilience in the Norwegian oil and gas infrastructure are essential to handle the hidden, dynamic and emergent risks that are introduced as new technologies and solutions are incorporated in the infrastructure. The digital infrastructure comprises information and communications systems integrated with supervisory control and data acquisition (SCADA) systems that manage oil and gas production and distribution to customers in the European Union and other countries.

The oil and gas sector is a significant part of Norway's national industry -it represented more than 19% of the total value creation and contributed 27% of the total state revenue in 2015. Norway is a significant supplier of oil (10%) and gas (30%) to the European Union, which has previously faced energy supply problems that resulted in blackouts and gas shortages.

The term "societal safety" is used in Norway when discussing vulnerabilities at the societal level, such as those in the energy and transportation sectors. The Norwegian Ministry of Justice and Public Security [START_REF]Statement on Safety and Security, Report 17[END_REF] defines it as the ability of society to maintain important societal functions and safeguard citizens' lives, health and basic needs during different forms of stress. Since oil and gas are required for transportation, power generation and heating, their uninterrupted supply helps maintain important societal functions. The oil and gas sector can, therefore, be considered a part of the critical infrastructure that supports societal safety. In fact, the Norwegian energy sector is specifically designated by the European Union as a part of its critical infrastructure [START_REF]Critical Infrastructures and the Assessment of the Need to Improve Their Protection[END_REF].

The oil and gas industry can be perceived as a "digital ecosystem." A software ecosystem is defined as a set of businesses functioning as a unit and interacting with a shared market of software and services, along with the relationships among them. The relationships are frequently underpinned by a common technological platform or market and operate via the exchange of information, resources and artifacts [START_REF] Jansen | A sense of community: A research agenda for software ecosystems[END_REF]. A digital ecosystem is a metaphor inspired by natural ecosystems that describes a distributed, adaptive and open socio-technical system comprising a legal and organizational framework, applications (with components) and their data and digital content, supported by a set of infrastructure services. The concept is useful when exploring digital vulnerabilities and resilience in the oil and gas sector because they depend on how the entire ecosystem is working, developed and improved.

Norway is considered to be one of the most "digitalized" countries in the world [START_REF]Committee of Digital Vulnerabilities in Society, Digital Vulnerability -Secure Society: Protecting People and Society in a Digitalized World[END_REF]. This status offers many major benefits, but challenges abound because the vulnerabilities and risks have progressed significantly. The Norwegian status and experience can be of value to other countries that do not yet have such a high degree of digitalization. Based on a systematic analysis of Symantec incident reports, Subrahmanian et al. [START_REF] Subrahmanian | The Global Cyber-Vulnerability Report[END_REF] have suggested that the Nordic countries (i.e., Norway, Denmark and Finland) are among the safest countries in terms of reported cyber incidents and attacks.

This chapter discusses digital vulnerabilities and resilience in the Norwegian oil and gas infrastructure. Hidden, dynamic and emergent risks are considered and resilience engineering is suggested as a framework for handling, recovering from and adapting to unexpected incidents.

Terminology

The goal is to protect critical assets (i.e., objects and processes) of value to stakeholders. The assets are a part of the infrastructure that is of critical importance to society, namely the critical infrastructure.

A vulnerability is a weakness in an asset or process or a gap in the protection efforts. A threat is something that has the potential to cause harm by exploiting a vulnerability. Risk is the combination of the likelihood of occurrence of harm and the potential severity.

The European Union IntegRisk Project [START_REF]Standard DIN CWA 16649, Managing Emerging Technology-Related Risks[END_REF] defines emergent risk as a risk that is new and/or increasing. The International Risk Governance Council (IRGC) [START_REF]International Risk Governance Council, Guidelines for Emerging Risk Governance[END_REF] defines emergent risks as new risks or familiar risks that become apparent in new or unfamiliar conditions. Since emergent risks are described as new to an actor or environment, the concepts of knowledge and knowledge maturation are important when examining these risks and the surrounding environment and actors. This is in line with Flage and Aven [START_REF] Flage | Emerging risk -Conceptual definition and a relation to black swan type of events[END_REF], who emphasize that knowledge is the key concept for handling emergent risks and black-swantype events.

Since new risks are difficult to anticipate, a key mitigation strategy is to explore and incorporate resilience; in fact, resilience has been used as a framework to handle surprises caused by new environments and changes. Resilience is the intrinsic ability of a system to adjust its functioning prior to or following changes and disturbances, so that it can sustain operations even after a major mishap or in the presence of continuous stress [START_REF]Resilience Engineering: Concepts and Precepts[END_REF].

Problem Statement

The threat picture in the oil and gas sector is evolving and new risks are emerging. Information and communications technologies are increasingly used in oil and gas production and distribution. Specifically, the information and communications systems are required to operate industrial control systems that manage critical processes. Thus, an undesirable incident -intentional or random -can impact health, safety and the environment. The Stuxnet attack [START_REF] Falliere | Stuxnet Dossier, Symantec[END_REF] raised awareness of the vulnerabilities in industrial control systems that can be exploited to cause physical harm. In 2008, a cyber attack was launched against an oil pipeline in Turkey; a review of the incident revealed poor knowledge of cyber vulnerabilities and limited follow-up analysis [START_REF] Robertson | Mysterious '08 Turkey pipeline blast opened new cyberwar[END_REF]. In 2014, attackers compromised the control network of a German steel mill and caused considerable physical damage by manipulating the controls of a blast furnace [START_REF]Federal Office for Information Security, The IT Security Situation in Germany in 2014[END_REF]. These cyber-physical incidents and others are important and there is a need to learn from them and to share the knowledge in order to address current and future threats.

Empirical analysis of the Industrial Incident Database [START_REF] Byres | Using ANSI/ISA-99 Standards to Improve Control System Security (plus White Paper)[END_REF] reveals that the reported incidents are broad and that multiple actions must be considered because incidents typically involve the exploitation of multiple vulnerabilities. The following categories of incidents were reported in the database:

Unintentional Incidents (80%): Software or hardware errors (38.4%), general malware (30.4%) and human error/poor design (11.2%).

Intentional Attacks (20%): External hackers/attackers (9.4%) and insiders (i.e., employees or consultants) (10.6%). Thus, there is a need to consider unintentional incidents (i.e., safety issues) as well as intentional attacks (i.e., security issues).

In the context of new cyber-physical incidents and the broad risk picture of the Norwegian oil and gas sector that combines both safety and security, it is necessary to study two main questions:

What are the main areas of emergent risks in the context of safety and security in the oil and gas industry? What are the key strategies for mitigating the emergent risks proactively (i.e., during the planning stage) and reactively (i.e., during the operating and incident response phases)?

This research builds on the International Risk Governance Council's framework of contributing factors related to emergent risks [START_REF]International Risk Governance Council, Guidelines for Emerging Risk Governance[END_REF]

Methods

This research focuses on emergent risks and risk mitigation at two levels: (i) proactively, based on national cyber security strategies and plans, and regulations focused on protecting critical assets; and (ii) reactively, based on assessing knowledge of threats/vulnerabilities, risk assessment procedures, documentation/awareness of incidents/events and procedures for handling emergencies. The perspective is based on a "bow-tie" approach that examines: (i) proactive mitigation through systematic planning of proactive barriers; (ii) incident handling; and (iii) reduction of incident consequences through reactive barriers. Proactive mitigation engages systematic sets of barriers and activities that reduce incident probability. Reactive mitigation engages systematic sets of barriers and activities that reduce incident consequences.

The exploration of the proactive aspects was performed via document reviews and workshop participation. Reviews were performed of cyber security strategies in Europe and in the United States, with an emphasis on emergent threats and impact mitigation through resilience. Regulatory progress related to the protection of critical assets was also studied.

The exploration of the reactive aspects involved thorough reviews of government status reports, surveys of knowledge maturation and interviews of key personnel from the Norwegian Ministry of Justice and Public Security, Norwegian National Security Authority (NSM), Norwegian Police Directorate, and oil and gas industry. Publications produced by the Petroleum Safety Authority (PSA) of Norway were also examined.

Vulnerabilities and Resilience

This section presents the results of the analysis of the proactive aspects. Specifically, it discusses strategies and regulatory conditions, and how security activities are performed based on observations by safety authorities and industry personnel.

Asset Protection

The Security Act of Norway [START_REF]The Security Act[END_REF] mandates measures for asset protection as specified in the regulations for protecting objects [START_REF]Measures for Protecting Objects[END_REF]. The Ministry of Defense has administrative responsibility over the Security Act and the National Security Authority. The National Security Authority is the entity responsible for following up on measures for protecting objects.

Cyber systems are considered to be critical objects and are, therefore, part of the critical infrastructure. The European Council Directive 114/08 on the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve Their Protection was released in 2008 [START_REF]Critical Infrastructures and the Assessment of the Need to Improve Their Protection[END_REF]. This directive was implemented in Norway in 2012 [START_REF]The Implementation of the EPCIP Directive[END_REF], nearly five years after the European Union implementation, indicating poor proactive efforts.

Additionally, differences exist in how the objects are classified and handled. The European Union considers the Norwegian oil and gas sector to be a part of the European critical infrastructure. A white paper by the Norwegian National Safety Authority [START_REF]Guideline for Protecting Objects[END_REF] specifies the critical infrastructure sectors in Norway as: Energy (electricity, oil and gas).

Transportation and telecommunications.

Drinking water and infrastructures based on satellites.

On the other hand, the European Council Directive 114/08 lists the sectors as: Energy (electricity, oil and natural gas).

Transportation (roads and highways, railroads, aviation, inland waterways, shipping and ports).

Curiously, as of 2016, the responsible political authority, the Norwegian Ministry of Justice and Public Security, has not designated the Norwegian oil and gas sector as a part of the national critical infrastructure. Thus, the national list of critical objects does not include offshore installations and onshore oil and gas facilities.

In 2009, the Norwegian Police Directorate [START_REF]Response on Measures for Protecting Objects[END_REF] stated that it is problematic that there is no national list of critical objects outside the scope of the Security Act, such as objects of local character and objects owned by private businesses. This includes offshore installations and onshore oil and gas facilities that are not covered by the Security Act. The same applies to companies in the energy sector such as electric power suppliers.

Norwegian regulations for protecting critical objects [START_REF]Measures for Protecting Objects[END_REF] were published in 2011. However, discussions of the proposed regulations were extensive, dating back to 1997. In interviews with experts, it was pointed out that the regulations were discussed for more than 13 years before they were finally published. The delay was due to internal discussions -and disagreements -between the various agencies. It was challenging to get the regulations in place; however, they are now used as an important tool to support the work of the Norwegian National Security Authority.

In summary, proactive asset protection efforts in Norway have been poor. It took more than ten years to create regulations for identifying and protecting critical objects.

Security Guidelines

The process of implementing new rules and regulations was also examined during the interviews. Risk assessment and protection of the oil and gas infrastructure have been considered by industry actors. For example, the safety and security guidelines used by industry were specified in 2004 in the form of checklists and scenarios in methods for verification and validation such as CRIOP [START_REF] Johnsen | CRIOP: A Scenario Method for Crisis Intervention and Operability Analysis[END_REF] and in the OLF 104 best practice technical guidelines [START_REF] Ask | Information Security Baseline Requirements for Process Control, Safety and Support ICT Systems[END_REF][START_REF] Johnsen | Reducing risk in oil and gas production operations[END_REF].

The CRIOP method was developed by key industry participants in collaboration with the Human Factors in Control Network (www.hfc.sintef.no).

The OLF 104 best practice guidelines were established in collaboration with the Norwegian Oil and Gas Association (OLF). The guidelines were incorporated in the Petroleum Safety Authority of Norway regulations [START_REF]Regulations Relating to Design and Outfitting of Facilities, etc. in the Petroleum Activities (The Facilities Regulations)[END_REF] after ten years. Section 34a of the regulations says that the Norwegian Oil and Gas Guideline No. 104 (OLF 104) should be used as the basis for protecting against information and communications technology hazards. The discussion and acceptance processes were intense and protracted. The slow pace at which the regulations were established demonstrates the poor support given to stakeholders who seek to mitigate emergent vulnerabilities.

Several industrial control system incidents with the potential for harm have occurred in the oil and gas sector, but no major disaster has occurred as of this time (2016). In the surveys and interviews, it was pointed out that there is poor knowledge of security guidelines -only about 50% of the respondents were aware of the guidelines. Additionally, attacks on information and communications technology assets have sometimes not been understood or identified (an offshore server park was unstable for six months before a virus infection was identified and firewall logs are seldom examined and analyzed). Since information and communications system vulnerabilities and incidents are not routinely identified or analyzed, there may be latent vulnerabilities in the infrastructures and poor procedures for handling unexpected incidents if and when they occur. Clearly, the conditions for emergent risks are present.

A key finding related to object protection is that what is prioritized as a part of societal safety does not match what is considered to be a critical infrastructure by all stakeholders. The process of establishing regulations has been slow and cumbersome, and certainly not proactive. Risk assessment is event based (i.e., reactive, not proactive and analytic in nature). Moreover, it took more than ten years to establish regulations, although industry had already prioritized areas of concern with regard to safety and security and had already adopted various rules and best practices.

Reactive (Not Proactive) Focus

The interviews also focused on how risks were assessed and prioritized. In general, it was observed that the risk assessment process is influenced by undesirable incidents and not driven by a systematic, proactive and analytic approach. Indeed, the process is ad hoc and reactive in nature and is driven by actual incidents. Unfortunately, this may be difficult to change due to limited resources and uncertainties in risk assessments. The 2014 annual report by the Norwegian National Security Authority [27] highlights missing risk assessments, inadequate management and risk governance, and poor proactive implementations of measures for protecting objects. In essence, the interviews and official reports reveal a focus on reactive -as opposed to proactive -protection of objects.

During the research, Norwegian National Security Authority officials were asked how audits and controls of the actual use of regulations were performed, including audits of measures for protecting objects. The officials reported that they used the ISO 19011 standard [11] as a framework for performing audits. Starting in 2013, the Norwegian National Security Authority has performed checkbacks of its audits. This checkback process appears to have enhanced the audit process by ensuring that deviations are handled and mitigated.

Emergent Threats and Resilience

A strategy is a set of actions (or roadmap) to achieve or reach a specific goal or vision. The process of developing a strategy can be as important as the resulting strategy document because it establishes the context, understanding and ownership (responsibility) in the execution of the strategy. A strategy usually has three parts: (i) diagnosis, which defines the challenges; (ii) policy, which deals with the challenges; and (iii) actions, which are designed to carry out the policy. The development of a national strategy is a collaborative effort involving several actors and it is often exceedingly difficult to specify explicit responsibilities. The current Norwegian National Cyber Security Strategy This research also explored the national cyber security strategies of other countries in Europe and of the United States. The national strategies are concerned about new technologies implemented in key areas and the (implicit) possibility of emergent risks. Thus, there are a variety of perspectives with regard to identifying best practices and common goals/strategies between countries. Luiijf et al. [START_REF] Luiijf | Nineteen national cyber security strategies[END_REF] have performed a comparison of nineteen national cyber security strategies. However, the comparison does not cover the strategies of Norway and the other Nordic countries. The Nordic countries are mature and advanced users of information and communications technologies at the societal level. Thus, a review of the Nordic experiences could help advance the state of the art.

Johnsen [START_REF] Johnsen | A comparative study of the Norwegian cyber security strategy vs. strategies in the EU and U.S. -Emerging cybersafety ignored[END_REF] has reviewed the Norwegian National Cyber Security Strategy. Based on this review and the work by Luiijf et al. [START_REF] Luiijf | Nineteen national cyber security strategies[END_REF], the following six areas of concern related to the Norwegian National Cyber Security Strategy are identified:

Limited focus on international collaboration related to the sharing of common strategies and support of good practices.

Limited support for identifying and specifying critical infrastructure assets.

Lack of a formal list of critical objects.

Limited focus and analysis of emergent threats, especially cyber-physical threats.

Limited focus on resilience as a strategy for mitigating the effects of unexpected events.

Limited focus on engaging users to ensure the understanding and acceptance of cyber security strategies.

Since there is no formal national list of critical objects (and functions), there may be a varying focus on protection in the value chain that comprises multiple providers. An example is the Norwegian oil and gas facilities, which are not specified as critical objects by Norway; however, they are designated as a part of the European Union critical infrastructure because they supply large amounts of oil and gas to countries in Europe. This missing perception of criticality was seen in the surveys of operators and service providers in the value chain. Specifically, they do not have common perceptions of the criticality of objects and, thus, object protection procedures vary and are limited in their efficacy. Clearly, there is a need for precise definitions of critical objects and functions in a national cyber security strategy.

Infrastructure is often common across national borders and may have the same vulnerabilities across the borders, but the use of terms, standards and best practices varies in the different jurisdictions. Additionally, the same systems are used in different contexts, which results in the manifestation of different vulnerabilities. Thus, the combination of learning experiences across countries enhances the potential for knowledge maturation. Sharing vulnerabilities between companies across countries is also very beneficial. This practice is not common, but it should become the norm. Good practices are of variable quality and are shared based on different policies (i.e., some are shared while some are not). Some countries, such as the United States, invest considerable effort in developing standards and guidelines; where feasible and with appropriate adjustments, they should become the foundations for common standards and guidelines across countries. Moreover, they should be shared in a more proactive manner. Clearly, there is a need to focus on international collaboration, infrastructure responsibility across borders and the development and sharing of standards and guidelines.

The definition of cyber security differs considerably between countries. The Norwegian National Cyber Security Strategy [24] defines information security as the "protection of the confidentiality, integrity and availability of information;" cyber security is defined as the "protection of data and systems connected to the Internet." The definition of information security matches the common international definition; however, the definition of cyber security does not match an internationally-accepted definition. The Norwegian definition of cyber security should be aligned with international norms. A suitable definition is proposed by Rauscher et al. [START_REF]Russia-U.S. Bilateral on Cybersecurity: Critical Terminology Foundations[END_REF] -cyber security is the ability to resist intentional and unintentional threats and to respond and recover to incidents.

However, the definition of cyber security should also be expanded to include cyber-physical harm and cyber safety. Information and communications systems are used to manage critical processes in the energy sector, especially for controlling electric power generation, transmission and distribution, and oil and gas production and distribution. The information and communications systems are increasingly being connected to industrial control systems that manage critical processes, which increases the likelihood that an undesirable incident (intentional or accidental) can impact health, safety and the environment.

The concept of cyber security does not adequately accommodate the risks of physical harm posed by the interconnections between cyber systems and physical systems. A concept that covers safety -such as "cyber safety" or "cyber-physical safety" -is required. One possibility is to combine the cyber security definition of Rauscher et al. [START_REF]Russia-U.S. Bilateral on Cybersecurity: Critical Terminology Foundations[END_REF] with the definition of safety proposed by the U.S. Department of Defense [36]: cyber safety is the ability to resist undesirable intentional and unintentional incidents, and to respond and recover to avoid death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment.

As mentioned above, the International Risk Governance Council (IRGC) has specified a framework of contributing factors related to emergent risks [START_REF]International Risk Governance Council, Guidelines for Emerging Risk Governance[END_REF]. This research has conducted a subjective evaluation of the importance of the factors in the context of safety and security in the oil and gas industry:

Information Asymmetries/Communication: A key issue is to reduce the level of information asymmetries when stakeholders hold back key information about a risk that is not available to others because of a need-to-know policy. Effective, open and honest communication can help build trust and create a learning organization.

Scientific Unknowns/Technological Advances: The development of the Internet of Things and the integration of information and communications technologies in industrial control systems have created an infrastructure with unknown vulnerabilities. Risks often emerge when a technological change is implemented without an in-depth investigation and evaluation of the consequences. The risks can be exacerbated when policy or regulatory frameworks are inadequate.

Loss of Safety Margins/Increased Connectivity and Network Interactions: Tight couplings may lead to the loss of buffering or margins. This has been seen when industrial control systems are integrated with information and communications systems.

Interests, Values and Scientific/Social Dynamics: Public debates about emergent risks seldom show a clear separation between science, values and interests. There are differences in social standing and dynamics between different actors even in the same company (e.g., offshore vs. onshore and suppliers vs. operators). Thus, it is important to support open information sharing and trust between the various actors.

Malicious Motives and Acts: Malicious motives give rise to emergent risks. In a globalized context with interconnected infrastructures and new dependencies across borders, the effects of an undesirable incident can be broader and more intense than in the past.

Enhancing Risk Assessment and Recovery

The Petroleum Safety Authority of Norway has performed several surveys of the information and communications technology infrastructure used in the oil and gas industry. A 2010 survey [29] covered fixed offshore installations (i.e., operating platforms and production units). One key finding was that operators had performed poor evaluations of the criticality of objects, contributing to poor risk assessments. In addition, no information security policies were in place [START_REF] Johnsen | An Investigation of Resilience in Complex Socio-Technical Systems to Improve Safety and Continuity in Integrated Operations[END_REF]. Another problem was that the equipment used in critical operations had not gone through systematic testing and certification processes (e.g., as suggested by ISA Secure (www.isasecure.org) or Wurdltech/Acilles (www.wurldtech.com)). Moreover, industrial control systems were regularly connected to other networks (offshore and/or onshore) -the "air gap" between operational technology and information technology networks was nothing more than a myth.

Poor network segmentation between critical and non-critical systems was common and the systems were not always independent (e.g., control systems and emergency shutdown systems). Too many actors could access critical systems and secure password policies were either not in place or not enforced. Poor awareness and information sharing about incidents between information technology and operational technology professionals were also common. To address this problem, some companies had established local competence groups (e.g., CERTs), but information was generally not shared across the industry and with the Petroleum Safety Authority of Norway.

Examples of poor awareness and poor risk assessments abound. A survey of oil and gas industry suppliers revealed that around 50% of the respondents were unaware of the relevant information and communications technology safety and security standards or rules such as OLF 104 [START_REF] Johnsen | An Investigation of Resilience in Complex Socio-Technical Systems to Improve Safety and Continuity in Integrated Operations[END_REF]. Additionally, no emergency response plans or limited plans were in place to deal with breakdowns in the critical information and communications infrastructure. Additionally, there was poor attack awareness; for example, logs of firewalls that protected offshore systems were rarely reviewed in a systematic manner.

The Petroleum Safety Authority also conducted a survey of mobile drilling units in Norway in 2012-2013 [START_REF]Review of ICT -Security in Drilling, Process Control, Safety and Support Systems within the Oil and Gas Sector[END_REF]. The survey was designed to obtain subjec-tive assessments based on the OLF 104 guidelines. The survey revealed that there was increased integration of information and communications technology and process control systems, which could impact safety. Additionally, new vulnerabilities were identified arising from increased remote support and real-time data transfer between offshore and onshore facilities. A jump in the number of attacks was also observed.

The Petroleum Safety Authority survey identified three primary concerns:

Poor user education (related to OLF 104, ISBR 5).

Missing information security policy (related to OLF 104, ISBR 1).

Poor documentation and testing of disaster recovery plans (related to OLF 104, ISBR 7).

The three concerns are related. An information security policy usually identifies the criticality and risks that impact the need for user education and the establishment and testing of disaster recovery plans. These areas indicate poor knowledge maturation of threats and risks and, thus, greater likelihood of unanticipated incidents with negative impacts.

Oil and Gas Sector Vulnerabilities

The Petroleum Safety Authority of Norway and its collaborators have analyzed the digital vulnerabilities in the Norwegian oil and gas industry; a series of reports were published in 2008 [START_REF] Johnsen | Reducing risk in oil and gas production operations[END_REF], 2011 [29] and 2013 [START_REF]Review of ICT -Security in Drilling, Process Control, Safety and Support Systems within the Oil and Gas Sector[END_REF]. A comprehensive white paper that documented digital vulnerabilities at the societal level was published in 2015 [START_REF]Committee of Digital Vulnerabilities in Society, Digital Vulnerability -Secure Society: Protecting People and Society in a Digitalized World[END_REF]. The white paper identified the following main issues:

The excellent safety traditions in the oil and gas sector should be transferred to other Norwegian industry sectors.

The Petroleum Safety Authority should require that barriers be set up to protect against digital vulnerabilities.

The criticality and vulnerabilities of digital systems in the oil and gas sector should be assessed and documented at the societal level. At this time, there is no national list of critical objects in the offshore and onshore oil and gas industry.

The ability of the Petroleum Safety Authority to deal with digital vulnerabilities should be strengthened. Specifically, the regulatory framework and knowledge related to protecting oil and gas installations should be enhanced.

An oil and gas (or energy) computer emergency response team (CERT) should be established.

Emergency response training related to information and communications system incidents should be enhanced. The reactive barriers in this area are not as sound as the proactive barriers related to digital vulnerabilities.

While the white paper examines resilience related to telecommunications systems, the notion of resilience is not as broad as that described in [START_REF]Resilience Engineering: Concepts and Precepts[END_REF]. What is needed is a strong focus on cyber-physical threats and vulnerabilities, along with a deep consideration of emergent, hidden and dynamic threats.

Strengths and Resilience

The Norwegian oil and gas industry has certain strengths and resilience characteristics. For several years, the oil and gas industry has been concerned about the vulnerabilities that emerge from increased interconnectivity and realtime monitoring and management of offshore and onshore facilities.

The oil and gas industry has supported the development of methods and regulations to mitigate these weaknesses. Examples are documented in [START_REF] Johnsen | Reducing risk in oil and gas production operations[END_REF], such as the good practice guidelines related to cyber physical threats as described in the CRIOP method [START_REF] Johnsen | CRIOP: A Scenario Method for Crisis Intervention and Operability Analysis[END_REF] and the OLF 104 industry guidelines published by the Oil and Gas Industry Association [START_REF] Ask | Information Security Baseline Requirements for Process Control, Safety and Support ICT Systems[END_REF]. These guidelines are effective and should be adapted and used by other Norwegian industries. As a matter of fact, OLF 104 was incorporated in Norwegian regulations in 2014 (however, the process was slow).

The communications infrastructure was created by collaborative efforts between industry and the regulator with a strong focus on safety, security and resilience. For example, the oil and gas industry established a secure, dedicated point-to-point network named SOIL for selected users in the oil and gas community.

Offshore oil and gas equipment employs diverse technical solutions and platforms. The systems are, therefore, difficult to attack at the societal level and it can be argued that they are resilient in some sense [START_REF] Johnsen | An Investigation of Resilience in Complex Socio-Technical Systems to Improve Safety and Continuity in Integrated Operations[END_REF]. As of 2015, only minor incidents have been reported and no major health, safety or environmental issues have been identified or reported. Some reported incidents [START_REF] Johnsen | An Investigation of Resilience in Complex Socio-Technical Systems to Improve Safety and Continuity in Integrated Operations[END_REF] could have serious effects in combination with other events. However, systematic vulnerability analyses have not been performed of the entire systems, which means that hidden vulnerabilities may exist.

The criticality of the technical infrastructure has been assessed and documented in a broad survey [START_REF] Johnsen | An Investigation of Resilience in Complex Socio-Technical Systems to Improve Safety and Continuity in Integrated Operations[END_REF]. Specifically, when a communications infrastructure fails for more than a day, the criticality is assessed to be high and may lead to health, safety or environmental incidents. There has been poor investigation and reporting of cyber-related incidents to the authorities and poor focus on cyber security vulnerabilities in accident analyses (thus, investigations only find what they are seeking [START_REF] Lundberg | What-you-look-for-is-whatyou-find: The consequences of underlying accident models in eight accident investigation manuals[END_REF]). A U.S. National Transportation Safety Board report [START_REF]National Transportation Safety Board, Supervisory Control and Data Acquisition (SCADA) in Liquid Pipelines, Safety Study[END_REF] that scrutinized 13 pipeline mishaps from 1992 to 2004 found key issues in displays, alarm management, training, fatigue and leak detection systems. In ten of these accidents, some aspect of industrial control systems contributed to the severity of the accidents. However, the National Transportation Safety Board did not collect data regarding whether control systems were involved in gas pipeline accidents until 2010. Such information asymmetries can create the foundation for emergent risks.

The Norwegian oil and gas industry has an excellent safety record [START_REF]Trends in Risk Level[END_REF] and has taken proactive steps to develop guidelines and standards. Thus, other Norwegian industries and regulatory agencies (as well as safety authorities) can learn from the industry practices and regulatory principles. At this time, the reporting of information and communications system incidents is not consistent. However, as a result of the report by the Norwegian Committee of Digital Vulnerabilities in Society [START_REF]Committee of Digital Vulnerabilities in Society, Digital Vulnerability -Secure Society: Protecting People and Society in a Digitalized World[END_REF], an excellent opportunity exists to build on the strengths and reduce the weaknesses by reporting industrial control system incidents and successful recovery efforts.

Key Findings

This section presents the key findings. When exploring digital vulnerabilities it is important to define a scope that covers systems, regulations and infrastructure. Thus, the term "digital ecosystem" of the oil and gas industry is used. Three key issues related to dealing with emergent vulnerabilities in the digital ecosystem are:

Handling emergent threats and risks proactively based on regulations, strategies and plans.

Handling actual emergent incidents based on knowledge, organization, procedures, actions and operations impacted by the vulnerabilities.

Handling emergent unexpected incidents in a reactive manner.

The following are the key issues that hinder the ability to deal with emergent threats: Slow pace in establishing formal regulations to protect assets.

Slow pace in incorporating industry-developed information and communications system security guidelines in regulations.

Reactive instead of proactive focus.

Lack of strategic focus on emergent threats and resilience.

Inadequate knowledge of risks, quality of risk assessments and ability to recover from incidents.

Several digital vulnerabilities in the oil and gas sector.

The complacency in establishing formal regulations related to the protection of objects and in including guidelines in regulations demonstrate the challenges of being proactive when improving regulations. The reactive focus and lack of consideration of emergent threats underscore the need to improve the proactive focus. The inadequate knowledge of risks and the need to recover from unexpected incidents emphasize improved risk governance involving societal audits of key mitigating actions. As mentioned above, the Norwegian oil and gas sector has some strengths and resilience capabilities, but these have to be nurtured to help address the safety and security challenges posed by emergent threats.

Proactive Regulations and Guidelines

The maturation of knowledge about risks is dependent on collaboration through a process based on the exploration of weak signals, discussion of occurrences (real-world, simulated or testbed) followed by the establishment of industry practices and regulations, as described by IntegRisk Project [START_REF]Standard DIN CWA 16649, Managing Emerging Technology-Related Risks[END_REF]. The knowledge maturation process regarding vulnerabilities must have a structure; specifically, subjects (i.e., stakeholders who improve their knowledge) and objects (i.e., objects having vulnerabilities). The maturation process must handle learning and continuous adaptation by the key stakeholders. This is a slow process that may be negatively impacted when there are few actual occurrences and few learning opportunities.

The knowledge maturation process at the societal level must handle maturation in value chains in different areas; thus, there is a need for international collaboration. In order to enhance learning and adaptation, there is a need to collect and learn from incidents at the international level and to explore regulatory actions and guidelines established by other countries that may have broader and deeper experiences. As a result, it is necessary to be more proactive when examining regulatory actions, guidelines and best practices across borders.

Since the maturation process cannot cover all the emergent risks, it is necessary to impart the ability to adapt and handle the unexpected, which supports resilience. Resilience involves analyzing the possibilities in advance of incidents, handling undesirable incidents and surprises, utilizing the lessons learned based on diverse perspectives and supporting graceful extensibility and sustained adaptation [START_REF]Resilience Engineering: Concepts and Precepts[END_REF]. Resilience engineering should be considered proactively as well as reactively during incident handling to enhance the ability to recover.

Regulation establishes a framework and context for mitigating emergent risks and undesirable incidents. The arguments in support of regulations are: Regulations raise standards. This is especially important in the case of emergent threats that need more attention.

Regulations help deal with scenarios where the consequences of failures can be catastrophic.

Formulating industry best practices as regulations forces laggards to toe the line while enhancing knowledge and awareness.

Establishing common regulatory rules across a value chain ensures common risk perceptions by the involved actors.

The result of the maturation process is the ability to handle emergent threats by proactive as well as reactive means. Given the numerous emergent vulnerabilities, it is imperative to develop and apply proactive and reactive approaches to reduce risk.

Emergent Threats and Resilience

Resilience is mentioned in only nine of the 19 cyber strategies examined by Luiijf et al. [START_REF] Luiijf | Nineteen national cyber security strategies[END_REF] and it is not explicitly addressed in the Norwegian Cyber Security Strategy [24]. In an environment facing emergent risks and the increased possibility of intentional attacks, it is simply not possible to have a clear understanding of risks and undesirable incidents. Therefore, a key strategy is to focus on resilience in order to endow the ability to handle surprises and adapt to ensure adequate operational capabilities and recovery.

It is important to define the notion of cyber safety to handle interconnections between cyber systems and physical systems and to incorporate cyber safety in cyber strategies. As a consequence, the Norwegian Cyber Security Strategy should specify and mandate standards and methods covering information and communications systems as well as cyber-physical systems. To ensure that technology is resilient and robust, stress testing and certification of key components should be performed. Certification should be performed based on accepted standards such as the IEC 62443 Conformity Assessment Program. In a society with emergent risks, the ability to handle unexpected incidents requires the mobilization and involvement of all levels of society. Thus, a national cyber security strategy should focus on engaging citizenry in cyber security and cyber safety efforts. The adaptation to and handling of undesirable and unexpected events must be underpinned by a framework that enables society to support key societal functions.

Risk Governance and Societal Audits

The Norwegian Cyber Security Strategy [24] describes several gaps. For example, security measures are often unsystematic and fragmented, and information security efforts do not have enough support from management and are not well integrated into business management. These gaps match some of the findings in [START_REF]Committee of Digital Vulnerabilities in Society, Digital Vulnerability -Secure Society: Protecting People and Society in a Digitalized World[END_REF].

According to the Norwegian Cyber Security Strategy, it is also important to audit strategies and the results of the strategies in order to close the gaps and reduce complacency (i.e., lack of management support and poor integration with business management). The audits should be based on a recognized standard such as ISO 19011 [11] that is used by other regulatory authorities, including the Norwegian National Security Authority.

At the societal level, it is necessary to be more proactive by implementing mitigation actions [START_REF] Johnsen | Ten years from risk assessment to regulatory action -Is complacency creating a reactive and brittle regulatory regime in Norway? in Safety and Reliability of Complex Engineered Systems[END_REF] and performing audits and checks that can be reported to the legislative branch. A suitable entity for implementing this could be Norway's Office of the Auditor General (Riksrevisjonen). The office could audit strategies to address complacency, poor prioritization, difficult cross-sectoral challenges and limited collaboration. This may be especially effective because the Office of the Auditor General is the national government auditor and is directly subordinate to the Norwegian Parliament.

Conclusions

As with other infrastructure sectors, the Norwegian oil and gas sector faces many emergent digital vulnerabilities. The sector is considered to be a part of the European Union's critical infrastructure because it supplies approximately 10% of the European Union's oil and 30% of its gas. However, Norway itself does not categorize its oil and gas assets and the associated information and communications systems as a part of its national critical infrastructure, creating different perceptions of protection in the value chain. As a result, there is significant variability in safety and security policies, procedures and implementations. Given the scope and magnitude of the emergent threats, there is an urgent need to be more proactive with regard to regulations, knowledge, risk communication and technology, and to establish strategies for dealing with unexpected incidents. Resilience engineering is an important component of any strategy for adapting to and recovering from incidents in a graceful manner.

It is also important to focus on testing and certification of critical cyberphysical equipment whose disruption or destruction can cause negative health, safety and environmental effects. Risk governance should be enhanced through improved incident investigations, audits throughout the value chain and frequent reviews of mitigation strategies and actions. Knowledge sharing should be enhanced through research, collaboration between safety and security experts and the creation of industry-specific computer emergency response teams. Finally, European Union countries, other European nations and the United States should expand and strengthen their cross-border efforts to ensure that the globally-connected critical infrastructure is both secure and resilient.

  [24] was published in 2012 by the Ministry of Justice and Public Security; Ministry of Government Administration, Reform and Church Affairs; Ministry of Defense; and Ministry of Transport and Communications.

Acknowledgements

This research was conducted under the New Strains Project supported by the Norwegian Research Council. The research was also supported by the Norwegian University of Science and Technology (NTNU).