Christos Siaterlis

Bela Genge

Marc Hohenadel

Marco Del Pra

Enabling the Exploration of Operating Procedures in Critical Infrastructures

Keywords: Critical infrastructures, operating procedures, security, simulation

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Most investigations that focus on critical infrastructures (e.g., power plants, smart grids and water treatment facilities) highlight the fact that human operators play a crucial role in the resolution of cyber security incidents [START_REF] Gheorghe | Critical Infrastructures at Risk: Securing the European Electric Power System[END_REF]. Simple configuration mistakes that leave systems unprotected are often uncovered only after security incidents. On the other hand, human decisions can make the difference between a complete breakdown and system survival.

The interaction of human operators with critical infrastructures is mostly implemented using information and communications technologies, largely due to reduced costs and greater efficiency, flexibility and interoperability. Consequently, several approaches have focused on the design of (graphical) interfaces, also known as human-machine interfaces (HMIs), that assist decision making processes and reduce the reaction times of human operators [START_REF] Moussa | A model based approach to semiautomated user interface generation for process control interactive applications[END_REF][START_REF] Reeder | User interface defect detection by hesitation analysis[END_REF]. On the other hand, human operators can also interact with a system independently of HMIs, for example, by switching a device on or off. Therefore, testbeds that focus on the analysis of critical infrastructures should also take into account the presence of human operators.

This paper argues that the presence of human operators and HMIs dramatically changes system behavior and should be taken into account when designing testbeds for analyzing critical infrastructures. Existing testbeds (see, e.g., [START_REF] Davis | SCADA cyber security testbed development[END_REF][START_REF] Mcdonald | Cyber Effects Analysis Using VCSE: Promoting Control System Reliability[END_REF][START_REF] Nai Fovino | An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants[END_REF][START_REF] Wang | A simulation environment for SCADA security analysis and assessment[END_REF]) may engage human operators and real HMIs, but they do not include software simulations of these components. Although testbeds with human operators and real HMIs provide reliable experimental data, they are unable to support exhaustive parameter testing. This is mainly due to the costs involved in acquiring and training human operators, and the costs of customizing proprietary HMI software.

Recognizing the importance of human operators and, especially, operating procedures in security experiments, we propose an extension to our previously developed experimentation framework [START_REF] Genge | Analyzing cyberphysical attacks on networked industrial control systems[END_REF]. The extension incorporates "human decision" units that can run human operator and HMI models in real time. Actions issued by the models are translated into commands that are executed in the cyber and physical realms. This way, the extended framework enables the recreation of realistic scenarios in which operators interact with the cyber realm and also execute actions in the physical realm. The approach is evaluated by assessing the impact of human operator reactions during an attack on a cyber-physical infrastructure incorporating the IEEE 30-bus power grid model.

Related Work

Most of the critical infrastructure experimentation testbeds in use today do not take into account human operator or HMI models. In contrast, several testbeds have been developed that model the interactions of human operators with a physical process through real HMIs. The most relevant approaches from both these categories are discussed in this section.

Chabukswar, et al. [START_REF] Chabukswar | Simulation of network attacks on SCADA systems[END_REF] used the Command and Control WindTunnel [START_REF] Neema | Model-based integration and experimentation of information fusion and C2 systems[END_REF] multi-model simulation environment based on the IEEE high-level architecture standard [START_REF] Shi | The introduction of high level architecture (HLA) and run-time infrastructure (RTI)[END_REF] to facilitate interactions between simulation engines. They used OMNeT++ to simulate a network, and Matlab Simulink to build and run the physical process model. In this approach, neither the human nor the HMI were considered because the main focus of the testbed was to recreate critical infrastructures and hardware control loops.

Hopkinson, et al.

[9] adopted a similar approach, in which a PowerWorld server (a high-voltage power system simulation and analysis package) [15], was used to provide a simulation environment for electrical power systems and the ns-2 network simulator was used to simulate other system components (e.g., programmable logic controllers (PLCs) and malware). Like the work of Chabukswar, et al., this approach also does not consider human operators or HMI models. Nevertheless, it provides a generic interface for extending the testbed with additional ns-2 modules. Although the approach could support the integration of external modules, it was not designed to run complex mathematical models such as those developed using dedicated modeling tools like Simulink. Furthermore, designers would have to define "glue" code to enable the integration of a wide range of models with ns-2. These aspects are the main focus of the work described in this paper -among other things, glue code consisting of several modules and interfaces is proposed to integrate human operator and HMI models in a previously developed critical infrastructure experimentation testbed.

In contrast with the two approaches mentioned above, several testbeds (e.g., [START_REF] Davis | SCADA cyber security testbed development[END_REF][START_REF] Mcdonald | Cyber Effects Analysis Using VCSE: Promoting Control System Reliability[END_REF][START_REF] Nai Fovino | An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants[END_REF][START_REF] Wang | A simulation environment for SCADA security analysis and assessment[END_REF]) incorporate "real" humans and HMIs -specifically, human operators interact with real proprietary HMIs. Although such testbeds provide reliable experimental data, they are unable to support exhaustive parameter testing involving human operators and HMIs. Queiroz, et al. [START_REF] Queiroz | Building a SCADA security testbed[END_REF] have implemented just such an approach. In their testbed, HMIs are simulated as OMNeT++ modules and human operators interact with the simulated HMIs. Although this approach represents an advancement over the approaches described above, it still requires human operators to be present and interact with the system. Ultimately, the fidelity of such an approach is counterbalanced by its higher costs and lower efficiency because experiments might require the presence of multiple humans to perform repetitive tasks in order to cover the entire parameter space.

Problem Statement

In many fields, there is an increasing trend to replace humans with automated control loops. Nevertheless, human operators continue to play a significant role in the operation of critical infrastructures, especially during abnormal situations and contingencies.

Most critical infrastructure experimentation testbeds available today (see, e.g., [START_REF] Davis | SCADA cyber security testbed development[END_REF][START_REF] Mcdonald | Cyber Effects Analysis Using VCSE: Promoting Control System Reliability[END_REF][START_REF] Nai Fovino | An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants[END_REF][START_REF] Wang | A simulation environment for SCADA security analysis and assessment[END_REF]) engage real human operators and HMIs, not simulations of human operators and HMIs. Human operator modeling (see, e.g., [START_REF] Bekey | Identification of sampling intervals in sampled-data models of human operators[END_REF][START_REF] Craik | Theory of the human operator in control systems[END_REF][START_REF] Harris | Human Operator Simulator (HOS) IV User's Guide[END_REF][START_REF] Ivancevic | Human operator modeling and Liederivative based control[END_REF][START_REF] Rao | BDI agents: From theory to practice[END_REF][START_REF] Zhao | Modeling human operator decisionmaking in manufacturing systems using BDI agent paradigm[END_REF]) is a complex task; in fact, research on designing human operator models has been around since the beginning of the 20th century [START_REF] Bekey | Identification of sampling intervals in sampled-data models of human operators[END_REF][START_REF] Craik | Theory of the human operator in control systems[END_REF]. Recent research has demonstrated the applicability of linear and nonlinear control theories [START_REF] Ivancevic | Human operator modeling and Liederivative based control[END_REF] and belief-desire-intention paradigms combined with agent-based platforms [START_REF] Rao | BDI agents: From theory to practice[END_REF][START_REF] Zhao | Modeling human operator decisionmaking in manufacturing systems using BDI agent paradigm[END_REF] in the human operator modeling process. Each approach comes with its own advantages and disadvantages, complicating the task of selecting an approach. Therefore, the design of a generic experimentation platform with human operator and HMI models that could be applied to a wide range of critical infrastructures is not a trivial task.

Taking into account the complexity and diversity of critical infrastructures and the operator models needed for each of these systems, a single operator model that is applicable to all systems may not be possible, let alone feasible. A solution that would require the integration of every operator model from scratch would also be infeasible. A more reasonable solution would provide designers with several interfaces that allow a wide variety of operator models to be adapted, coupled and integrated into a testbed. The solution should also enable the coupling and integration of various HMI models because HMI software has a major impact on the state of a critical infrastructure.

It is also important to take into account the fact that large critical infrastructures have many human operators who supervise and control systems at any given time. A generic representation of the human decision making process should include hierarchical and graph-based information flows. These complex interactions should not be ignored or the applicability of the approach would be greatly limited.

Another important issue to be considered is the translation of simulated operator decisions to actions in the cyber-physical realm. These actions include interactions with the physical process as well as interactions in the cyber realm (e.g., configuring a firewall, launching an external script and shutting down a computer). The translation process should be flexible and should rely on generic modules that are easily replaceable. In this way, the implemented solution would support experimentation with a wide range of physical processes and networked industrial control systems.

Extending existing critical infrastructure experimentation testbeds with human operator and HMI models is a complex task. But it is important because, when human operator and HMI models are added, the experimentation environment is able to support the human-in-the-loop paradigm that plays a crucial role in the outcome of any cyber security experiment involving critical infrastructures.

Proposed Approach

This section presents our approach for integrating human decision making into our previously developed critical infrastructure experimentation framework [START_REF] Genge | Analyzing cyberphysical attacks on networked industrial control systems[END_REF]. The section begins with a brief overview of the experimentation framework and proceeds to describe the extension.

Experimentation Framework

The experimentation framework developed in our previous work [START_REF] Genge | Analyzing cyberphysical attacks on networked industrial control systems[END_REF] follows a hybrid approach, where the Emulab-based testbed recreates the control and process network of a networked industrial control system, including PLCs and SCADA servers, and a software simulation reproduces the industrial process. The architecture shown in Figure 1 has three layers: (i) cyber layer; (ii) physical layer; and (iii) link layer, which lies in between the cyber and physical layers. The cyber layer includes various information and communication technology components that are used in SCADA systems, while the physical layer incorporates simulations of physical processes and devices. The link layer (cyberphysical layer) provides the glue between the two layers through the use of a shared memory region.

The physical layer is recreated using a soft real-time simulator that runs on the simulation core (SC unit) and executes a model of the industrial process. The cyber layer is recreated by an emulation testbed that uses the Emulab architecture and software [START_REF] White | An integrated experimental environment for distributed systems and networks[END_REF] to automatically and dynamically map physical components (e.g., servers and switches) to a virtual topology.

In addition to the process network, the cyber layer also includes control logic code that is executed by PLCs in a real-world system. The control code can be run sequentially or in parallel with the physical model. In the sequential case, tightly coupled code (TCC) is used; this code runs on the SC unit in the same memory space as the model. In the parallel case, loosely coupled code (LCC) is used; this code runs in another address space, possibly on another host in the remote PLC (R-PLC) unit. The main advantage of TCC is that it does not miss values generated by the model between executions. On the other hand, LCC allows the remote execution of PLC code, the injection of malicious code without stopping model execution, and the execution of complex PLC emulators. A master unit implements global decision algorithms based on the sensor values received from R-PLC units.

The cyber-physical layer incorporates PLC memory (as a set of registers typical of PLCs) and the communications interfaces that glue the other two layers. Memory registers provide links to inputs (e.g., valve position) and outputs (e.g., sensor values) of the physical model.

Prototypes of SC, R-PLC and master units were written in C# (Windows) code, which was ported and tested on Unix-based systems (FreeBSD, Fedora and Ubuntu) using the Mono platform. Matlab Simulink is used as the industrial process simulator (physical layer). Matlab Real Time Workshop is used to generate C code from the Simulink models. Communications between SC and R-PLC units are handled by a .NET binary implementation of RPC over TCP (referred to as "remoting"). Communications between the master and R-PLC units use the Modbus TCP protocol.

Extended Architecture

As mentioned above, adding human decision making to an experimentation testbed offers several advantages. However, the complexity of modeling human decision making requires an approach that does not limit the testbed to one specific model. Therefore, we propose a generic approach for integrating models in cyber-physical testbeds. In this approach, models are seen as "black boxes" that must implement a standard interface in order to interact with other system components. The required interface includes a set of inputs and a set of outputs that are connected to "action scripts" at run time. All the actions issued or received by models are sent through action scripts that include the code necessary for processing actions and communicating with other software components.

To implement the proposed approach, we extended the framework developed in our previous work with a generic human decision (HD) unit. In the remainder of this section, we describe the prototype implementation in detail and provide insight into some of the key aspects of the implementation.

The design of the HD unit started with the assumption that human operators interact with cyber-physical systems in several ways. Human operators certainly rely on information and communications hardware and software present in networked industrial control system installations (e.g., HMIs). However, they also interact independently of these components via installation-specific components (e.g., customized script for configuring a firewall) and physical actions (e.g., shutting down a server). The HD unit architecture takes all these aspects into account through the actions (glue) layer and through action scripts that implement the specifics of each experiment conducted using the testbed.

Figure 2 presents the extended architecture, which includes an HD unit and other components typical of networked industrial control systems. Within the HD unit, human operator and HMI models interact with the cyber-physical realm through an action module that enables bidirectional communications and command execution (i.e., actions). The human operator and HMI models shown in Figure 2 interact in real time using direct connections that are included in the architecture. Although the human operator and HMI models are con- structed according to the specifications of an experiment, three building blocks are included in the human operator model for completeness: (i) perception; (ii) reasoning; and (iii) decision. These basic human operator functionalities can be taken into account when building similar models. Also, depending on the requirements of an experiment, they can be replaced with other blocks if necessary.

As shown in Figure 2, human operator models receive events from the action module directly and through HMI models. The first case represents the direct interaction of human operators with the cyber-physical realm, while the second case represents interactions through the HMI. In both cases, the inputs are the data used by the models in each time step (e.g., measured voltage) while the outputs are the actions to be executed. Each action includes an identifier and several parameters (e.g., open or close a valve). These are written to the remotely accessible memory module from where they are read by the action handler module. Then, based on external XML configuration files, the action handler module runs a specific action script identified by a numeric identifier.

Action scripts are written in the C programming language and are loaded as external binary libraries. These can be specific to each experiment and may include commands that pass values to other components of the framework (e.g., physical model) or commands that launch additional scripts (e.g., configuring a firewall or turning off a machine). This way, the HD unit provides a flexible approach to translate model-specific outputs to real actions that affect the physical and cyber realms.

The remotely accessible memory module is not limited to passing values between the internal modules of the HD unit; it also serves as a way for external components to interact with the human operator and HMI models. By enabling remote access to this memory region, external software components (e.g., other HD units and SCADA master units) can communicate with the HD unit using simple memory access operations. In these cases, requests are received and processed by the communications module, which passes the received values to the remotely accessible memory module, from where they are read by the models module and provided to the human operator and HMI models. To increase flexibility, external XML configuration files are used to map memory regions to model inputs and to map model outputs to memory regions.

As in our previous work, we implemented a prototype of the HD unit in C# (Windows) and ported it to Unix-based systems using the Mono platform. Currently, communications with other HD and master units are handled by the Modbus protocol, as this protocol was specifically designed for exchanging memory-mapped data between units. However, other protocols can be implemented simply by replacing the Modbus handler units.

Human operator and HMI models were implemented in Matlab Simulink, a general simulation environment for dynamic and embedded systems. Its toolboxes (e.g., control systems and neural networks) provide powerful support for modeling and simulation. Matlab RTW was used to generate C code from the Simulink models. The generated code was then integrated into the extended framework using an XML configuration file. Thus, the model is able to interact in real time with the other system components.

Case Study

Human operators play major roles in real critical infrastructure installations and, therefore, cannot be ignored in experimentation testbeds. The HD units address this issue by bringing new elements that implement the human-inthe-loop paradigm in existing testbeds. This section presents experimental results that demonstrate the applicability of the proposed approach and the importance of human operators in a case study involving cyber attacks on a simulated power grid.

The power grid model employed in the experiment was the well-known IEEE 30-bus test system, which includes six power generators and twenty loads distributed on twenty buses. The overall model was divided into four regions, each controlled by different human operators. One of the main goals of the experiment was to show that disturbances can be balanced by countermeasures taken by power grid operators. The results also confirm the fact that, in an interconnected power grid, operators from different regions must collaborate to restore the grid to normal conditions after a disturbance.

Experimental Scenarios

Figure 3 presents a schematic diagram of the IEEE 30-bus power grid model. The grid is divided into four regions that minimize the number of connections (i.e., transmission lines) between the regions. In a real-world environment, the grid may be divided into regions based on other factors (e.g., balanced power and loads). However, our focus is not on defining regions, but on recreating a possibly realistic scenario with multiple operators, who have to cooperate in order to keep the power grid within its normal operating limits.

In our scenario, we assume that an adversary can compromise the information and communications technology infrastructure in Region 3 using social engineering and also exploit vulnerabilities in the SCADA protocols [START_REF] Bompard | Cyber vulnerability in power systems operation and control[END_REF]. Then, the same adversary employs a coordinated worm-based attack to trigger synchronized events in control devices. The attacks turn the power on to large consumers at the same time at Substations 12 and 20 (120 MW total), which causes a disturbance that drops the voltages below their operating limits of 0.95 p.u. In a real-world environment, these attacks could damage hardware and cause blackouts, and possibly have cascading effects that could spread throughout the power grid.

In our scenario, we also assume that the operators in Region 3 can request assistance from operators in other regions when they lose control of their in-frastructure. Upon receiving the request, operators in Regions 2 and 4 inject additional power into the grid with the goal of stabilizing the voltages in Region 3.

The following three cases are considered in our scenario:

Case 1: Operators in Region 3 lose control of their infrastructure and do not request assistance from operators in other regions. The voltages drop well below their normal operating limits and the operators have to react quickly in order to prevent serious damage to physical devices.

Case 2: Operators in Region 3 lose control of their infrastructure and request assistance from operators in Region 4. This case shows that a disturbance originating in Region 3 can be addressed by measures taken in other regions. The operators in Region 3 request their counterparts in Region 4 to increase energy production and the power supplied to the grid. Upon receiving the request, the operators in Region 4 start their back-up generators and increase production by 50 MVar. Although the effects are limited, this case demonstrates the importance of operator collaboration.

Case 3: Operators in Region 3 lose control of their infrastructure and request assistance from operators in Regions 4 and 2. The actions taken in Case 2 produce limited effects, so additional assistance is requested from operators in Region 2. Upon receiving the request, the operators in Region 2 increase the energy production by 90 MVar. This action stabilizes the bus voltages in Region 3.

Experimental Setup and Models

The critical infrastructure protection scenario was implemented in the Experimental Platform for Internet Contingencies (EPIC) Laboratory at the EU Joint Research Centre [START_REF] Siaterlis | On the use of Emulab testbeds for scientifically rigorous experiments[END_REF]. The Emulab testbed included nodes with the following configuration: FreeBSD OS 8, AMD 2.3 GHz Athlon Dual Core CPU and 4 GB RAM. Figure 3 shows the experimental setup. Models were developed using the "black-box" approach described in the previous sections. A Simulink model was developed for each operator with inputs and outputs connected to action scripts.

The operator model for Region 3 has one input (link status) and three outputs (action identifier and two parameters for the request for assistance). The input action script continuously tests the link between the HD unit and the physical process (SC unit). When the link is "on," the action script sends a value of "1" to the model, and "0" otherwise. The model takes this input and forwards its negated value to the output along with the action identifier. The output action script takes these two values and forwards them to the HD units running in Regions 2 and 4. In the implementation, a value of "1" means that operators in Region 3 need assistance. The implemented functions are different for each case:

Case 1: f 1 (x) = (ID, 0, 0) Case 2: f 2 (x) = (ID, !x, 0) Case 3: f 3 (x) = (ID, !x, !x)
where x is the model input and ID is the action identifier.

The operator model for Region 4 has one input (status of assistance request ("0" or "1")) and two outputs (action identifier and one parameter denoting the power injected by back-up generators (50 MVar)). The model receives its input value from the HD unit in Region 3 and produces an output that is sent to the SC unit and finally to the physical process. The mathematical function for this model is:

f (x) = (ID, (x = 1)? 50 : 0)

where x is the model input and ID is the action identifier. The operator model for Region 2 is similar to that for Region 4 in that it takes the same input but produces one additional output. The first output is the action identifier, while the second and the third outputs are the MVars produced by two back-up generators. Our scenario uses two back-up generators in Region 2 to produce a total of 90 MVar (45 MVar per generator). The mathematical function for this model is: f (x) = (ID, (x = 1)? 45 : 0, (x = 1)? 45 : 0) where x is the model input and ID is the action identifier.

Experimental Results

This section presents the results obtained for the three cases.

Case 1: Immediately after the attack is launched on Buses 12 and 20, the voltages begin to drop. The voltages of the Buses 18, 19 and 20 fall to almost 0.91 p.u., well below the operating limit of 0.95 p.u. The disturbance also propagates to Region 4, where it causes a voltage drop on Bus 8 to 0.949 p.u., slightly below the operating limit. This effect is also shown in Figures 4(a) and (b) where, without any operator intervention, the disturbance causes severe voltage changes, mostly in Region 3.

Case 2: In this case, we assume that the operators in Region 3 are able to obtain assistance from their counterparts in Region 4, where an additional back-up generator injects 50 MVar into the grid. This action has a significant effect on Bus 8, where the voltage increases above the operating limit. However, the effects are not as significant on the other buses, where the voltages remain below 0.95 p.u. (Figure 5). of additional power using a back-up generator and the operators in Region 2 start two back-up generators, which inject an additional 90 MVar of power into the grid. As shown in Figure 6, this immediately increases the voltages above the operating limits. Consequently, although the operators in Region 3 lose control of their infrastructure, they are eventually (a) Time series of affected bus voltages.

(b) Regional view. able to ensure stability in their region by cooperating with operators in neighboring regions.

The results confirm the fact that human operators are indispensable elements of security studies involving critical infrastructures. Upon comparing the results for Case 3 with those for Cases 1 and 2, it is clear that operators in a highly interconnected power grid must collaborate in order to balance regional disturbances and ensure grid stability. The results also demonstrate that the proposed approach can recreate complex scenarios involving the cyber and physical realms, as well as the decision making of human operators. The approach thus implements the important human-in-the-loop paradigm that is a significant aspect of real-world critical infrastructure environments.

Conclusions

Human operators play important roles in supervising and controlling modern critical infrastructures. Although industry may be moving towards fully automated control loops, human operators are indispensable during abnormal situations and contingencies. The principal contribution of this paper is an extended experimentation framework that provides generic human decision units that help integrate human operator and HMI models. The integration is based on a "black-box" approach where, as long as generic models implement welldefined interfaces with sets of input and output signals, the models can be integrated in the experimentation framework regardless of their content. The case study involving the IEEE 30-bus power grid model demonstrates the utility of the extended experimentation framework. The results of the case study also confirm that, in large-scale interconnected critical infrastructures involving multiple operators, it is crucial that operators cooperate to ensure the global stability of the infrastructures. Therefore, modern testbeds must provide support for modeling and analyzing the behavior of multiple human operators in complex critical infrastructure scenarios.

Our future research will explore the complexity of human operator networks and the vulnerabilities of critical infrastructures that rely on information exchange. This will help recreate and analyze complex multi-sector scenarios where one critical infrastructure could have cascading effects on other critical infrastructures.

Figure 1 .

 1 Figure 1. Experimentation framework.

Figure 2 .

 2 Figure 2. Extended architecture with a human decision unit.

Figure 3 .

 3 Figure 3. Experimental setup and test system regions.

Case 3 :

 3 In Case 3, the operators in Region 3 request the assistance of operators in Regions 4 and 2. The operators in Region 4 inject 50 MVar (a) Time series of affected bus voltages. (b) Regional view.

Figure 4 .

 4 Figure 4. Effect of the attack in Case 1.

  (a) Time series of affected bus voltages.(b) Regional view.

Figure 5 .

 5 Figure 5. Effect of the attack in Case 2.

Figure 6 .

 6 Figure 6. Effect of the attack in Case 3.


Fabio Bisogni

Simona Cavallini

Luisa Franchina

Giovanni Saja

The European Perspective of Telecommunications as a Critical Infrastructure

Keywords: Europe, critical infrastructures, telecommunications, classification

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The importance of telecommunications to all the societal sectors has led European policy makers to include it in the list of potential critical infrastructures. This view is also corroborated by research on interdependencies between critical infrastructures and the consequent cascading effects of telecommunications failures (see, e.g., [START_REF] Bisogni | Assessing the economic loss and social impact of information system breakdowns[END_REF][START_REF] Pederson | Critical Infrastructure Interdependency Modeling: A Survey of U.S. and[END_REF][START_REF] Santos | Modeling the demand reduction input-output inoperability due to terrorism of interconnected infrastructures[END_REF][START_REF] Sarriegi | Adaptation of modeling paradigms to the critical infrastructure interdependencies problem[END_REF]). Interested readers are referred to Luiijf, et al. [START_REF] Luiijf | Empirical findings on critical infrastructure dependencies in Europe[END_REF] for an analysis of the interdependencies involving the telecommunications sector and other European critical infrastructure sectors.

In June 2004, the European Council requested that a comprehensive strategy be created for protecting critical infrastructures. In October 2004, the European Commission adopted a communication on critical infrastructure protection as part of the fight against terrorism [START_REF]European Commission, Critical Infrastructure Protection in the Fight Against Terrorism[END_REF]; this communication included several proposals for enhancing prevention, preparedness and response at the European level in the event of terrorist attacks on critical infrastructure assets. In December 2004, the Council, in its conclusions on prevention, preparedness and response to terrorist attacks, approved the European Commission's proposal to establish a European Programme for Critical Infrastructure Protection (EPCIP) that would spearhead various initiatives aimed at enhancing critical infrastructure protection.

The next year, in November 2005, the European Commission adopted a "green paper" [START_REF]European Commission, Green Paper on a European Programme for Critical Infrastructure Protection[END_REF] that outlined strategic alternatives with regard to critical infrastructure protection. The process culminated with a 2008 European Council directive that emphasized the identification and designation of European critical infrastructures and an assessment of the need to improve their protection [START_REF]On the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve Their Protection[END_REF].

Recognizing the existence of several infrastructures whose disruption or destruction could have a significant impact on member states, the European Council directive focused on clarifying the key elements related to critical infrastructure protection. In particular, the directive defined the following key concepts:

Critical Infrastructure: Assets, systems or parts thereof located in European Union member states, which are essential for the maintenance of vital social functions, security, safety, health and economic/social welfare of the population, and whose destruction or malfunction would have a significant impact in a member state (loss of service).

European Critical Infrastructure: Critical infrastructures located in European Union member states whose destruction or malfunction would have a significant impact in at least two European Union member states. The significance of the impact is to be assessed in terms of cross-cutting criteria, including the effects of cross-sector dependencies on other infrastructures.

The directive also defined a common approach for identifying European critical infrastructures and protecting them. Since the various sectors have accumulated extensive expertise and experience with regard to asset protection, the directive was designed to be implemented on a sector basis. At this time, two areas -energy and transportation and their related sub-sectors -are identified by the directive as domains in which the procedures for identifying European critical infrastructures must be applied.

The implementation of the directive has imposed a number of requirements on member states that impact the activities and organization of owners and operators of the identified European critical infrastructure assets. In particular, the identification of a European critical infrastructure on the part of a member state leads to a procedure with two requirements for asset owners and operators: Implementation of Operator Security Plans: The directive provides an indication of the minimum components that must be addressed in a plan. In particular, a plan should identify the critical infrastructure assets and the security solutions that are in place and those that are being implemented. Also, the procedures should cover, at the very least: the identification of critical assets; a risk analysis that includes threats, vulnerabilities and potential impacts; the identification, selection and prioritization of countermeasures, categorized as those that are permanent and those that are enforceable gradually.

Appointment of Liaison Officers:

The directive requires liaison officers to act as a points of contact between the critical infrastructures and the national bodies responsible for their protection.

The 2008 directive also recognized the future need to expand the list of critical infrastructures. Indeed, it gave priority to the information and communications technology sector during the first review, which started in January 2012.

Following the 2008 directive and its goal of increasing the scope of the European critical infrastructure sectors, the European Commission issued a 2009 communication to protect Europe from large-scale cyber attacks and disruptions, and enhance preparedness, security and resilience [START_REF]European Commission, Protecting Europe from Large-Scale Cyber Attacks and Disruptions: Enhancing Preparedness, Security and Resilience, Commission Communication COM[END_REF]. This communication articulated European policy on strengthening security and trust in the information society. Focusing attention on prevention, preparedness and awareness, it specified immediate actions to strengthen the security and resilience of critical information and communication infrastructures, including all aspects of telecommunications services. Subsequent European Union debate spurred efforts to examine the challenges and priorities for network and information security policy and to set up the most appropriate instruments needed at the European level to ensure the security and resilience of critical information nfrastructures.

The 2009 communication on critical information infrastructures came at the end of a process extending back to 2005 that focused on the increasing role of the telecommunications sector in Europe. A 2005 Commission communication [START_REF]European Commission, A European Information Society for Growth and Employment[END_REF] highlighted the urgent need to coordinate efforts to build the trust and confidence of stakeholders in electronic communications and electronic services. To this end, a strategy for a more secure information society was adopted in 2006 [START_REF]European Commission, A Strategy for a Secure Information Society -Dialogue, Partnership and Empowerment[END_REF]. This 2006 communication was produced to revitalize the European Commission strategy set out in 2001. The main intent was to develop a dynamic, global strategy in Europe, based on a culture of security and founded on three pillars: dialogue, partnership and empowerment. As part of the partnership framework, the 2006 communication asked the European Network and Information Security Agency (ENISA) to develop a trusted partnership with member states and stakeholders to develop an appropriate data collection framework, including procedures and mechanisms to collect and analyze European-Unionwide data on security incidents and consumer confidence. Member states, the private sector and the research community are required to establish strategic partnerships to ensure the availability of data on the information and communications technology security industry and on market trends for products and services in the European Union (EU). Moreover, to improve the ability to respond to network security threats, the European Commission asked ENISA to examine the feasibility of a European information sharing and alert system to articulate effective responses to current and emerging threats.

The 2006 communication sought to achieve the infrastructure identification and protection objectives by adopting a multi-stakeholder approach and promoting effective public policy and private sector initiatives. According to this goal, in order to identify the key assets in the telecommunications sector and to adequately protect them, the relevance of the perspectives adopted by European and national policy makers should match the organizational approach of telecommunications operators in meeting their security and resilience requirements. Indeed, what is needed is a common framework in terms of approaches and goals that would support efficient and effective security and resilience strategies.

European Telecommunications Sector

The first step in developing a common framework for policy makers and asset owners and operators is to define the components of the telecommunications sector regardless of the geographic areas in which they are located. At present, statistics on the evolution of telecommunications markets are becoming wide and consistent, thanks to the efforts of several governmental and non-governmental organizations.

The availability of public data related to the larger information and communications technology sector is relatively broad. The primary reliable sources for the European context are Eurostat, Organization for Economic Cooperation and Development (OECD) and International Telecommunications Union (ITU). These entities conduct electronic and postal surveys as well as interviews at the national and international levels in order to obtain high-quality statistical data. The resulting data can be used to define indicators that are comparable across countries. However, limited data is available about telecommunications applications and usage.

Using the traditional classification of telecommunications applications in terms of fixed telephony, mobile telephony and Internet, the first point of reference is Eurostat, which, through the national statistical institutes, provides an annual dataset on the twenty-seven EU member states (EU-27). Information and communications technology market features are clarified through statistics that link telecommunications and various economic indicators of the member states.

A valuable Eurostat data asset is the elaboration of several aggregate indicators such as "Internet activities of enterprises." However, as far as telephony is concerned, data is provided in terms of the volume of different types of calls along with indicators related to operators and service providers. Eurostat data sources are also useful for analyzing information and communications technology use by citizens. Indeed, various statistics are available about the expanding role of information and communications technology in daily activities, especially related to "households" and "individuals." Several indicators pertaining to network access also give a good sense of the importance of telecommunications services.

OECD databases and statistics are also valuable sources of information about the telecommunications sector. The available data includes communication channel access (fixed, mobile and Internet), employees, revenue, capital and investment. The main limitations of OECD data related to the European telecommunications sector are that they cover only part of the EU-27 and that most OECD statistics are published in books instead of being disseminated free of charge on the Internet. Nevertheless, the OECD Directorate for Science Technology and Industry frequently publishes some information and communications technology indicators from its various databases. These indicators cover trade, firms, use and growth related to information and communications technologies.

ITU, the U.N. telecommunications agency, maintains a highly reliable and often quoted database that contains data provided directly by governments via ITU's annual questionnaires. Data related to the telecommunications sector, which is available on a payment basis, cover more than 200 countries, including all the EU-27 countries from 1960 onwards. The data related to fixed and mobile telephony includes coverage, diffusion, traffic, prices, revenues and investments. The same data is also available for the entire telecommunications sector with the addition of some data about faults. In the case of the Internet, the available data primarily focuses on the numbers of users and subscribers.

Another reliable, but limited, data source is the annual report prepared by the European Telecommunications Network Operators Association (ETNO). The report provides data about the European telecommunications market for fixed telephony, mobile telephony and Internet, focusing mainly on operator revenue trends and ETNO member investments.

Infrastructure Approach

At the European level, telecommunications is considered to be a complex critical infrastructure sector. Also, national approaches and related regulations hinder a common approach -in the member states, the criteria for identifying critical infrastructures are defined by various ad hoc public institutions and government entities.

Most European member states use the following approaches when defining and identifying critical infrastructures:

Service-Oriented Approach: This approach focuses on the services and/or functions that are vital to society. Infrastructures that provide these services and/or functions are considered to be critical infrastructures.

Asset-Oriented Approach: This approach focuses on the impact and/ or risk. Infrastructures whose disruption may result in major impact in terms of casualties, economic and public effects are considered to be critical infrastructures.

Operator-Oriented Approach: This approach focuses on infrastructure operators because of their decision-making roles in providing vital services. Operators are considered critical on the basis of legislative obligations and spontaneous interactions because they help ensure the protection of assets and the resilience of services.

A 2011 study by IABG, Booz and Alcatel-Lucent [START_REF] Iabg | Study to Support the Process to Define Sectoral Criteria to Identify European Critical Infrastructures in the ICT Sector, with Particular Focus on the Sub-Sectors of Internet, Fixed and Mobile Telecommunications[END_REF] investigated the sectoral criteria for identifying European critical infrastructures. The study involved sixteen European countries and incorporated contributions by 68 organizations, mainly national entities with information and communications technology responsibilities and telecommunications operators. According to the study, most of the member states are considering the information and communications sector as outlined in Directive 2008/114/EC [START_REF]On the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve Their Protection[END_REF]. About two-thirds of the member states adopt the service-oriented approach (or its variations) in designating critical infrastructures, while just a few countries engage the assetoriented approach or the operator-oriented approach. In some limited cases, critical infrastructures are identified based on common aspects of all three approaches.

Proposed Classification Method

The aforementioned 2009 European Commission communication [START_REF]European Commission, Protecting Europe from Large-Scale Cyber Attacks and Disruptions: Enhancing Preparedness, Security and Resilience, Commission Communication COM[END_REF] encourages member states to continue to develop, in cooperation with all relevant stakeholders, criteria for identifying critical infrastructure assets in the information and communications technology sector. According to many experts, the main obstacle to applying the criteria promoted by the European critical infrastructure directive [START_REF]On the Identification and Designation of European Critical Infrastructures and the Assessment of the Need to Improve Their Protection[END_REF] is the nature of the information and communications technology sector and the telecommunications component. Information and communications technology has a strategic role because it pervades all societal activities, but its horizontal nature prevents precise boundaries from being defined for the sector.

For this reason and others, a classification method for identifying the criticality of the telecommunications infrastructure should rely on a multi-faceted framework that is shared among the main stakeholders of the sector. Because of the quality of service and the security and resilience provisions, two dimensions must be considered: (i) telecommunications applications; and (ii) the adopted infrastructure approach.

The first dimension of the proposed classification method is telecommunications applications. The traditional classification of telecommunications applications as fixed telephony, mobile telephony and Internet is gradually losing its significance as a result of service convergence and communication channel integration. Although the main statistics in the telecommunications sector are collected using the traditional classification, the evolution of technologies as connected software, hardware and middleware suggests that a content-oriented taxonomy would be more appropriate. Therefore, our proposed method classifies telecommunications applications in terms of voice communications, data communications and data management systems (i.e., data processing, hosting and related activities).

The second dimension of the proposed classification method is the adopted infrastructure approach, which may be service-oriented, asset-oriented or operator-oriented. According to this dimension, the provided services (e.g., fixed telephony), essential assets (e.g., public switched telephone network facilities) and operators (e.g., Telecom Italia) are all infrastructure objects with security and resilience provisions.

The classification matrix presented in Figure 1 allows the various telecommunications sector stakeholders to define relative criticality levels (low-level, medium level and high-level) based on the appropriate thresholds. The matrix can be used to compare the frames of reference used by policy makers (e.g., national authorities) and owners and operators of potential critical information infrastructure assets (e.g., telecommunications operators) when defining policies and strategies for security and resilience.

Italian Case Study

This section presents a case study where the classification methodology described in the previous section is applied to the Italian telecommunications sector.

Italian Telecommunications Sector

According to the implementation of Article 53 of the Italian Legislative Decree on the Electronic Communication Code (CCE) of August 1, 2003, all users within the national boundaries, regardless of their geographical locations, should be able to access "universal communication services" at a pre-defined quality level. In addition, telecommunications companies must provide these universal communication services to all users at an affordable price.

At present, Telecom Italia is Italy's only unique provider of universal communications services. According to Article 54 of CCE, Telecom Italia must provide fixed telephony services in addition to free emergency services. With regard to security and resilience, specific quality targets for fixed telephony services related to the line disruption rate and recovery time were initially regulated by Article 61, but have been updated in recent years. These indications match the findings of the 2011 study by IABG, Booz and Alcatel-Lucent [START_REF] Iabg | Study to Support the Process to Define Sectoral Criteria to Identify European Critical Infrastructures in the ICT Sector, with Particular Focus on the Sub-Sectors of Internet, Fixed and Mobile Telecommunications[END_REF], which noted that Italy tends to uses the service-oriented approach for identifying critical information infrastructures. Telecom Italia's position as the leading Italian telecommunications provider has historical roots. Telecom Italia was established in 1994 as result of the merger of STET and SIP, which was the only Italian telecommunications company since 1964. It was not until 1997 that the Italian telecommunications market was opened to other national and international operators in the fixed telephony, mobile telephony and Internet sub-sectors. In 2010, at least six operators provided both fixed and mobile telephony to the Italian market. However, according to the latest (2010) data in Table 1, Telecom Italia is the largest in terms of expenses for fixed and mobile telephony (48.9%). The other main players are Vodafone Italia (21.4%) and Wind (13.6%).

Using a sub-sector classification similar to the traditional classification, the market shares of fixed telephony connections and bandwidth connections also show the dominance of Telecom Italia (Table 2). However, Vodafone Italia is the principal provider of mobile telephony services. 1 December 2010 data. 2 Operator does not provide the service or its market share is included in Others. 3 Includes mobile virtual network operators for mobile telephony.

Telecom Italia

Telecom Italia is the largest Italian provider of fixed telephony services. It is a major international with 57,853 employees in Italy and a total of 84,335 people worldwide (according to the 2011 corporate report). In 2010, the company had industrial investments of 4,583 million euros, turnover of 27,571 million euros and earnings before interest, taxes, depreciation and amortization (EBITDA) of 11,412 million euros.

The domestic (Italian) infrastructure of Telecom Italia includes 31.3 million mobile telephony lines (Telecom Italia Mobile), 9.1 million broadband connections (1.9 million of them wholesale costumers) and 15 million retail fixed line connections (7.2 million of them broadband connections).

The international operations of Telecom Italia are primarily focused on South America: 55.5 million mobile lines in Brazil (25.5% share); 17.4 million mobile lines, 4.1 million fixed lines and 1.5 million broadband connections in Argentina; and 2 million mobile lines in Paraguay.

With regard to Telecom Italia, the definition of infrastructure criticality is essential in order to apply the mandated security and resilience measures. As the main Italian company, Telecom Italia is regarded by the Italian Government as the owner and operator of a potential critical infrastructure, and the operator-oriented approach is applicable because of Telecom Italia's role as the sole provider of universal communications services.

However, in order to guarantee the protection of the telecommunications infrastructure, a strong asset-oriented perspective is adopted internally by Telecom Italia. Assets are defined as those that are physical and substantial. The criticality of the assets is determined by a three-step process: defining the asset boundaries, assessing the quality of the provided services and guaranteeing the level of user satisfaction. Taking into account these three connected aspects, the criticality depends on the weakest link in the chain. Thus, a critical infrastructure can be considered to be an asset that makes a service available, and the absence of the service produces significant disruptions for end users. For this reason, the criticality lies in "transporting" the service to end users.

For security and resilience purposes, identifying assets and the related processes of service production and delivery are crucial. The optimal solution is a homothetic organization. Each structure in such an organization has its own responsibilities, updates the risk map, sets up operator security plans, defines recovery and continuity plans, and guarantees the compliance of the implemented activities in order to avoid functional overlap.

The Telecom Italia approach involves defining the asset boundaries and assessing the criticality of the assets. Producing an exhaustive and unambiguous list of assets supports the identification of the key elements that are required to deliver services (business processes, technological functions, human resources, facilities, etc.). The vulnerabilities and related risks are evaluated for each asset by applying heuristic techniques (e.g., a quasi-logarithmic scale) because the probabilities of occurrence of rare and high-impact critical events are usually not available. This technique, which is based on a non-linear scale, ensures more precise evaluations because it highlights the exceptional occurrence of minimum and maximum values.

The computation of the expected impact as a score for each location in terms of vulnerability multiplied by risk allows a ranking of the criticality of the locations themselves. A logarithmic ranking of locations and their assets is then created according to different levels of criticality. The logarithmic ranking assists in separating critical assets from less strategic assets. Having a smaller number of critical assets also helps focus protection efforts.

Based on this approach, Figure 2 shows the criticality matrix classification results for Telecom Italia. From the service perspective, voice communications, which is related to fixed telephony and has special regulatory attention, is not ranked as the application with the highest criticality. However, from the assetoriented perspective, data management systems has the highest criticality.

The proposed classification method has two main benefits. The first benefit is the opportunity to increase stakeholder awareness about the criticality of the telecommunications infrastructure according to different perspectives while also enabling the comparison of infrastructure criticality. In fact, during the course of the case study, Telecom Italia had to reason about its perspective with regard to managing criticalities and about the perspectives adopted by other stakeholders, including policy makers and competitors.

The second benefit is policy making support. The criticality matrix summarizes certain structural features of the telecommunications framework such as the influence of legal provisions (e.g., regarding the universal communications services provided by Telecom Italia) and the direct liability of the telecommunications infrastructure (e.g., ownership of the physical infrastructure, especially fixed telephony). Thus, the criticality matrix method provides a homogeneous classification. In particular, it enables the various stakeholders to assess the criticality of telecommunications applications according to the specific infrastructure perspectives they adopt. Note, however, that in order to enhance the utility of the classification method, it is recommended to collect and use data based on the three types of telecommunications applications shown in Figure 2.

Conclusions

The growing societal reliance on the telecommunications sector has made it imperative to ensure that the critical information and communications infrastructure is secure and resilient. While there is broad agreement on the need to protect critical infrastructures, different perspectives and approaches are applied at the European level to identify -and ultimately protect -infrastructure assets. This heterogeneity has driven the effort to develop the criticality matrix classification method. The method offers a common, shared framework for policy makers and asset owners and operators to identify key infrastructure assets and to assess their criticality, helping formulate effective and efficient security and resilience strategies. The Telecom Italia case study demonstrates the different perspectives and decision processes that can be applied to identify infrastructure assets and assess their criticality; and how the criticality matrix method can be used to provide a highly homogeneous classification that also facilitates the comparison of results obtained using different infrastructure perspectives.

Table 1 .

 1 Total expenses per operator in Italy in 2009 and 2010[START_REF]Italian Authority for the Protection of Communications (AGCOM), Relazione Annuale 2011 sull'Attivita svolta e sui Programmi di Lavoro[END_REF].

	Operator	2009	2010
	Telecom Italia	51.6%	48.9%
	Vodafone Italia	20.6%	21.4%
	Wind	12.5%	13.6%
	Fastweb	4.6%	4.9%
	H3G	3.7%	4.2%
	BT Italia	2.8%	2.7%
	Others	4.3%	4.4%
	Total	100.0% 100.0%

Table 2 .

 2 Market shares of Italian telecom operators in 2010[START_REF]Italian Authority for the Protection of Communications (AGCOM), Relazione Annuale 2011 sull'Attivita svolta e sui Programmi di Lavoro[END_REF].

	Operator	Fixed	Bandwidth	Mobile
		Connections 1 Connections 1	Voice and Data
	Telecom Italia	71.6%	53.9%	35.7%
	Vodafone Italia	7.4%	12.0%	36.8%
	Wind	10.6%	14.8%	18.4%
	Fastweb	7.5%	12.9%	NA 2
	H3G	NA 2	NA 2	7.2%
	BT Italia	0.4%	0.9%	NA 2
	Tiscali	1.9%	4.1%	NA 2
	Others 3	1.4%	13.6%	1.9%
	Total	100.0%	100.0%	100.0%


Ian Ellefsen

Sebastiaan Von Solms

IMPLEMENTING CRITICAL INFORMATION INFRASTRUCTURE PROTECTION STRUCTURES IN DEVELOPING COUNTRIES

Keywords:

The development of a national critical information infrastructure protection (CIIP) structure is essential to safeguard critical systems from cyber attacks and other threats. As developing nations leverage Internet technologies, it is imperative that they develop their own national CIIP structures to ensure reliable operations, incident response and resilience in the face of attacks. This paper presents a framework designed to enable developing countries to define a set of clear deliverables that can be used to realize a national CIIP structure.

Introduction

Technologically advanced countries have implemented a variety of critical information infrastructure protection (CIIP) structures to safeguard their national information infrastructures and critical systems from cyber attacks and other threats. Historically, developing nations have had poor access to Internetbased technologies [START_REF]State of the Internet[END_REF], which has limited their need to develop effective CIIP structures such as computer security incident response teams (CSIRTs) [START_REF] Heacock | Internet filtering in Sub-Saharan Africa[END_REF].

However, this situation is changing. Many developing nations are experiencing massive growth in Internet capacity and the use of Internet-based technologies. Attacks on the information infrastructure can severely affect the ability of a country to function effectively [START_REF]President's Information Technology Advisory Committee, Cyber Security: A Crisis of Prioritization, Report to the President[END_REF]. If commercial entities were to lose Internet services for a prolonged period, the economic effects would be significant. The impact of large-scale cyber attacks on national critical systems would be much more devastating. It is clear that developing countries are finding them-selves in the situation where they have to implement national CIIP structures to safeguard their information infrastructure assets [START_REF]State of the Internet[END_REF].

This paper presents a framework that is intended to be used by developing countries to implement CIIP structures. To this end, the paper investigates the role of traditional CIIP mechanisms such as CSIRTs and related protection structures. The generic framework outlines a set of deliverables that allow for the establishment of a national CIIP structure.

Background

Developing countries are making massive investments in Internet and communications technologies. Many large-scale infrastructure assets used for electricity distribution, water supply, and banking and finance are utilizing these technologies to improve their ability to deliver services. The resulting information infrastructure is transforming the manner in which governments interact with citizens, companies transact business, and individuals access vital information and services.

Despite their reliance on the information infrastructure, developing countries rarely implement a nationally-coordinated protection structure to protect their vital information assets [START_REF] Ellefsen | Critical information infrastructure protection in the developing world[END_REF]. Cyber attacks, such as distributed denial of service (DDoS) attacks, can severely affect all the infrastructure sectors [START_REF] Baker | Crossfire: Critical Infrastructure in the Age of Cyber War[END_REF]. Cyber attacks differ greatly from traditional types of attacks. Historically, the ability to wage war has been the domain of governments. However, cyber attacks can potentially be initiated by any person with relatively little expenditure and without the need for a high degree of technical proficiency [START_REF] Lipson | Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues[END_REF], and these attacks can have a direct effect on all sections of society.

In the United States, 85% of all critical systems are owned and operated by private entities [START_REF]Cybersecurity for Critical Infrastructure Protection[END_REF]. The situation is quite different in most developing countries, where the majority of infrastructure assets are in the public sector. But regardless of the extent of government ownership, there should be a transition from centralized information infrastructure protection structures to public structures that safeguard commercial and individual interests. This is not to suggest that there is no place for governmental structures, only that they should operate in tandem with public protection structures.

Protection Structures

There are a number of protection structures that can form the basis of a national CIIP structure. The structures, which are intended to provide a coordinated platform for dealing with cyber incidents, are geared towards the specific environments in which they are deployed. However, despite their differences, protection structures take one of two forms, a top-down structure or bottom-up structure. We discuss a computer security incident response team (CSIRT) as an example of a top-down structure, and a community-oriented security, warning and advice (C-SAW) team as an example of a bottom-up structure. Computer Security Incident Response Team. A CSIRT is a national entity that coordinates proactive and reactive efforts focused on managing cyber security incidents [START_REF]European Network and Information Security Agency, Baseline Capabilities for National/Governmental CERTs[END_REF]. Figure 1 presents the different components of a CSIRT structure, which provide incident handling support to various constituencies.

The CSIRT itself follows a top-down model, where coordination is provided at the national level, with a number of regional CSIRTs that provide support to smaller constituencies [START_REF] Killcrece | Steps for Creating National CSIRTs[END_REF]. Each CSIRT is structured to suit the environment in which it is deployed [START_REF] West-Brown | Handbook for Computer Security Response Teams (CSIRTs)[END_REF].

The primary service provided by a CSIRT is incident response. Incident response covers a number of services that seek to identify, manage and mitigate cyber security threats [START_REF] Brownlee | RFC2350: Expectations for Computer Security Incident Response[END_REF][START_REF] West-Brown | Handbook for Computer Security Response Teams (CSIRTs)[END_REF].

A CSIRT is national in its scope and, as such, maintains relationships with international peers, governments and large organizations. However, the needs of individuals and small organizations cannot be overlooked in a national CIIP structure. The needs of these segments of the population are addressed by computer security, advisory and warning (C-SAW) teams.

Community-Oriented Security, Advisory and Warning Teams.

Small businesses and individual households make up a large percentage of computer users. Often these users have to fend for themselves when dealing with cyber security threats and incidents.

A community-oriented structure is required to enable these smaller stakeholders to receive cyber security support. This structure is a "bottom-up" model, where security support is provided in a loosely-coupled manner from within a community.

Community-oriented security, advisory and warning (C-SAW) teams are an example of a community-oriented model that could be deployed within a national CIIP structure. These teams provide CSIRT-like services to a smaller, less informed community of members [START_REF] Ellefsen | Critical information infrastructure protection through simplification[END_REF][START_REF] Ellefsen | The community-oriented computer security, advisory and warning team[END_REF].

A C-SAW team can also serve as an intermediary between a larger national CIIP structure and the smaller stakeholders, with a direct focus on providing cyber security support to its community. A C-SAW team should be community driven and operated by members of the community it services [START_REF] Ellefsen | The community-oriented computer security, advisory and warning team[END_REF]. The services provided by a team, which typically involve vulnerability tracking and incident response, are largely dictated by the needs of its community.

C-SAW teams should operate independently of the larger national CIIP structure. Nevertheless, a C-SAW team should maintain good communication channels with other teams as well as the national CIIP structure.

C-SAW teams are important to national CIIP efforts because small businesses and individuals may not have the technical expertise available to manage CIIP threats and incidents. These smaller stakeholders should not be ignored because incidents that affect large numbers of these users can severely affect critical infrastructure operations [START_REF] Ellefsen | Critical information infrastructure protection through simplification[END_REF]. Other community-based structures serve a similar role as a C-SAW team. The common aspect is that they are community-driven and focus on providing support to their communities.

Overall Structure. The CSIRT and C-SAW teams should operate together to provide the front-end for a national CIIP structure. The design and operation of these teams are vital to ensure that CIIP efforts pervade all sections of society. However, the mere deployment of protection structures is not sufficient to establish a successful national CIIP structure. Indeed, a national CIIP structure typically goes through a number of developmental stages before it can provide adequate protection for a nation's information infrastructure.

CIIP Framework for Developing Nations

The International Telecommunications Union (ITU) has produced a number of documents related to the development of CIIP structures in developing countries. One of the key documents is the ITU Cybersecurity Work Programme to Assist Developing Countries 2007-2009 [START_REF]ITU Cybersecurity Work Programme to Assist Developing Countries 2007-2009[END_REF], which highlights the need to establish effective CIIP structures in developing nations because of the potential impact that they have on the global economy. This section builds on the ITU effort by describing a framework for developing effective national CIIP structures in developing countries.

Cyber security structures in developed nations have their roots in the early years of the Internet, when the U.S. Defense Advanced Research Projects Agency (DARPA) funded the development of the initial Computer Emergency Response Team (CERT) in response to the Morris worm [START_REF] Killcrece | Steps for Creating National CSIRTs[END_REF]. These structures have evolved with the Internet to meet new and expanding requirements.

Developing nations, on the other hand, have historically had limited Internet access and poor provisioning of information and telecommunications infrastructures. However, the introduction of a number of high capacity fiber optic cables -especially in Sub-Saharan Africa [START_REF] Song | African undersea cables, Many possibilities[END_REF] -has created a situation where the establishment of effective CIIP structures is a necessity. When designing and implementing these CIIP structures, developing nations have the advantage of being able to leverage the lessons learned from the efforts undertaken by developed countries.

Developing countries have unique challenges that should be addressed by CIIP structures. In particular, Harris [START_REF] Harris | CIOs drive expansion into Africa[END_REF] has identified the following key challenges:

Rapid development of information infrastructures.

High-levels of cyber security illiteracy.

Significant use of mobile technologies.

High demand to adopt and provision web services.

Inadequate legislation addressing cyber security.

Inadequate policy documentation addressing cyber security.

All these challenges must be addressed in a national cyber security policy. Of course, the scope with which the challenges are addressed would depend on the conditions and needs of the country in question.

It is also important that the CIIP structure provides support to all sections of society. Furthermore, it is necessary to consider the needs of the private sector that may own and operate a significant portion of the critical infrastructure, as well as small businesses and individuals that make up a large segment of computer users within a developing country [START_REF]European Network and Information Security Agency, EISAS -European Information Sharing and Alert System for Citizens and SMEs, Heraklion[END_REF].

Two-Factor Development

A national CIIP structure must provide cyber security support to two primary societal groups. The first group is served by a traditional CSIRT structure, and the second by community-based structures. Each group exhibits different cyber security needs, and the overall CIIP structure should be able to address these needs. Ideally, the development of a national CIIP structure should follow a "two-factor development" strategy, where protection for each societal group is developed in parallel, with the holistic structure developing over time.

Figure 2 shows the society groups and the CIIP structures that are responsible for providing cyber security support and managing incidents. We now discuss the roles of the CSIRT and C-SAW teams.

Government

Military Departments

H o l i s t i c C o n s t r u c t i o n

Large Academic Institutions

Large Industry CSIRT Role. The CSIRT is the lead entity in a national CIIP structure implemented according to the top-down model. The CSIRT coordinates the national cyber security policy, develops cyber security strategies and provides oversight and management for security related incidents in diverse operating environments. Figure 2 lists the specific organizations that fall under the direct management of a CSIRT structure. The organizations are:

Public Private

Universities and Research Institutions

Government Entities: Governmental departments, military entities, and other government-sponsored utilities.

Large Industry Entities: Financial institutions, telecommunication, manufacturing, electrical power, water distribution, sewage treatment and other large industries that provide services at a national level.

Large Academic Entities: Large tertiary academic institutions and national research institutions.

The management of these organizations is delegated to a CSIRT because the organizations have large numbers of users and substantial computing resources. Also, the organizations may control critical infrastructure assets and may require considerable computing resources and network bandwidth. An additional benefit of assigning these entities to an emerging CSIRT structure is that they often have internal security structures and policies in place, which can be utilized to aid in the development of the CSIRT.

C-SAW Team Role. C-SAW teams are responsible for managing and coordinating cyber security efforts for smaller entities. These entities include:

Small Academic Entities: Primary and secondary academic institutions.

Small Industry Entities: Small and medium-sized businesses.

Individuals: Private citizens. These entities may be smaller than those managed by a CSIRT and they are often overlooked [START_REF] Harrison | An update on WARPs[END_REF], but they are, nevertheless, vital to a national infrastructure. Early CIIP structures primarily focused on large industry entities. However, due to the abundance of individual users and small businesses and their potential to serve as breeding grounds for malware, these entities can have a serious impact on critical national systems.

Following the bottom-up paradigm, the services provided by a C-SAW team are driven by community needs. C-SAW teams play a vital role in educating their communities and helping secure their assets [START_REF] Ellefsen | Critical information infrastructure protection through simplification[END_REF]. The teams also provide a bridge between their communities and the national CIIP structure.

CIIP Framework Development

The development of a national CIIP framework occurs in an incremental manner. The parallel development of top-down and bottom-up structures over the evolution of the national framework results in a holistic CIIP structure.

Stages of Development

A national CIIP structure progresses through several phases of development before it can be fully operational. Previous work related to the development of national CIIP structures (see, e.g., [START_REF] Killcrece | Steps for Creating National CSIRTs[END_REF][START_REF] West-Brown | Handbook for Computer Security Response Teams (CSIRTs)[END_REF]) does not translate well into the context of developing nations. This is largely due to the constraints imposed by the environment in developing countries. Therefore, it is necessary to conduct a rigorous assessment of the environment in which the CIIP structure will be deployed.

The following three phases of CIIP structure development are geared towards developing nations: Initial Development: Environmental assessments are conducted, legislation is evaluated, technological aspects are assessed and basic structures are put in place. This phase sets the groundwork for the later stages of development.

Intermediate Development: CIIP structures are developed to support growing needs. Community-based structures are expanded and public awareness schemes are initiated.

Mature Development: CIIP structures are fully able to handle cyber security incidents.

Initial Development

The initial development phase is primarily concerned with laying the groundwork for the national CIIP structure. Many assessments are conducted during this phase, with the goal of deploying a functional CSIRT. The assessments are aimed at understanding the environment that must be protected, and identifying the strengths and weaknesses of existing systems.

Environmental Assessment. The goal of this assessment is to understanding the key components of the environment. Areas addressed in the environmental assessment include:

Critical Systems: Identification of the set of nationally critical systems. The set of systems could be derived from assessments conducted in developed countries. These systems would eventually fall under the jurisdiction of the CSIRT.

Stakeholders: Identification of the stakeholders in the CIIP structure. These are role players who have a vested interest in the stability of national systems. The stakeholders include government departments, large companies and international partners. The degree of interest of each stakeholder must also be gauged.

Legislation: Identification of existing legislation related to cyber security and projected changes to the legislation.

Expertise: Identification of the expertise required to develop the CIIP structure. This helps provide recommendations on whether a country has the local capacity to develop an effective national cyber security structure.

The role of the environmental assessment is to understand the environment where the CIIP structure will be deployed. The assessment is not limited to the components listed above. Indeed, due to the unique nature of each deployment environment, a number of other factors may have to be considered during the assessment.

Legislative Assessment. The legislative assessment is concerned with identifying the legal environment in which the CIIP structure is to be deployed.

As is often the case in developing countries, the legal system may not make provisions for current and future developments in technology. Despite the fact that legal frameworks are complex and diverse, the legislative assessment can be broken down into two basic components:

Current Legislation: Evaluation of the current set of legislation that addresses cyber security, national cyber security policy, physical information infrastructure and compliance with international best practices.

Possible Amendments: Identification of the areas of legislation that may have to be amended to allow for the effective deployment of a national CIIP structure. This component should consider the assignment of legal powers to the various entities in a CIIP structure to enable them to operate effectively.

Once again, these are not the only tasks that to be performed. Further analysis should be conducted during this phase to identify other legal issues.

Technology and Vulnerability Assessment. A technology and vulnerability assessment is conducted in order to gain an understanding of the operating environment. This assessment should identify technological components and their vulnerabilities that could potentially impact the national CIIP structure. The assessment should cover the following aspects:

Current and Future Bandwidth: Investigations of the amount of available bandwidth, and well as future projections.

New Technologies: Investigations of new technologies that could impact information infrastructure security. This would also include investigations of mobile technologies.

Current Systems: Investigations of the current state of computer-based systems and their impact on overall cyber security. The analysis should also cover legacy systems.

In addition to helping understand the current operating environment, the technology and vulnerability assessment enables the national CIIP structure to accommodate longer-term projections.

International Peer and Partner Assessment. The role of international partnerships in CIIP cannot be overlooked. Partnerships with international CIIP structures can provide valuable assistance in creating effective local structures in developing countries. The partnerships are also important during the later phases of development. Due to the international nature of the Internet, these partnerships cannot be ignored. Incident information must be shared freely between international peers to identify and mitigate the effects of security incidents.

Local entities are a valuable resource during the initial phase of CIIP structure development. These entities include multinational companies and large local companies that already have cyber security structures in place.

A key component is fostering trust between international and local partners. Active participation in international organizations such as the Forum of Incident Response and Security Teams (FIRST) can help build trust.

Small-Scale Deployment. After the deployment environment has been assessed, a small-scale deployment of a CIIP structure (CSIRT or C-SAW team) should be attempted to identify any oversights in the initial assessments. The trial deployment lays the groundwork for future development of the CIIP structure and provides valuable insight into the operational environment. The deployment need not focus on incident response; it is beneficial to also concentrate on developing local and international relationships, which are vital during the later phases of CIIP structure development.

Intermediate Development

After the operational environment has been assessed, the development of the national CIIP structure transitions into the intermediate phase. The intermediate phase focuses on the development of the national protection structures, especially the CSIRT and C-SAW teams.

CSIRT Development. The development of the CSIRT is crucial during the intermediate phase. The lessons learned during the initial phase and the small-scale deployment are applied when creating the CSIRT. The principal goals are to strengthen local and international relationships, and define the roles and responsibilities of the CSIRT. The CSIRT should also initiate its operations, and begin to monitor and respond to cyber incidents.

C-SAW Team Deployment. After the CSIRT structure is operational and has the ability to respond to incidents (even in a limited capacity), the C-SAW teams can be integrated into the national structure. This enables small businesses and individuals to gain the benefits of the national CIIP structure.

The C-SAW teams should work with the CSIRT to raise awareness and educate users about threats, vulnerabilities and mitigation strategies. The C-SAW teams should actively grow their constituencies and work within their communities to drive cyber security programs at the grassroots level.

Mature Development

During this stage of development, the national CIIP structure is fully operational. The CSIRT and C-SAW teams can communicate effectively with their stakeholders and manage incidents. Also, relationships with international peers and industry partners are well established. The mature phase does not signify the end of the development cycle. Rather, the national CIIP structure should continuously monitor and adapt to the ever changing environment. Also, CSIRT and C-SAW teams should continue to educate their user bases and ensure that a strong cyber security culture develops over time.

Figure 3 illustrates the CIIP deployment timeline. The timeline spans the four developmental phases, culminating with a mature and robust national CIIP structure.

Conclusions

Developing countries have traditionally had poor access to the Internet, and as such have not felt the need to develop national CIIP structures. However, as these countries leverage Internet-based technologies, it is imperative that they develop their own national CIIP structures to ensure reliable operations, incident response and resilience in the face of attacks.

The CIIP framework described in this paper establishes a clear set of phases, goals and outcomes that developing countries can use to establish effective national CIIP structures. Of course, every operational environment is unique. Therefore, it is important that the national CIIP structures accommodate the pertinent features of their environments and continuously evolve with the changing technological and threat landscapes.

Every country must take strong steps to protect its information infrastructure and critical systems. To this end, every national CIIP structure should aim to be all encompassing, open, transparent and publicly available.

!

Figure 1 .

 1 Figure 1. High-level CSIRT model.

!Figure 2 .

 2 Figure 2. Organizations in a holistic CIIP structure.

Figure 3 .

 3 Figure 3. Timeline for deploying a national CIIP structure.