A Hybrid Hierarchical Framework Toward Security Effectiveness for Critical Infrastructure Protection and Resiliency: A Hospital Case Study

Abstract

A successful Denial of Service attack on a CI can indirectly have devastating and irreversible effects to those that depend on its services. Furthermore, recent disruptions have raised concerns regarding the resiliency, security effectiveness and emergency preparedness of CIs and dependent resources. To address the persistent challenge of protecting CIs and maintaining the essential services they provide, this research offers emergency management personnel a conceptual framework to evaluate security effectiveness and estimate the cascading effects that may result from inadequate security measures. We combine the philosophy of multi-dimensional modeling, with the statistical engine of Bayesian Belief Networks to provide proactive, scenario-based interdependency analysis for CI protection and resiliency. The findings of this research resulted in a multi-dimensional approach that enables a heightened awareness of one’s risk-posture by highlighting the existence (strength) or absence (weakness) of relevant security factors. Through stakeholder risk-assessment, preemptive implementation of threat mitigation plans for dependent resources are permissible. Specifically, we provide this proof of concept, “what-if” analysis tool to assist in the reduction of vulnerabilities. To illustrate the conceptual framework, we provide a Healthcare and Public Health sector case study that evaluates the impact to a hospital patient given a successful DoS attack on a CI.