Left in the Dark: Obstacles to Studying and Performing Critical Infrastructure Protection

Abstract

This paper highlights major methodological obstacles to studying and performing critical infrastructure protection (CIP) in general and CIP governance in particular. The study simultaneously examines a research project on and practice in the context of Swedish CIP. The complex planning approach of interest is called Styrel, a Swedish acronym for Steering Electricity to prioritised power consumers. It aims to identify and prioritise power consumers of societal importance, collectively referred to as critical infrastructure (CI), to provide an emergency response plan for the event of a national power shortage. Methodologically, the investigation uses material from document studies, interviews and a survey, which involved many actors from the Swedish case. For the analysis of the methodological obstacles, this study applies an abstracted research and development process that encompasses four steps: data collection, data assessment, decision-making and evaluation. The paper mutually maps the insights from the research project to the empirical evidence from the case study. Through this reflective analysis, the findings contribute to a deeper understanding of the challenges that significantly impede research and practice in the context of national and international CIP, for example, insufficient information sharing and knowledge exchange among parties, a lack of integrated and advanced methods, and uncertainty in policies that induces a variety of local approaches. In addition, since empirical research on implemented CIP plans is limited, this paper addresses this gap. It reveals five general obstacles for both research and practice: a) the access to high-quality data, b) the loss of knowledge over time, c) the interpretation and evaluation of processes and methods, d) the transferability and comparability of data, results and insights; whereas all culminate in 5) a lack of collective intelligence. The accumulation of these obstacles hinders a detailed assessment of decision-making for CIP and its consequences on society. For this reason, this study emphasises the need for enhancing mutual understanding among the various parties in the area of CIP while respecting relevant security issues when inventing novel methods that facilitate collective intelligence.

Framework for critical information infrastructure protection in smart government: a case study in Indonesia

“…In other studies, the development of security controls refers to standard security programs or enterprise architecture (EA) with complete security functions (ISO/IEC, 2013; Suter, 2007; NIST, 2018; Center for Internet Security, 2021). CII protection for several service providers results from developing EA (Baina et al , 2020; Erastus et al , 2020; Große et al , 2021; Ramtohul and Soyjaudah, 2016). Despite the variety of approaches for developing security control, the EA approach is more necessary for CII protection at the national level because EA accounts for threats, vulnerabilities, security principles and functions (Putro and Sensuse, 2021).…”