Identification of Critical Infrastructures in the Mediterranean Sea context and communications’ criticalities Irene Fiorucci Cesidio Bianchi Istituto Nazionale di Geofisica e Vulcanologia Rome, Italy

Outline  Motivation (European Directive)  Selecting criteria and identification of ECIs  Minimum amount of information for the ECIs management and control  Internet criticalities and the need of a backup network  Conclusions 2SWING Final Meeting | CNIT - Pisa, Italy13/12/2013

Motivation 3SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 In the framework of the European Program for Critical Infrastructure Protection (EPCIP), the Council of the European Union has established, by means of the promulgation of the Directive 2008/114/EC, a procedure for the identification and designation of European Critical Infrastructures (ECIs) and the assessment of the need to improve their protection. “Critical Infrastructure means an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State.” Council Directive 2008/114/EC Reducing the vulnerabilities of critical infrastructure and increasing their resilience is one of the major objectives of the EU. This protection process should be based on an all-hazards approach (technological threats, natural disasters, etc.) but the threat of terrorism should be given priority.

Directive 2008/114/EC 4SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 The 2008 Directive applies only to the Energy and Transport sectors.

Directive 2008/114/EC 4SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 The 2008 Directive applies only to the Energy and Transport sectors.

5SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 Ports are sensitive points: sea entrance gates for goods and passengers transfer relevant cross-border mutual exchange of information SWING project is focused on the Mediterranean region where several relevant ports are operative. ECIs and CGAs identification

5SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 Ports are sensitive points: sea entrance gates for goods and passengers transfer relevant cross-border mutual exchange of information SWING project is focused on the Mediterranean region where several relevant ports are operative. SWING project simulated scenario: European Critical Infrastructures (ECIs) : Coast Guards of three Mediterranean ports (Piraeus-Athens, Gibilmanna- Palermo, Roquetes-Barcelona) Controlling Governmental Agency (CGA): General Command of the Coast Guards (located in Rome) ECIs and CGAs identification

AIS-VTS system Coast Guards have many functions (search and rescue at sea, safety of navigation, protection of the marine environment etc.). We consider only maritime traffic control. Data concerning the vessels traffic are collected by means of an AIS-VTS system: 6SWING Final Meeting | CNIT - Pisa, Italy13/12/2013  AIS (Automatic Identification System): electronic transponder installed on a vessel transmitting a VHF signal.  VTS (Vessel Traffic Services): stations onshore to monitor the local maritime traffic (using radar and VHF radio links with the passing ships).

Minimum amount of information each vessel exchanges with the nearest AIS-VTS station: 7SWING Final Meeting | CNIT - Pisa, Italy13/12/2013

Minimum amount of information  Minimum amount of information for each vessel: ≈1 kbit  Normal vessels traffic in the sector of competence of a Coast Guard: a hundred of vessels 8SWING Final Meeting | CNIT - Pisa, Italy13/12/2013

Minimum amount of information  Minimum amount of information for each vessel: ≈1 kbit  Normal vessels traffic in the sector of competence of a Coast Guard: a hundred of vessels Minimum amount of information for each Coast Guard: ≈ 100 kbit This information is exchanged between the Coast Guards and the General Command using the broadband Internet connection. 8SWING Final Meeting | CNIT - Pisa, Italy13/12/2013

Internet Criticalities of ECIs and CGAs 9SWING Final Meeting | CNIT - Pisa, Italy13/12/2013 Numerous kind of security threats and intrusions to the web services: Malware Leakage of personal information Phishing Denial-of-services (DoS) and Distributed Denial of Services (DDoS). DOS A Denial-of-Service attack is designed to hinder or stop the normal functioning of a web site or server flooding it by sending more requests than it is able to handle. This will make the server run slower than usual or crash completely. DDOS A Distributed-Denial-of-Service attack differs only in the fact that it is conducted using multiple machines. The hacker typically uses one compromised machine as the ‘master’ and co-ordinates the attack across other, so-called ‘zombie’, machines.

Conclusions 10SWING Final Meeting | CNIT - Pisa, Italy13/12/2013  Due to internet vulnerabilities in case of terrorist threat or attack, sensitive and confidential information regarding maritime traffic should be shared in a supplementary network. The SWING high survival HF radio network has been designed for this aim.  However, due to the relatively low data throughput of the SWING network, only the minimum flux of essential information for the ECIs management and control should be maintained (≈ 100 kbit ).  In spite of its scarce efficiency, the HF network is the only way to communicate relatively short messages, necessary for infrastructures awareness, preparedness and protection, at long distances, at any time any condition.