1. The Assessment Methodology of Resilience of Critical Infrastructure Elements Luděk Lukáš Tomas Bata University in Zlín Czech Republic, lukas@fai.utb.czlukas@fai.utb.cz

2. 1.Introduction 2.Protection of Critical Infrastructure in the Czech Republic 3.Assessment Framework for Resilience of Critical Infrastructure 4.Resilience Criteria 5.Methodology for Assessment of Resilience of CI 6.Conclusion Agenda

3. contemporary democratic society provides citizens by optimal conditions for their life and development, society development is mainly based on using of new technology, society highly depends on technology, concept of critical infrastructure protection was formulated as a one of the pillars of security based on political developments in the nineties. Introduction

4. key critical infrastructure sectors are energy, ICT, health care, food, transportation etc. critical infrastructure must be protected particularly against the physical destructive threats, technological accidents, cyber attacks and natural disasters, selection of individual elements of critical infrastructure is provided on the basis of sectorial criteria. Introduction

5. Czech Republic has started process of protection of critical infrastructure since 2010, Czech Republic has defined area of critical infrastructure legislatively by amendment to the Act No. 240/2000 Coll. on crisis management, critical infrastructure is defined by Act as: ".. an element of critical infrastructure or system of elements of critical infrastructure which disruption of the function would have a significant impact on national security, the security of basic living needs of the population, human health or economy of the state." this Act has established the duty of state's and private's owners of selected elements and systems to ensure the protection of elements of critical infrastructure, Protection of Critical Infrastructure in the Czech Republic

6. ensuring the protection, resilience and recovery infrastructure includes risk analysis of critical infrastructure elements, the specification of security, safety and operational measures to ensure the required level of security and reconstruction functions, Operational Security Plan is basis for the protection and restoration functions, Security Liaison Officer must be designated in each element of critical infrastructure. evaluation of taken protection measures should be part of protection of critical infrastructure in the future. Protection of Critical Infrastructure in the Czech Republic

7. protection of key elements of critical infrastructure is the principle of the protection of critical infrastructure definition: resilience of critical infrastructure is its ability to ensure its function in terms of the effects of external and internal negative factors (risks) resilience of a critical infrastructure element expresses its adaptability to potential threats (risks), evaluation of resilience of element of critical infrastructure should be concrete, aimed at evaluating the evaluable unit with clear boundary, evaluated element is particularly structure / building, facility, means or public infrastructure; evaluation of resilience should be comprehensive, Framework for Resilience Evaluation

8. evaluation should be bottom up, resilient element of the critical infrastructure is the basis of resilience of critical infrastructure sector; methodology of risk management is the basis for evaluation the resilience; responsibility for ensuring the functionality and protection of critical infrastructure element should be respected, evaluated element should be owned by one subject of a critical infrastructure resilience of an element of critical infrastructure is possible to evaluate only in time of real disaster, the resilience of the element evaluation should be performed semi- quantitatively and multi-criteria. Framework for Resilience Evaluation

9. Resilience of critical infrastructure: resilience of critical infrastructure is its ability to ensure its function in terms of the effects of external and internal negative factors (risks) ability to overcome the effects of negative factors and ensure continuous operation of element of critical infrastructure, Resilience Criteria

10. Resilience of critical infrastructure is achieved by: ability to withstand the effects of negative factors, flexibility of operation, absorption of impact of negative effects, adaptation to the new situation, involvement of redundant elements, recovery function, etc. Resilience Criteria

11. Basic parameters of resilience include: robustness, preparedness, responsiveness, recoverability. Resilience Criteria

12. robustness of CI element - represents strength, durability, resistance to deformation; ability to withstand and survive the effects of negative factors without significant degradation of function; robustness of element of critical infrastructure includes: structural robustness, security robustness (protective robustness). structural robustness - the ability to withstand the effects of negative factors based on the design of element, the system configuration and technologies. security robustness - the ability of an element of critical infrastructure to withstand effect of the negative factors by using of security and protective measures Resilience Criteria

13. preparedness - the ability of an element of critical infrastructure to withstand the expected crisis situations. responsiveness - ability of response of forces and means to recovery function of an element of critical infrastructure recoverability of element of critical infrastructure is its ability to restore function after emergency event to the desired level. evaluation of resilience is narrowed into the evaluation of robustness and preparedness Resilience Criteria

14. Methodology for evaluation of resilience of CI elements includes following phases: system analysis risk analysis and risk assessment determination of evaluated areas of provision and security determination of the attributes and calculating the size of the parameters calculation of the resilience of critical infrastructure element assessment of the resistance elements of critical infrastructure Methodology for Assessment of Resilience of CI

15. Evaluated critical infrastructure element system analysis objective function (output, product, service) of the element of critical infrastructure, process architecture - list of key processes that ensure the objective function of element (specify the characteristics of processes and outputs) topological structure of the evaluated object - topological structure, elements and links correlation and time-sensitivity of production – sensitivity on lacking production (electricity immediately, due to the oil reserves in the pipeline – from hours to day work activities of the ministry - a few days) number of employees results are used for calculation of the structural robustness Methodology for Assessment of Resilience of CI

16. Risk Analysis and Risk Assessment The process of risk analysis and assessment includes the following phases: semi-quantitative risk analysis, KARS analysis. In the first instance, the risk is semi-quantitatively expressed by: Where: R - is the value of risk P - probability of particular threat effectuation, N - is the result of threats. Methodology for Assessment of Resilience of CI

17. The next step risk analysis is KARS analysis (qualitative risk analysis of correlations). objective: to identify and determine the most significant risks that threaten 80% of the functionality of element of critical infrastructure principle of KARS analysis is based on the "Pareto rule" (Vilfredo Pareto - Italian sociologist, sometimes also rule 80/20): „20 % risk affects 80% of the system's functionality“ Methodology for Assessment of Resilience of CI Index1234 Rizika Vysoká teplota Blesk Pád stromu Provozní chyba pracovníků třetích stran 1Vysoká teplotax001 2Blesk0x10 3Pád stromu00x0 4Provozní chyba pracovníků třetích stran100x

18. Mathematical representation of the coefficients is given by: To express the parameters of the line is used a mathematical formula: Methodology for Assessment of Resilience of CI

19. coefficient of risk H RZ - the risk expresses the potential impact on the functionality of critical infrastructure, correlation coefficient K SO - expresses the dependence of a link between the areas of critical infrastructure, coefficient of structural robustness K SR - is the ability to withstand the elements of negative factors due to its structure, system performance and characteristics of technology. coefficient of security robustness K RO - referring to the status and level of security measures ensuring the elimination of risk exposure, coefficient of preparedness K PR - is the ability of the element to ensure a response to the emergence of an emergency / incident and restore the functions required elements of critical infrastructure Methodology for Assessment of Resilience of CI

20. Coefficient of Correlation Determination of coefficient of correlation K s is an important aspect that expresses the position of the linkages and dependencies of areas of critical infrastructure sectors within the critical infrastructure. Generally speaking, the main areas are the links: physical links, logical links, territorial links. To determine the coefficient of correlation applies: Where: K s - coefficient of correlation Sum S i - is the sum of the degree of dependence of the i-th group elements on other areas of critical infrastructure S max - the maximum value that can be defined within the system to achieve. Methodology for Assessment of Resilience of CI

21. Calculation of Coefficient of Robustness K RO Where K RO - the coefficient of robustness K RZ - the coefficient of security robustness K SR - is the coefficient of structural robustness Methodology for Assessment of Resilience of CI

22. Calculation of Coefficient of Security Robustness Where: V FB - weight of physical security, V IB - weight of information security, V AB - weight of administrative security, M FB - quality of physical security measures, M IB - quality of information security measures M AB - quality of administrative security measures, Methodology for Assessment of Resilience of CI

23. The next step is the mathematical expression of the coefficient of structural robustness by formula: where: K SR - coefficient of structural robustness I t - topology index, I s - complexity index, I kt – index of key technologies I f - flexibility index I r - redundancy index I po - index of perimeter protection. Methodology for Assessment of Resilience of CI

24. Mathematical expression of preparedness of element of critical infrastructure system is given by: where: K r - coefficient of accuracy of the identified risks, K p - coefficient of quality of Security Operation Plan, K i - coefficient of quality of implementation of Security Operation Plan Methodology for Assessment of Resilience of CI

25. Mathematical formula of resilience of the element of critical infrastructure: where: H Rz - value of risk K s - correlation coefficient K RO - coefficient of robustness V RO - weight of robustness K PR - coefficient of preparedness V PR - weight of preparedness Methodology for Assessment of Resilience of CI

26. resilienceODi excellent (A)0,8– 1 very good (B)0,6 – 0,79 good (C)0,4 – 0,59 sufficient (D)0,2 – 0,39 Not able (E)0 – 0,19 Level of resilience

27. methodology allows the evaluation of resilience of elements of critical infrastructure risk analysis is the basis for evaluation number of measures and security is evaluated robustness and preparedness are basic criteria for resilience evaluation Conclusion

28. With support of the Ministry of Interior of the Czech Republic under the Research Project No. VG20112014067 and by the European Regional Development Fund under the project CEBIA-Tech No. CZ.1.05/2.1.00/03.0089. Acknowledgement