1. Hannu Sivonen1 Risk assessment based on interdependencies Helsinki, Finland Hannu Sivonen, Senior Researcher MANMADE Castellanza 28-29 June 2007

2. Hannu Sivonen2 National Emergency Supply Agency (NESA) Fund, independent of the state budget Public Private Partnership coordinator (23 branches, 800 experts) Government defines objectives for security of supply NESA finances security of supply when not provided by the market mechanism Focus areas:  Critical technical infrastructure  Food supply  Energy supply  Logistics  Critical medical substances and supplies  Defence related industries NESA balance is 1000 million €

3. Hannu Sivonen3 A method for assessing the risk caused by interdependencies between technical infrastructures, basic services, and threats  Linear mathematical model similar to that used by Google  Simplifying assumptions  Complex interdependencies and accumulating effects and risks handled Information system failures and weather conditions are major risks in Finland Published in Finnish Yhteiskunnan huoltovarmuuden kannalta keskeisten toimintojen riskiarviointi http://www.huoltovarmuus.fi/julkaisut/esittely/?id=72 Risk assessment based on interdependencies

4. Hannu Sivonen4 Finnish government decision 305/2002 Technical infrastructures (14) energy supply communications information systems Basic services and supplies (29) food supply transport logistics mass media health care financial services

5. Hannu Sivonen5 Threats from outside the infrastructure and services (17) economic threats  threats to information systems  crisis in international logistics weather phenomena structural damage strikes environment and health threats national security threats

6. Hannu Sivonen6 Interdependencies = reasons for failures recurrent (ratio 1) expected (ratio 0.1) rare (ratio 0.01) theoretical (ratio 0.001) nonexistent

7. Hannu Sivonen7 Input: Interdependencies (sample)

8. Hannu Sivonen8 Mean time between failures recurrent (< 1 year) expected (1-10 years) rare (10-100 years) theoretical (>100 years) nonexistent

9. Hannu Sivonen9 Input: Duration and mean time between failures

10. Hannu Sivonen10 Output: Relative risks pertinent to inter- dependent infrastructures

11. Hannu Sivonen11 Output: Relative risks pertinent to outside threats

12. Hannu Sivonen12 Relative component risks in food logistics *) operator = processing plant + logistics operator

13. Hannu Sivonen13 The model applied to criticality of ICT functions 72 functions, 6 scenarios (3x2): Duration of failure  short term (hours)  medium term (days)  long term (months) Dependency type  cause of failure to others  obstacle to recovery of others No assessment for MTB, just interdependencies = potential effect, criticality

14. Hannu Sivonen14 Top ten critical functions from 6 scenarios