CRITICAL INFRASTUCTURE PROTECTION: ENGINEERING AS A FORCE MULTIPLIER

CRITICAL INFRASTUCTURE PROTECTION: ENGINEERING AS A FORCE MULTIPLIER BY COL.

Protocol.

INTRODUCTION

Critical infrastructure and how we protect it is fast becoming a prominent topic around the world. Much attention is paid to its definition and what role critical infrastructure offers towards the well-being of the society. This is more so, especially as pertains to the societal impact if a catastrophic loss of critical infrastructure were to occur, be it due, natural disaster, terrorism, or acts of war. You will agree with me that the events of terrorism in the North- Eastern part of Nigeria has significantly raised national awareness about the topic. It was, after all the tragedy posed by Boko-Haram that propelled the creation a new division of the Nigeria Army and indeed, other special task forces by various security agencies in the North-Eastern part of the country. Similarly, unrests throughout the world continues to fuel concerns about critical infrastructure. This paper will therefore, attempt to define some terms that I hope will help our understanding of this topic. It will highlight various critical infrastructure sectors and discuss tools, physical security equipment and services required to mitigate the threats and risks associated with insecurity.

AIM

The aim of the paper is to discuss critical infrastructure protection and the role of the engineer.

SCOPE

This paper will cover the following:

• Definition of important terms.
• Overview of Critical Infrastructure.
• Physical security equipment and services.
• Roles of Engineers in mitigating security threats and risks.

DEFINITION OF TERMS

Physical Security: Wikipedia describes physical security as “security measures designed to deny unauthorized access to facilities, equipment and resources, and to protect personnel and property from damages or harm (such as espionage, theft, terrorist attacks, robbery, kidnapping, etc. It involves the use of multiple layers of interdependent systems which would include but not limited to CCTV surveillance, security guards, protective barriers, locks, access control and protocol.

Critical Infrastructure: The Department of Homeland Security (DHS) in the United States of America defines Critical Infrastructure as “the assets, systems and networks, whether physical or vital , so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, public health or safety, way of life or any combination thereof”.

Force Multiplier: A force multiplier refers to a factor. Force multiplier therefore,is an attribute or a combination of attributes that dramatically increases (hence multiplies) the effectiveness of an item or a group, giving a given number of troops or weapons/hardware the ability to accomplish greater things than without. The expected size increase required to have the same effectiveness without that advantages is the multiplication factor. For example, if a certain technology like GPS (Global Positioning System) enables a force to accomplish the same results of a force five times as large but without GPS, then the multiplier is five. Such estimates are used to justify an investment in cost for force multipliers.

OVERVIEW OF CRITICAL INFRASTRUCTURE AND SECURITY CHALLENGES.

The Department of Homeland Security maintains that: “Protecting and ensuring the continuity of the critical infrastructure of the United States are essential to the nation’s security, public health and safety, economic vitality and way of life.

The United States thus classifies 18 critical infrastructure sectors as follows:

By comparison, Canada’s National Strategy for Critical infrastructure lists 10 critical infrastructure sectors.

A closer look will of course confirm that these are one and the same. The only difference is that one is more detailed and I believe it is so, in order to remove any ambiguity.

However, they both view critical infrastructure as paramount to a nation for 3 key reasons:

• Attacks on critical infrastructure could significantly disrupt the functioning of government and business alike and produce cascading effects far beyond the targeted sector and physical location of the incident.

• Direct terrorist attacks and natural, manmade, or technological hazards could produce catastrophic losses in terms of human casualties, property destruction, and economic effects, as well as profound damage to public morale and confidence.

• Attacks using components of the nation’s critical infrastructure as weapons of mass destruction could have even devastating physical and psychological consequences.

Critical infrastructure protection thus falls under 3 main areas of focus, these being:

1. Cyber protection
2. Physical protection
3. Emergency protection

For the purpose of this discuss however, we shall limit ourselves to physical protection.

PHYSICAL SECURITY EQUIPMENT AND SERVICES

From our earlier definition of physical security measures.The services and equipment required to achieve the needed objective are as follows:

1. VIDEO SURVEILLANCE: Includes the following equipment types for professional video surveillance equipment: analogue security cameras, DVRs, NVRs, network security cameras, video encoders, video management software (VMS), camera housings, CCTV controllers/keyboards and motorized camera positioning mounts.

2. ACCESS CONTROL: Includes the following equipment types: readers, control panels, credentials, software and electronic locks.

3. INTRUDER ALARMS: Includes the following equipment types: intrusion sensors, control panels, keypads and accessories.

4. ENTRANCE CONTROL (VEHICLE):Includes the following equipment types: gate operators, rising bollards, road blockers, barriers, garage door operators, and parking systems.

5. ENTRANCE CONTROL (PEDESTRIAN): Includes the following equipment types: entrance gates, full-height turnstiles, optical turnstiles, interlocking doors, revolving security doors, security booths, speed gates, and tripod barriers.

6. CONSUMER VIDEO SURVEILLANCE: Video equipment distributed through a diversified network of physical and online retailers, designed for residential and SMB applications, and to be installed by the consumer (although may be installed professionally once purchased).

7. THERMAL CAMERAS: Un-cooled thermal cameras used in security applications such as perimeter security.

8. WIRELESS INFRASTRUCTURE: Wireless infrastructure used in video surveillance applications: wireless mesh nodes, point-to-point links and point-to-multipoint base stations and sub units.

ROLES OF ENGINEERS IN MITIGATING SECURITY THREATS AND RISKS

Equipment is defined as “necessary items for a particular purpose”. Its synonyms include “apparatus, paraphernalia, articles, appliances, impedimenta, tools, utensils, implements, instruments, hardware, gadgets, gadgetry, stuff, things, kit, tackle, rig, resources, supplies, material, baggage, etc.”

Also, an Engineer is defined as “a person who designs, builds, or maintains engines, machines or public works. He or She could also be an originator, deviser, architect, inventor, developer, creator, mastermind, etc.” Therefore, as engineers, I am certain we can identify with a handful of the synonyms of equipment because it is our job to design, build and maintain them. Our design must however, be focused on security aspects to achieve the purpose for which physical security policy is formulated. This may be at the architectural design stage (in case of physical infrastructure) where we have to consider threat assessment, to think of vulnerabilities, layout of design for responders during rescue operations, physical barriers for blast control, virtual/cyber solutions. The multi-dimensional specialized field that covers these myriads of solutions is called security engineering. It is a fast-growing field which according ISIS international is valued at US$250 billion frown its 2014 survey. I stand to be corrected, I am not sure there is a dedicated division in the Nigerian Society of Engineers for this fast-growing field. I would therefore, encourage our young engineers to cash in on this. I would like to assume that we can all agree that the global threat trend tilts largely towards terrorism. For your information only, there are 5 distinct types of terrorism and these are:

• State-Sponsored terrorism, which consists of terrorist acts on a state or government by a state or government.
• Dissent terrorism, which are terrorist groups which have rebelled against their government.
• Terrorists and the Left and Right, which are groups rooted in political ideology.
• Religious terrorism, which are terrorist groups which are extremely religiously motivated and
• Criminal Terrorism, which are terrorists acts used to aid in crime and criminal profit.

If this topic is of any interest to any us here present you could contact me later for materials.

It is however, important to state here that the methods of attack could either be physical or online (i.e. cyber).

Consequently, in the fight against the threat of terrorism and indeed all other that could affect our well-being and way of life, the engineer would not only be helping to contribute his or her quota for the protection of law-abiding citizens, he or she would also be smiling to the bank.

CONCLUSION

The purpose of critical infrastructure protection in any nation is to build capabilities and competencies to strengthen and supportthe robustness, reliability, resilience and protection of physical and information technology facilities, networks, services and assets (human and material), which if disrupted or destroyed would have serious impact on the health, safety, security, economic well-being, or effective functioning of a nation. The engineer must therefore, at the design stage, take cognizance of the requirements to deter, detect, deny, delay and defend. These are the 5Ds of physical security measures.

Here in Nigeria, the security engineering field is still dominated by foreign companies. There are thus, vast opportunities for young engineers to explore. One security engineer cannot cover the entire spectrum of physical security. Professionals that work in this space do not always have a holistic understanding of physical security because of specialized variables and components that are needed to secure an organization or an asset. Individuals often specialize in specific fields such as secure facility construction, risk assessment and analysis, secure data centre implementation, fire protection, intrusion detection systems, closed-circuit television implementation, personnel emergency response, etc.

Guards are a significant part of physical security measures because they are adaptable. Security officers maybe fixed at one location or make rounds, patrolling the grounds. While making rounds, guards can verify doors and windows are locked, and vaults protected. Guards may also be (though not in all cases) be accountable for watching intrusion detection systems and CCTVs and can react to suspicious activities by calling for backup or police intervention to help capture a suspect.

These equipment does not only complement the efforts of the security guards but also speed up the attainment of the objective of physical security measures, the 5Ds, deter, detect, deny, delay and defend.

The engineer will design, build and maintain the equipment. Therein lies the force multiplier.

I thank you for your rapt attention.

References.

Harris, S. (2013). Physical and environmental security. In CISSP Exam Guide (6th ed., pp.427-502). USA McGraw-Hill;

Harris, S. (2013). Access Control. In CISSP Exam Guide (6th ed., pp.97, 98, 157-277).USA McGraw-Hill:

Harris, S. (2013). Information Security Governance and Risk Management. In CISSP

Exam Guide (6th ed,. Pp. 21-141). USA McGraw-Hill;

Wailgun, T. (2005, February 1). Metrics for Corporate and Physical Security Programs /CSO online. Retrieved fromhttp://www.csoonline.com/article/2118531

/metrics-budgets/metrics-for-corporate -and-physical-security-programs.html

Irwin, S. (2014, September 8). Creating a Threat profile for your organization.

Retrieved from https:/www.sans.org/reading-room/whitepapers/threats/

Creating-threat-profile-organization-35492

U.S. Department of Homeland Security, & Interagency Security Committee (ISC).

(2009). Interagency Security Committee Use of Physical Security

Performance Measures. Retrieved from https://www.dhs.gov/xlibrary/assets/isc-physical-security-performance-measures.pdf

SANS Institute. (n.d.).SANS Institute-CIS Critical Security Controls. Retrieved from

https://www.sans.org/critical-security-controls

Interagency Security Committee (ISC). (2015). Best Practices for Planning and

Managing: Physical Security Resources: An Interagency Security Committee

Guide. Retrieved from https://www.dhs.gov/sites/default/file/publicatios/isc-planning -managing-physical-secuirty-rescources-dec-2015-505.pdf