Critical Infrastructure Protection

5.1 Understanding Critical Infrastructure

Critical infrastructure encompasses the systems and assets essential to the functioning of society. Disruption or destruction of these systems would have debilitating effects on public safety, economic security, or public health. Smart city security must prioritize protection of these vital resources.

The interdependency of critical infrastructure sectors creates cascading failure risks. A cyberattack on the power grid could disable water treatment, disable traffic signals, shut down hospitals, and cripple communications. Understanding these dependencies is essential for comprehensive protection strategies.

5.1.1 Critical Infrastructure Sectors

5.2 Power Grid Security

Electrical power is the foundation upon which all other infrastructure depends. Modern power grids combine traditional generation and transmission infrastructure with smart grid technologies that improve efficiency but also introduce new security challenges.

5.2.1 Physical Security Requirements

5.2.2 Cyber-Physical Security

Smart grid technologies create connections between operational technology (OT) networks controlling physical equipment and information technology (IT) networks. These connections must be carefully secured to prevent cyberattacks from affecting physical operations.

5.3 Water System Security

Water systems are uniquely vulnerable to both contamination and service disruption attacks. Protection requires securing treatment facilities, distribution networks, and the supervisory control systems that manage operations.

5.3.1 Treatment Facility Security

// WIA-CITY-SEC-001 Water Security Standards

Physical Security:
  - Perimeter: Double fence with detection zone
  - Access: Biometric + card + PIN (multi-factor)
  - Surveillance: 100% facility coverage, 30-day retention
  - Lighting: Full perimeter and interior illumination
  
Chemical Security:
  - Storage: Secured, ventilated, monitored
  - Access: Limited to trained, vetted personnel
  - Inventory: Real-time tracking, automated alerts
  - Delivery: Verified vendors, supervised offloading

Process Monitoring:
  - Quality sensors: pH, turbidity, chlorine continuous
  - Flow monitoring: All intake and distribution points
  - Anomaly detection: ML-based deviation alerts
  - Backup systems: Independent verification capability

Cyber Security:
  - Network: Air-gapped OT, encrypted communications
  - Authentication: Individual accounts, no shared credentials
  - Logging: All access and control actions recorded
  - Recovery: Tested backup and restoration procedures

5.3.2 Distribution System Monitoring

Water distribution networks span entire cities with thousands of miles of pipes and hundreds of monitoring points. IoT sensors enable continuous monitoring for contamination, leaks, and pressure anomalies.

5.4 Transportation Infrastructure

Transportation infrastructure includes roads, bridges, tunnels, rail systems, airports, and seaports. Security must protect both the physical infrastructure and the control systems that manage traffic and operations.

5.4.1 Bridge and Tunnel Security

Major bridges and tunnels are high-value targets requiring comprehensive protection against vehicle attacks, structural attacks, and surveillance/reconnaissance activities.

5.4.2 Transit System Security

Mass transit systems present unique security challenges due to high passenger volumes, multiple access points, and the need to maintain efficient operations while implementing security measures.

5.5 Communications Infrastructure

Communications infrastructure underpins all other critical systems and is essential for emergency response. Protection priorities include physical facilities, network infrastructure, and redundancy measures.

5.5.1 911/Emergency Communications

Physical Security:
  - Facility: Hardened construction, blast resistant
  - Power: Dual utility feeds + generator + UPS
  - Cooling: Redundant HVAC, N+1 minimum
  - Access: 24/7 staffing, biometric entry

Network Redundancy:
  - Trunking: Diverse paths from all carriers
  - Routing: Automatic failover, load balancing
  - Backup PSAP: Geographically separate, tested monthly
  - Interoperability: CAD-to-CAD, mutual aid

Cybersecurity:
  - Network: Segmented, monitored, filtered
  - Endpoints: Hardened, patched, EDR protected
  - Data: Encrypted at rest and in transit
  - Backup: Offline copies, tested restoration

Availability Target: 99.999% (5.26 min/year downtime)

5.5.2 Public Safety Radio Systems

Public safety radio networks (P25, TETRA) require protection against jamming, interception, and infrastructure attacks. Modern systems employ encryption and frequency hopping but remain vulnerable to physical attacks on tower sites.

5.6 Interdependency Management

Critical infrastructure sectors are deeply interconnected, creating complex failure cascades. Effective protection requires understanding and managing these interdependencies.

5.6.1 Resilience Strategies

• Redundancy: Backup systems for critical functions
• Diversity: Multiple suppliers, technologies, paths
• Isolation: Ability to operate independently when dependencies fail
• Rapid Recovery: Pre-positioned resources, tested procedures
• Cross-Sector Coordination: Information sharing, joint planning

5.7 IoT and Industrial Control Security

The proliferation of IoT devices and industrial control systems (ICS) in critical infrastructure creates new attack surfaces. These systems often have long lifecycles, limited security features, and challenging patch management requirements.

5.7.1 ICS/SCADA Security