Critical infrastructure resilience: A Nordic model in the making?

Abstract

In recent years, there has been a shift in emphasis from critical infrastructure protection to that of resilience. This development reflects the acknowledgment that complete protection can never be guaranteed, and that achieving the desired level of protection is not cost-effective as a rule in relation to the actual threats. This article reviews the responses of four of the five Nordic countries to this challenge, namely Denmark, Finland, Norway and Sweden. The article analyzes their strategies and conceptual development, highlighting the common trends and differences. In so doing, it argues that these countries have a better starting point for the task of making their critical infrastructure resilient than most of the EU. This is due to the fact that even before the resilience debate emerged, these countries had based their policies on securing vital societal functions rather than the individual infrastructures that support these functions. The article concludes that some kind of Nordic model can really be identified when it comes to approaches towards critical infrastructure resilience. It should also be recognized, however, that there has been a fruitful interplay at the conceptual level between the Nordic countries and the EU that has inspired and influenced both parties.

Critical Infrastructures: The Operational Environment in Cases of Severe Disruption

“…If this is true, seeing infrastructure management as part of the context of internal and external security, the prevention of terrorism and crisis management become increasingly distant. To counteract this, the Nordic countries, for example, have been striving to reinforce the principles of comprehensive security and a broader concept of security that interweave public administration, business, non-governmental organizations, and citizens to improve the resilience of society [64]. The role of such actors may be vital in exceptional situations; they may be essential for continuity even if they are not thought to be relevant when designing systems or managing them in normal situations.…”

Climate Change, Environmental Threats and Cyber-Threats to Critical Infrastructures in Multi-Regulatory Sustainable Global Approach with Sweden as an Example

“…In addition, cyber-threats and environmental threats interact in a way that increases the risks for CI. This is particularly true in the energy sector, especially in the European High North (EHN) areas, such as Norway, Sweden and Finland where there is a need to improve resilience (Pursiainen, 2018). Given the lack of treaties both at global and regional level regulating cyber-threats and cyber-attacks, especially to CI and under environmental threats, it is up to the national level, and more specifically to the private sector to manage cyber-threats.…”

“…Adding regulation would force the private sector operating under cyber-security rules and exposed to the risk of cyber threat, to invest more resources in protection or resilience of the systems they own or operate. This would not be welcomed by many operators, especially of CI, because markets are externalizing CI risks at present, whereas state regulation would mean establishing "liability rules based on the notion that organization should internalize the costs of the risks they produce and that by internalizing them, they will make wise choices about the technologies they use" (Pursiainen, 2018). According to one author (Pursiainen, 2018), this would require a well-functioning tort liability legislation that would make it easy for the consumer, both public and private, to demand compensation for losses incurred by CI failures or enterprises heavily digitalized with vulnerable holes that could be exposed to cyber-threats.…”

“…This would not be welcomed by many operators, especially of CI, because markets are externalizing CI risks at present, whereas state regulation would mean establishing "liability rules based on the notion that organization should internalize the costs of the risks they produce and that by internalizing them, they will make wise choices about the technologies they use" (Pursiainen, 2018). According to one author (Pursiainen, 2018), this would require a well-functioning tort liability legislation that would make it easy for the consumer, both public and private, to demand compensation for losses incurred by CI failures or enterprises heavily digitalized with vulnerable holes that could be exposed to cyber-threats. In the substance, lessons learned from the environmental liability system and applied to the cyber-security regime can force the industry to pay more attention to cybersecurity, to invest more and to make the cybersecurity regime effective and to use liability as an instrument to apply sustainable development not only in the environmental area but also in the cybersecurity regime facilitating the shift toward a sustainable cyber security.…”

Continuous and multidimensional assessment of resilience based on functionality analysis for interconnected systems

“…This work focuses on situation (a) and proposes a methodology for continuous and multidimensional resilience assessment based on analysis of the functionalities of interconnected systems. Current resilience assessment approaches are oriented towards individual systems (Pursiainen, 2018), whether they be financial, healthcare or transport systems. These approaches are therefore inflexible (difficult to adapt to other domains), with fixed criteria that generally concern performance (other criteria that might be important in the assessment of resilience are overlooked) and not applicable in the context of interconnected systems.…”