When the future meets the past: Can safety and cyber security coexist in modern critical infrastructures?

Abstract

Big data technologies are entering the world of ageing computer systems running critical infrastructures. These innovations promise to afford rapid Internet connectivity, remote operations or predictive maintenance. As legacy critical infrastructures were traditionally disconnected from the Internet, the prospect of their modernisation necessitates an inquiry into cyber security and how it intersects with traditional engineering requirements like safety, reliability or resilience. Looking at how the adoption of big data technologies in critical infrastructures shapes understandings of risk management, we focus on a specific case study from the cyber security governance: the EU Network and Information Systems Security Directive. We argue that the implementation of Network and Information Systems Security Directive is the first step in the integration of safety and security through novel risk management practices. Therefore, it is the move towards legitimising the modernisation of critical infrastructures. But we also show that security risk management practices cannot be directly transplanted from the safety realm, as cyber security is grounded in anticipation of the future adversarial behaviours rather than the history of equipment failure rates. Our analysis offers several postulates for the emerging research agenda on big data in complex engineering systems. Building on the conceptualisations of safety and security grounded in the materialist literature across Science and Technology Studies and Organisational Sociology, we call for a better understanding of the ‘making of’ technologies, standardisation processes and engineering knowledge in a quest to build safe and secure critical infrastructures.

Rethinking Independence in Safety Systems

“…Organizational structures and roles. The upsurge of cybersecurity incidents is not reflected in the tasks and expected knowledge of the OT personnel [29,20,30]. The OT personnel and operators perceive any system anomalies but struggle to identify the origin of the anomaly (e.g., (un)intentional faults).…”

The Role of Cybersecurity in Medical Devices Regulation: Future Considerations and Solutions

“…These are simple devices with sensors and network connectivity, such as smart devices like cameras or sensors, or wearables, like pacemakers and automated insulin pumps, intended to be part of a greater system. 58 Manufacturers sometimes forgo updates to the software in IoT devices to cut costs, which, as time passes, makes them increasingly vulnerable to cyberattacks. 59 For this reason, the initial approval of a device does not ensure compliance throughout the medical devices' lifecycle.…”

Untitled

“…In recent years, CPS has seen a rise in connections, which has raised cybersecurity concerns. Aside from classic information system vulnerabilities, CPS has new issues due to heterogeneous devices and protocols and stringent reliability requirements (Michalec et al, 2022). The critical infrastructure could be formed as laboratories for practice, intelligence school and training, qualified departments and materials, and cyber-physical systems (Qi et al, 2018;Quincozes et al, 2022).…”