9781119614531

TERM	PRICE	DUE
SEMESTER	$109.37	Dec 13
QUARTER	$103.90	Aug 16
SHORT TERM	$98.43	Jul 01

Covers critical infrastructure protection, providing a rigorous treatment of risk, resilience, complex adaptive systems, and sector dependence

Wide in scope, this classroom-tested book is the only one to emphasize a scientific approach to protecting the key infrastructures components of a nation. It analyzes the complex network of entities that make up a nation's infrastructure, and identifies vulnerabilities and risks in various sectors by combining network science, complexity theory, risk analysis, and modeling and simulation. This approach reduces the complex problem of protecting water supplies, energy pipelines, telecommunication stations, power grid, and Internet and Web networks to a much simpler problem of protecting a few critical nodes.

The new third edition of Critical Infrastructure Protection in Homeland Security: Defending a Networked Nation incorporates a broader selection of ideas and sectors than the previous book. Divided into three sections, the first part looks at the historical origins of homeland security and critical infrastructure, and emphasizes current policy. The second examines theory and foundations, highlighting risk and resilience in the context of complexity theory, network science, and the prevailing theories of catastrophe. The last part covers the individual sectors, including communications, internet, cyber threats, information technology, social networks, SCADA, water and water treatment, energy, and more.

Covers theories of catastrophes, details of how sectors work, and how to deal with the problem of critical infrastructure protection’s enormity and complexity
Places great emphasis on computer security and whole-community response
Includes PowerPoint slides for use by lecturers, as well as an instructor's guide with answers to exercises
Offers five robust appendices that augment the non-mathematical chapters with more rigorous explanations and mathematics

Critical Infrastructure Protection in Homeland Security, Third Edition is an important book for upper-division undergraduates and first-year graduate students in political science, history, public administration, and computer technology. It will also be of great interest to professional security experts and policymakers.

Ted G. Lewis has over 35 published books to his credit, and extensive experience in both industry and academia. He served as a senior executive in DaimlerChrysler Corp, Eastman Kodak Company, and Oregon Advanced Computing Institute, as well as a professor of computer science at the University of Missouri-Rolla, University of Louisiana, Oregon State University, and the Naval Postgraduate School. Lewis was Editor-in-Chief of IEEE Software Magazine, IEEE Computer Magazine, and founded several of its periodicals.

Foreword By Sen. Mark Warner xv

Foreword By Prof. Andrew Odlyzko xxi

Preface xxxiii

How to Use this Book xxxvii

About the Companion Website xxxix

1 Origins of Critical Infrastructure Protection 1

1.1 Recognition 3

1.2 Natural Disaster Recovery 4

1.3 Definitional Phase 5

1.4 Public–Private Cooperation 8

1.5 Federalism: Whole of Government 8

1.6 Rise of the Framework 10

1.7 Implementing a Risk Strategy 12

1.7.1 Risk‐Informed Decision‐Making 13

1.7.2 Resilience‐Informed Decision‐Making 14

1.7.3 Prevention or Response? 15

1.8 Analysis 16

1.8.1 The Public–Private Partnership (PPP) Conundrum 17

1.8.2 The Information Sharing Conundrum 17

1.8.3 Climate Change Conundrum 17

1.8.4 The Funding Conundrum 17

1.8.5 Spend 80% on 20% of the Country 18

1.9 Exercises 18

1.10 Discussions 19

References 20

2 Risk Strategies 21

2.1 Expected Utility Theory 23

2.1.1 Threat–Asset Pairs 24

2.2 PRA and Fault Trees 24

2.2.1 An Example: Your Car 26

2.3 MRBA and Resource Allocation 26

2.3.1 Another Example: Redundant Power 27

2.4 Cyber Kill Chains are Fault Trees 28

2.5 PRA in the Supply Chain 29

2.6 Protection Versus Response 30

2.7 Threat is an Output 32

2.8 Bayesian Belief Networks 33

2.8.1 A Bayesian Network for Threat 33

2.8.2 Predictive Analytics 34

2.9 Risk of a Natural Disaster 35

2.9.1 Exceedence 35

2.9.2 EP vs. PML Risk 35

2.10 Earthquakes 36

2.11 Black Swans and Risk 36

2.12 Black Swan Floods 37

2.13 Are Natural Disasters Getting Worse? 38

2.14 Black Swan Al Qaeda Attacks 38

2.15 Black Swan Pandemic 39

2.16 Risk and Resilience 41

2.17 Exercises 42

2.18 Discussions 43

References 43

3 Theories of Catastrophe 44

3.1 Normal Accident Theory (NAT) 45

3.2 Blocks and Springs 46

3.3 Bak’s Punctuated Equilibrium Theory 48

3.4 Tragedy of the Commons (TOC) 51

3.4.1 The State Space Diagram 52

3.5 The US Electric Power Grid 52

3.6 Paradox of Enrichment (POE) 55

3.6.1 The Great Recessions 56

3.6.2 Too Much Money 56

3.7 Competitive Exclusion Principle (CEP) 57

3.7.1 Gause’s Law 58

3.7.2 The Self‐Organizing Internet 58

3.7.3 A Monoculture 59

3.8 Paradox of Redundancy (POR) 59

3.9 Resilience of Complex Infrastructure Systems 60

3.9.1 Expected Utility and Risk 60

3.9.2 Countering SOC 60

3.9.3 The TOC Test 61

3.9.4 POE and Nonlinearity 61

3.9.5 CEP and Loss of Redundancy 61

3.9.6 POR and Percolation 62

3.10 Emergence 62

3.10.1 Opposing Forces in Emergent CIKR 62

3.11 Exercises 63

3.12 Discussions 64

References 64

4 Complex CIKR Systems 66

4.1 CIKR as Networks 69

4.1.1 Emergence 72

4.1.2 Classes of CIKR Networks 74

4.1.3 Self‐Organized Networks 75

4.2 Cascading CIKR Systems 76

4.2.1 The Fundamental Resilience Line 80

4.2.2 Critical Factors and Cascades 81

4.2.3 Targeted Attacks 82

4.3 Network Flow Risk and Resilience 85

4.3.1 Braess’s Paradox 86

4.3.2 Flow Network Resilience 87

4.4 Paradox of Redundancy 88

4.4.1 Link Percolation and Robustness 88

4.4.2 Node Percolation and Robustness 89

4.4.3 Blocking Nodes 89

4.5 Network Risk 91

4.5.1 Crude Oil and Keystone XL 92

4.5.2 MBRA Network Resource Allocation 92

4.6 The Fragility Framework 96

4.6.1 The Hodges Fragility Framework 96

4.6.2 The Hodges Fault Tree 97

4.7 Exercises 98

4.8 Discussions 99

References 100

5 Communications 101

5.1 Early Years 102

5.2 Regulatory Structure 105

5.3 The Architecture of the Communications Sector 106

5.3.1 Physical Infrastructure 107

5.3.2 Wireless Networks 108

5.3.3 Extraterrestrial Communication 108

5.3.4 Land Earth Stations 109

5.3.5 Cellular Networks 110

5.3.6 Generations 110

5.3.7 Wi‐Fi Technology 111

5.4 Risk and Resilience Analysis 111

5.4.1 Importance of Carrier Hotels 113

5.4.2 Network Analysis 114

5.4.3 Flow Analysis 116

5.4.4 Robustness 116

5.4.5 The Submarine Cable Network 117

5.4.6 HPM Attacks 117

5.5 Cellular Network Threats 118

5.5.1 Cyber Threats 119

5.5.2 HPM‐Like Threats 120

5.5.3 Physical Threats 120

5.6 Analysis 120

5.7 Exercises 121

5.8 Discussions 122

References 122

6 Internet 123

6.1 The Internet Monoculture 125

6.1.1 The Original Sin 127

6.1.2 How TCP/IP Works 128

6.1.3 More Original Sin 130

6.2 Analyzing The Autonomous System Network 130

6.2.1 The AS500 Network 130

6.2.2 Countermeasures 132

6.3 The RFC Process 133

6.3.1 Emergence of Email 133

6.3.2 Emergence of TCP/IP 133

6.4 The Internet of Things (IOT) 134

6.4.1 Data Scraping 135

6.4.2 IoT Devices 135

6.4.3 More IoT Exploits 136

6.5 Commercialization 137

6.6 The World Wide Web 137

6.7 Internet Governance 138

6.7.1 IAB and IETF 138

6.7.2 ICANN Wars 140

6.7.3 ISOC 141

6.7.4 W3C 141

6.8 Internationalization 142

6.9 Regulation and Balkanization 142

6.10 Exercises 143

6.11 Discussions 144

7 Cyber Threats 145

7.1 Threat Surface 146

7.1.1 Script Kiddies 148

7.1.2 Black‐Hats 149

7.1.3 Weaponized Exploits 149

7.1.4 Ransomware and the NSA 150

7.2 Basic Vulnerabilities 151

7.2.1 The First Exploit 152

7.2.2 TCP/IP Flaws 153

7.2.3 Open Ports 154

7.2.4 Buffer Overflow Exploits 155

7.2.5 DDoS Attacks 155

7.2.6 Email Exploits 156

7.2.7 Flawed Application and System Software 157

7.2.8 Trojans, Worms, Viruses, and Keyloggers 158

7.2.9 Hacking the DNS 159

7.3 Botnets 159

7.3.1 Hardware Flaws 160

7.4 Cyber Risk Analysis 161

7.5 Cyber Infrastructure Risk 161

7.5.1 Blocking Node Analysis 163

7.5.2 Machine Learning Approach 165

7.5.3 Kill Chain Approach 165

7.6 Analysis 166

7.7 Exercises 166

7.8 Discussions 168

References 168

8 Information Technology (IT) 169

8.1 Principles of IT Security 171

8.2 Enterprise Systems 171

8.2.1 Loss of Service 172

8.2.2 Loss of Data 172

8.2.3 Loss of Security 172

8.3 Cyber Defense 173

8.3.1 Authenticate Users 173

8.3.2 Trusted Path 174

8.3.3 Inside the DMZ 175

8.4 Basics of Encryption 176

8.4.1 DES 177

8.4.2 3DES 177

8.4.3 AES 177

8.5 Asymmetric Encryption 177

8.5.1 Public Key Encryption 179

8.5.2 RSA Illustrated 180

8.5.3 Shor’s Algorithm 180

8.6 PKI 181

8.6.1 Definition of PKI 182

8.6.2 Certificates 182

8.6.3 Blockchain 183

8.6.4 FIDO and WebAuth 184

8.6.5 Mathematics of Passwords 184

8.7 Countermeasures 185

8.8 Exercises 187

8.9 Discussions 188

References 188

9 Hacking Social Networks 189

9.1 Web 2.0 and the Social Network 190

9.2 Social Networks Amplify Memes 193

9.3 Topology Matters 194

9.4 Computational Propaganda 194

9.5 The ECHO Chamber 197

9.6 Big Data Analytics 198

9.6.1 Algorithmic Bias 199

9.6.2 The Depths of Deep Learning 200

9.6.3 Data Brokers 200

9.7 GDPR 201

9.8 Social Network Resilience 202

9.9 The Regulated Web 203

9.9.1 The Century of Regulation 203

9.10 Exercises 204

9.11 Discussions 205

References 206

10 Supervisory Control and Data Acquisition 207

10.1 What is SCADA? 208

10.2 SCADA Versus Enterprise Computing Differences 209

10.3 Common Threats 210

10.4 Who is in Charge? 211

10.5 SCADA Everywhere 212

10.6 SCADA Risk Analysis 213

10.7 NIST‐CSF 216

10.8 SFPUC SCADA Redundancy 216

10.8.1 Redundancy as a Resiliency Mechanism 218

10.8.2 Risk Reduction and Resource Allocation 220

10.9 Industrial Control of Power Plants 221

10.9.1 Maximum PML 221

10.9.2 Recovery 221

10.9.3 Node Resilience 222

10.10 Analysis 225

10.11 Exercises 227

10.12 Discussions 228

11 Water and Water Treatment 229

11.1 From Germs to Terrorists 230

11.1.1 Safe Drinking Water Act 231

11.1.2 The WaterISAC 231

11.2 Foundations: SDWA of 1974 232

11.3 The Bioterrorism Act of 2002 232

11.3.1 Is Water for Drinking? 233

11.3.2 Climate Change and Rot: The New Threats 234

11.4 The Architecture of Water Systems 235

11.4.1 The Law of The River 235

11.5 The Hetch Hetchy Network 235

11.5.1 Bottleneck Analysis 236

11.6 Risk Analysis 238

11.6.1 Multidimensional Analysis 238

11.6.2 Blocking Nodes 239

11.7 Hetch Hetchy Investment Strategies 239

11.7.1 The Rational Actor Attacker 240

11.8 Hetch Hetchy Threat Analysis 242

11.8.1 Chem/Bio Threats 242

11.8.2 Earthquake Threats 244

11.8.3 Allocation to Harden Threat–Asset Pairs 244

11.9 Analysis 245

11.10 Exercises 246

11.11 Discussions 247

References 248

12 Energy 249

12.1 Energy Fundamentals 251

12.2 Regulatory Structure of the Energy Sector 252

12.2.1 Evolution of Energy Regulation 252

12.2.2 Other Regulations 253

12.2.3 The Energy ISAC 254

12.3 Interdependent Coal 254

12.3.1 Interdependency with Transportation 254

12.4 The Rise of Oil and the Automobile 255

12.4.1 Oil 255

12.4.2 Natural Gas 256

12.5 Energy Supply Chains 256

12.5.1 PADDs 257

12.5.2 Refineries 258

12.5.3 Transmission 258

12.5.4 Transport4 259

12.5.5 Storage 259

12.5.6 Natural Gas Supply Chains 259

12.5.7 SCADA 259

12.6 The Critical Gulf of Mexico Cluster 259

12.6.1 Refineries 260

12.6.2 Transmission Pipelines 260

12.6.3 Storage 262

12.7 Threat Analysis of the Gulf of Mexico Supply Chain 265

12.8 Network Analysis of the Gulf of Mexico Supply Chain 266

12.9 The Keystonexl Pipeline Controversy 267

12.10 The Natural Gas Supply Chain 268

12.11 Analysis 270

12.12 Exercises 270

12.13 Discussions 271

References 272

13 Electric Power 273

13.1 The Grid 274

13.2 From Death Rays to Vertical Integration 275

13.2.1 Early Regulation 276

13.2.2 Deregulation and EPACT 1992 278

13.2.3 Energy Sector ISAC 278

13.3 Out of Orders 888 and 889 Comes Chaos 279

13.3.1 Economics Versus Physics 280

13.3.2 Betweenness Increases SOC 281

13.4 The North American Grid 281

13.4.1 ACE and Kirchhoff’s Law 283

13.5 Anatomy of a Blackout 283

13.5.1 What Happened on August 14 285

13.6 Threat Analysis 286

13.6.1 Attack Scenario 1: Disruption of Fuel Supply to Power Plants 286

13.6.2 Attack Scenario 2: Destruction of Major Transformers 287

13.6.3 Attack Scenario 3: Disruption of SCADA Communications 287

13.6.4 Attack Scenario 4: Creation of a Cascading Transmission Failure 287

13.7 Risk Analysis 288

13.8 Analysis of WECC96 288

13.9 Analysis 291

13.10 Exercises 292

13.11 Discussions 294

References 294

14 Healthcare and Public Health 295

14.1 The Sector Plan 296

14.2 Roemer’s Model 297

14.2.1 Components of Roemer’s Model 298

14.3 The Complexity of Public Health 299

14.4 Risk Analysis of HPH Sector 300

14.5 Bioterrorism 300

14.5.1 Classification of Biological Agents 301

14.6 Epidemiology 303

14.6.1 The Kermack–McKendrick Model 303

14.6.2 SARS 304

14.7 Predicting Pandemics 304

14.7.1 The Levy Flight Theory of Pandemics 306

14.8 Bio‐Surveillance 307

14.8.1 HealthMap 307

14.8.2 Big Data 307

14.8.3 GeoSentinel 308

14.9 Network Pandemics 309

14.10 The World Travel Network 310

14.11 Exercises 312

14.12 Discussions 313

References 313

15 Transportation 314

15.1 Transportation Under Transformation 316

15.2 The Road to Prosperity 319

15.2.1 Economic Impact 319

15.2.2 The National Highway System (NHS) 319

15.2.3 The Interstate Highway Network Is Resilient 320

15.2.4 The NHS Is Safer 320

15.3 Rail 320

15.3.1 Birth of Regulation 322

15.3.2 Freight Trains 323

15.3.3 Passenger Rail 324

15.3.4 Commuter Rail Resiliency 324

15.4 Air 325

15.4.1 Resilience of the Hub‐and‐Spoke Network 326

15.4.2 Security of Commercial Air Travel 328

15.4.3 How Safe and Secure Is Flying in the United States? 329

15.5 Airport Games 330

15.5.1 GUARDS 330

15.5.2 Bayesian Belief Networks 331

15.6 Exercises 331

15.7 Discussions 332

References 332

16 Supply Chains 334

16.1 The World Is Flat, But Tilted 335

16.1.1 Supply‐Side Supply 336

16.1.2 The Father of Containerization 337

16.1.3 The Perils of Efficient Supply Chains 337

16.2 The World Trade Web 340

16.2.1 Economic Contagions 342

16.3 Risk Assessment 344

16.3.1 MSRAM 344

16.3.2 PROTECT 345

16.4 Analysis 346

16.5 Exercises 347

16.6 Discussions 347

References 348

17 Banking and Finance 349

17.1 The Financial System 351

17.1.1 Federal Reserve vs. US Treasury 352

17.1.2 Operating the System 353

17.1.3 Balancing the Balance Sheet 353

17.1.4 Paradox of Enrichment 354

17.2 Financial Networks 355

17.2.1 FedWire 355

17.2.2 TARGET 356

17.2.3 SWIFT 356

17.2.4 Credit Card Networks 356

17.2.5 3‐D Secure Payment 357

17.3 Virtual Currency 358

17.3.1 Intermediary PayPal 358

17.3.2 ApplePay 358

17.3.3 Cryptocurrency 359

17.4 Hacking The Financial Network 361

17.5 Hot Money 363

17.5.1 The Dutch Disease 364

17.6 The End of Stimulus? 364

17.7 Fractal Markets 365

17.7.1 Efficient Market Hypothesis (EMH) 366

17.7.2 Fractal Market Hypothesis (FMH) 366

17.7.3 Predicting Collapse 367

17.8 Exercises 369

17.9 Discussions 370

References 370

18 Strategies for a Networked Nation 371

18.1 Whole of Government 372

18.2 Risk and Resilience 373

18.3 Complex and Emergent CIKR 373

18.4 Communications and the Internet 374

18.5 Information Technology (IT) 375

18.6 Surveillance Capitalism 375

18.7 Industrial Control Systems 376

18.8 Energy and Power 376

18.9 Global Pandemics 377

18.10 Transportation and Supply Chains 377

18.11 Banking and Finance 378

18.12 Discussions 378

Appendix A: Math: Probability Primer 379

A.1 A Priori Probability 379

A.2 A Pori Probability 381

A.3 Random Networks 382

A.4 Conditional Probability 383

A.5 Bayesian Networks 384

A.6 Bayesian Reasoning 385

References 387

Amazon no longer offers textbook rentals. We do!

Critical Infrastructure Protection in Homeland Security

Critical Infrastructure Protection in Homeland Security

1119614538

Summary

Author Biography

Table of Contents

Supplemental Materials