Chapter 32 — Critical infrastructure and sector security: interdisciplinary interfaces
Lesson map
Lesson 32 published. Map, example, EX063.
flowchart TD
N0["Learning outcomes and connection"]
N1["32.1 Law and regulation"]
N2["32.2 Economics and incentives"]
N3["32.3 Safety engineering and human factors"]
N4["32.4 Communication"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX063"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["32.1 Law and regulation"]
N2["32.2 Economics and incentives"]
N3["32.3 Safety engineering and human factors"]
N4["32.4 Communication"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX063"]
[Learning outcomes and connection]
|
v
[32.1 Law and regulation]
|
v
[32.2 Economics and incentives]
|
v
[32.3 Safety engineering and human factors]
|
v
[32.4 Communication]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX063]
Learning outcomes and connection
After this chapter you can (1) explain how law and regulation, economics, safety engineering, human factors and public communication shape security decisions in critical services; (2) translate a technical finding for lawyers, finance officers, clinicians, engineers and the public; (3) recognise when a security problem is really an incentive or organisational problem; and (4) work across disciplines without overstepping your expertise. It builds on Chapters 10, 14, 19 and 28–31 and prepares the field practice (Chapter 36) and capstone.
32.1 Law and regulation
Critical services are regulated. Examples consulted for this book: the EU's NIS2 Directive sets risk-management and incident-reporting obligations for essential and important entities (NIS2); DORA sets ICT-risk requirements for financial entities (DORA); in North America, NERC's Critical Infrastructure Protection standards apply to the bulk electric system (NERC CIP); in the US water sector, America's Water Infrastructure Act of 2018 required risk and resilience assessments and emergency response plans from community water systems above a size threshold (EPA, AWIA). As a security professional you need to know that such obligations exist, where to find the current text, and when to involve legal counsel — not to interpret them alone. Compliance is a floor: meeting a standard does not prove the service is resilient.
32.2 Economics and incentives
Much infrastructure is privately operated, but its failure harms people who are not its customers — an externality. Investments that protect against rare events compete with visible, near-term costs, and the benefit (an outage that did not happen) is invisible. Regulation, insurance, procurement requirements and public reporting are ways of changing incentives. Recognising an incentive problem prevents a common mistake: proposing a technically excellent control that no budget holder has a reason to fund. Chapter 1's expected-loss and worst-credible-event framing is the bridge to a finance audience.
32.3 Safety engineering and human factors
Safety engineers have long practice in analysing hazards, independent protection layers and management of change (Chapters 26 and 28). Security and safety can conflict — an account lockout that blocks an operator in an emergency; a patch that invalidates a safety certification — and must be reconciled jointly. Human-factors specialists study how people actually work: alarm floods, fatigue on night shifts, workarounds when procedures do not fit reality. Reason's work shows errors as consequences of system design (Reason, 2000). A control that operators cannot use under stress will be bypassed (Saltzer and Schroeder's psychological acceptability).
32.4 Communication
Different audiences need different translations of the same finding. Clinicians need to know the effect on patient care and what to do differently. Engineers need the technical mechanism and constraints. Finance needs costs, avoided losses and options. Lawyers need facts, dates and obligations triggered. The public needs honest, timely information on the service and on what they should do — without details that help attackers. Agreed spokespeople and pre-approved message templates are part of incident preparation (Chapter 30's journalist inject).
CVH's BMS finding is translated this way below: a ventilation check for the theatre lead, VLAN and interlock details for estates, about £25,000 against cancelled surgery for finance, and a no-obligation statement for legal.
32.5 Worked example: one finding, four audiences (synthetic)
This case is synthetic. Finding: CVH's theatre ventilation can be changed from the BMS, which is reachable from the corporate network with password-only authentication.
- Theatre lead: "A misuse of the building system could reduce theatre air changes. Until we fix it, estates will check ventilation readings at the start of each list and you should report any alarm immediately."
- Estates engineer: "BMS admin interface reachable from corporate VLAN; password-only. Proposal: allowlist to two estates workstations, MFA, hard-wired minimum airflow interlock."
- Finance: "Cost about £25,000 one-off; it addresses a scenario whose worst credible outcome is cancelled surgery for several days. Alternatives and their costs are attached."
- Data protection and legal: "No personal data involved; no reporting obligation triggered by the finding itself; we will reassess if exploitation is detected."
32.6 Common errors and limits
- Giving legal opinions without counsel.
- Proposing controls without a funding argument.
- Ignoring safety or clinical consequences of security controls.
- One message for all audiences.
The worked example avoids each: the legal message says what was checked and when it will be reassessed; the finance message gives a cost and its worst credible outcome; the theatre message names the clinical check; and four audiences receive four messages. A single technical email to all would have failed the theatre lead and finance.
Exercises — chapter 32
EX063 — Translate for the board. Objective: communicate across disciplines. Inputs: the Lab 11 result (cyber path roughly doubles the probability of losing critical power in the synthetic model). Steps: write a 120-word note to CVH's board with the finding, the proposed engineering fix, the cost framing and the limits of the model. Expected evidence: note. Rubric: 3 = plain language, consequence for patients, fix restores independence, honest about synthetic numbers and adversary non-randomness; 2 = partial; 1 = jargon; 0 = none.
EX064 — Safety–security conflict. Objective: reconcile duties. Inputs: a policy to lock HMI accounts after five failed logins. Steps: explain the safety risk, and propose an alternative meeting the security purpose. Expected evidence: explanation and alternative. Rubric: 3 = operator locked out during an emergency; alternatives such as physical-access-controlled console with monitoring, rate limiting without lockout, alerting on failures, emergency override with audit; 2 = one; 1 = vague; 0 = none.
Chapter synthesis
Security in critical services sits among law, economics, safety, human factors and communication. Know where obligations live and when to call counsel, recognise incentive problems, reconcile safety and security jointly, design for people under stress and translate each finding for the audience who must act on it.
Continue studying — chapter 32 of 40
← Chapter 31 · Course chapter index · Chapter 33 →
Continue to the next authored lesson.