Chapter 2 — Critical infrastructure and sector security: research frontier

Chapter 2 — Critical infrastructure and sector security: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["2.1 Why the literature is hard to find"]
  N2["2.2 Systematic scoping across disciplines"]
  N3["2.3 The policy and standards landscape as a research"]
  N4["2.4 Interdependency modelling families"]
  N5["2.5 Detection and testbed research: evaluation as a"]
  N6["2.6 Sector-specific and threat evidence"]
  N7["2.7 Classifying the gap"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["2.1 Why the literature is hard to find"]
  N2["2.2 Systematic scoping across disciplines"]
  N3["2.3 The policy and standards landscape as a research"]
  N4["2.4 Interdependency modelling families"]
  N5["2.5 Detection and testbed research: evaluation as a"]
  N6["2.6 Sector-specific and threat evidence"]
  N7["2.7 Classifying the gap"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX008"]

[Learning outcomes and connection]
    |
    v
[2.1 Why the literature is hard to find]
    |
    v
[2.2 Systematic scoping across disciplines]
    |
    v
[2.3 The policy and standards landscape as a research]
    |
    v
[2.4 Interdependency modelling families]
    |
    v
[2.5 Detection and testbed research: evaluation as a]
    |
    v
[2.6 Sector-specific and threat evidence]
    |
    v
[2.7 Classifying the gap]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes and connection

By the end of this chapter the learner will be able to:

1. Search the scattered literature on infrastructure security and resilience across engineering, operations research, economics, policy and computer security with a documented, repeatable protocol.
2. Explain the main families of interdependency models, what each assumes and what kind of claim each can support.
3. Read standards and regulations — NIST CSF 2.0, NIST SP 800-82, IEC 62443, NERC CIP, NIS2, CER and sector guidance — as research objects whose effectiveness is itself an open question.
4. Appraise detection and testbed research for the evaluation pitfalls documented in the security and time-series literature.
5. Classify an evidence gap (absent, weak, conflicting, untransferred) and convert a topic into a falsifiable contribution statement.

Chapter 1 supplied the claim ladder and the evidence sources; this chapter uses them to read the field. Chapter 3 will turn the gap chosen here into a contribution proposal.

2.1 Why the literature is hard to find

A doctoral candidate in infrastructure security inherits at least five literatures that rarely cite each other:

Dedicated venues such as the International Journal of Critical Infrastructure Protection and the CRITIS conference series bridge some of these, but a search confined to security venues will miss most restoration and interdependency work, and a search confined to engineering will miss threat-informed work. Rinaldi, Peerenboom and Kelly's framework (2001) is the most common shared ancestor and a good seed for citation chaining in both directions.

2.2 Systematic scoping across disciplines

2.2.1 Choosing the review type

A systematic review answers a focused question with an exhaustive search and formal appraisal; a scoping review maps the extent and nature of a body of work; a narrative review is an expert synthesis without a reproducible search. For a doctoral frontier chapter, a scoping review with a documented protocol is usually right: it is reproducible, it shows the shape of the field and it identifies where a systematic review would be premature. Report it using the relevant items of PRISMA 2020 — search sources, dates, strings, screening, reasons for exclusion and a flow diagram — even where the full checklist does not apply.

2.2.2 A search protocol for the Cascade Study

1. Question. What is known about the effect of restoration ordering, informed by cross-sector dependencies, on the consequences of infrastructure outages, including cyber-induced outages?
2. Concept blocks. (restoration OR recovery OR "service restoration" OR prioritization) AND (interdependen* OR dependen* OR cascad*) AND (infrastructure OR utility OR "distribution system" OR "lifeline").
3. Sources. At least one engineering index, one general scholarly index and one policy source (government reports, after-action reports), plus backward and forward citation chaining from two seed papers.
4. Eligibility. Studies that compare at least two restoration orderings or that quantify dependency-driven consequence; exclude purely topological vulnerability rankings that do not model service.
5. Screening. Two screeners on a sample of titles and abstracts with agreement measured before splitting the work; disagreements resolved by discussion and logged.
6. Coding frame. Model family; validation type (none, face, historical, field); data source; whether the authors also built the testbed or model they evaluate; outcome metric; hazard type (natural, accidental, cyber); comparison baseline.
7. Stopping rule. Stop chaining when two consecutive rounds add no eligible study.

2.2.3 Appraisal for models and simulations

Clinical appraisal tools fit poorly. For model-based papers, appraise: Is the model's structure justified by the mechanism it represents? Are parameters sourced? Was the implementation verified (does the code do what the paper says)? Was the model validated, and against what — face validity, historical events, field data (Sargent, 2013)? Is there a sensitivity analysis? Is the comparison baseline strong? Are code and inputs available? A model paper that cannot answer the verification and validation questions supports at most a claim about the model, not about infrastructure.

2.3 The policy and standards landscape as a research object

Standards and regulations are not only background; whether they work is one of the field's biggest open questions. The current landscape (verify versions before citing):

• NIST Cybersecurity Framework 2.0 (CSWP 29, February 2024) added a Govern function to Identify, Protect, Detect, Respond and Recover. It is outcome-based and voluntary in most sectors; research question: do organizations that adopt it experience fewer or less consequential disruptions, and how would one know?
• NIST SP 800-82 Rev. 3 (September 2023) broadened scope from industrial control systems to operational technology and added an OT overlay for SP 800-53 Rev. 5 controls. An initial public draft of Rev. 4 was released in September 2026 (CSRC).
• ISA/IEC 62443 is a series of standards for industrial automation and control system security. Part 3-2 defines the system under consideration, partitions it into zones and conduits, assesses risk and assigns a target security level (SL-T); Part 3-3 states system requirements under seven foundational requirements — identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability (IEC 62443-3-2 catalogue page). Research question: does an assigned SL-T predict resistance to realistic adversaries, and how can achieved security levels be measured rather than asserted?
• NERC CIP reliability standards are mandatory for the North American bulk electric system. In June 2025 FERC approved CIP-015-1 on internal network security monitoring (Order No. 907), with implementation phased over years (NERC standard page). A mandatory standard with a phased rollout is a natural experiment — if researchers can obtain outcome data, which is rarely the case.
• EU NIS2 and CER (both 2022) impose risk-management and reporting obligations on essential and important entities and resilience obligations on critical entities; national transposition varies, which creates cross-country variation of research interest.
• Finance. The CPMI–IOSCO Guidance on cyber resilience for financial market infrastructures (June 2016) supplements the Principles for Financial Market Infrastructures; it is the source of the widely discussed expectation that critical operations be designed to resume quickly after a disruption, which creates a tension between speed of resumption and integrity of data — a research problem with no settled answer.
• Consequence-driven Cyber-informed Engineering (CCE), developed at Idaho National Laboratory, proceeds through four phases — consequence prioritization, system-of-systems analysis, consequence-based targeting, and mitigations and protections (INL CCE page; Bochman and Freeman, 2021). It starts from consequences rather than vulnerabilities, which aligns with this book's emphasis; whether it yields better mitigation choices than vulnerability-driven methods has, to the author's knowledge, not been tested with comparative designs.

The common research gap across the landscape is outcome evidence: the frameworks are justified by expert consensus and incident lessons, but comparative studies linking their adoption to consequences are rare, because outcome data are rare, protected and confounded by organizational maturity.

2.4 Interdependency modelling families

Ouyang (2014) reviewed modelling and simulation of interdependent infrastructure systems and grouped approaches into empirical, agent-based, system-dynamics-based, economic-theory-based, network-based and other approaches. Each family supports a different kind of claim.

Topological cascades. Buldyrev et al. (2010) showed in a percolation model of two interdependent networks that the coupling can produce abrupt, catastrophic collapse and that, unlike in single networks, broader degree distributions can increase vulnerability to random failure. The result is a landmark for structural insight. It is also a frequent source of overclaiming: the model assumes all-or-nothing dependence, no buffers, no restoration and specific coupling patterns. Citing it as evidence that a particular city's power and communications will collapse abruptly is a category error — L5 structural insight presented as an L4 consequence claim.

Input–output inoperability. The inoperability input–output model (IIM) writes the equilibrium inoperability vector q as q = A*q + c*, so q = (I − A*)⁻¹ c*, where A* holds interdependency coefficients and c* an initial perturbation. Chapter 4 replicates an IIM calculation and shows how a matrix-convention error silently changes results.

Where buffers live. A theme across families is that consequence timing is governed by buffers — generator fuel, battery autonomy, storage, inventory, manual procedures — that topology ignores and that flow models often hold constant. Restoration research in power engineering does model sequencing, but frequently within one sector and with the objective of customers or load restored. The Cascade Study sits in this seam: cross-sector buffer timing as the driver of restoration ordering.

2.5 Detection and testbed research: evaluation as a frontier

Much of the security-side literature studies attack detection in industrial processes. Its problems are increasingly well documented:

• Closed-world evaluation. Sommer and Paxson (2010) argued that machine-learning intrusion detection is poorly matched to the open, shifting world of real networks, and that evaluations often fail to capture the cost of errors and the semantic gap between an anomaly and an attack.
• Pitfalls in ML security research. Arp et al. (2022) identified ten pitfalls — among them sampling bias, data snooping, spurious correlations, inappropriate baselines and metrics, the base-rate fallacy, lab-only evaluation and inappropriate threat models — and found several in each of 30 top-venue papers they reviewed.
• Inflated time-series metrics. Kim et al. (2022) showed that the point adjustment protocol common in time-series anomaly detection, which marks a whole anomalous segment as detected if any point in it is flagged, can make even random scores look state-of-the-art; they proposed PA%K. Chapter 4 reproduces the effect.
• Small, old, author-built testbeds. Public datasets from testbeds such as SWaT (Goh et al., 2016) and the BATADAL water-distribution competition (Taormina et al., 2018) enabled comparison, which is a major contribution. They also concentrate the field on a few systems with specific attack sets; results transfer to other plants only by argument.

For a CI thesis, detection is relevant mainly as a buffer against consequence: detection that arrives after a service's buffer is exhausted changes nothing for the people served. Framing detection by time-to-consequence rather than by F1 is an under-explored bridge between the two literatures.

2.6 Sector-specific and threat evidence

• Energy. The 2015 Ukrainian distribution attack, documented by E-ISAC and SANS, is the most cited public case of a cyber attack causing customer outages; it is also one case, with restoration achieved through manual operation.
• Water. Water systems are numerous, often small and under-resourced, which makes sector-wide evidence hard to collect; much quantitative work uses simulated distribution networks such as BATADAL's.
• Healthcare. Neprash et al. (2022) documented a rising number of ransomware attacks on U.S. health care delivery organizations from 2016 to 2021 and their effects on operations; such work connects a cyber event to care delivery — the consequence rung — using public and regulatory data.
• Threat model shift. CISA's joint advisory AA24-038A (February 2024) assessed that a state-sponsored actor known as Volt Typhoon pre-positioned in IT networks of communications, energy, transportation and water organizations to enable potential disruption, using valid accounts and living-off-the-land techniques. For research, pre-positioning means that the relevant scenario is simultaneous, multi-sector, adversary-timed disruption — exactly where single-sector restoration rules may fail.
• Cyber-physical precedent. Langner's 2013 analysis of Stuxnet is a classic account of a cyber-physical attack designed around process knowledge. Its lesson for CI research is that consequential attacks are engineered against physical processes and their safety margins, which is why consequence-first methods such as CCE exist.

2.7 Classifying the gap

The IR doctoral book distinguishes four kinds of evidence gap; they apply here unchanged:

2.8 Worked example: appraising the restoration-ordering literature (synthetic)

The Cascade Study's scoping review (synthetic) found eight eligible papers, P1–P8:

Appraisal: C1 has only self-validated topological evidence — it is weak. C2 has two independent historical validations — the strongest claim in the set, though about economic loss, not service. C3 has three studies but only one that is independent and strongly validated; P4 and P5 were evaluated in the authors' own models, which invites model–policy circularity (Chapter 6). C4 rests on one empirical study. The frontier is therefore C3: plausible, repeatedly proposed, weakly tested.

2.9 Practical activity: code the literature map

# Lab 2 - coding a synthetic literature map for interdependency-modelling claims (offline)
# Fields: id, model family, validation, independent of authors' own testbed?, claim supported
studies = [
    ("P1", "network-topology", "none",       False, "C1"),
    ("P2", "network-topology", "face",       False, "C1"),
    ("P3", "input-output",     "historical", True,  "C2"),
    ("P4", "agent-based",      "face",       False, "C3"),
    ("P5", "co-simulation",    "historical", False, "C3"),
    ("P6", "input-output",     "historical", True,  "C2"),
    ("P7", "co-simulation",    "field",      True,  "C3"),
    ("P8", "empirical",        "field",      True,  "C4"),
]
claims = {
    "C1": "Topological centrality identifies the assets whose loss causes the largest service cascade",
    "C2": "Input-output inoperability ranks sectors by economic loss after a regional outage",
    "C3": "Dependency-aware restoration lowers critical-service loss compared with siloed restoration",
    "C4": "Backup-power duration is the dominant buffer controlling cascade timing",
}
STRONG = {"historical", "field"}
for cid, text in claims.items():
    rows = [s for s in studies if s[4] == cid]
    strong_indep = [s[0] for s in rows if s[2] in STRONG and s[3]]
    if len(strong_indep) >= 2:
        state = "supported (>=2 independent strong validations)"
    elif strong_indep:
        state = "single-source; needs replication"
    else:
        state = "open: no independent strong validation"
    print(f"{cid}: {state}; evidence={[s[0] for s in rows]}; strong+independent={strong_indep}")

Expected output:

C1: open: no independent strong validation; evidence=['P1', 'P2']; strong+independent=[]
C2: supported (>=2 independent strong validations); evidence=['P3', 'P6']; strong+independent=['P3', 'P6']
C3: single-source; needs replication; evidence=['P4', 'P5', 'P7']; strong+independent=['P7']
C4: single-source; needs replication; evidence=['P8']; strong+independent=['P8']

Record exact output in your reproduction log, not a paraphrase.

The rule encoded in STRONG and in the independence flag is a choice. Changing it changes which claims are "supported". A literature map must publish its coding rule so readers can disagree with it explicitly.

Two checks are worth making before trusting the map. First, run it with the independence flag removed: C3 then counts P5 as a strong validation and is reported as supported, which shows how much of the verdict rests on that one coding decision. Second, have a second coder classify validation and independence for all eight papers without seeing the first coder's sheet, and record where they disagree. Disagreement over whether a utility exercise counts as field validation, as in P7, is a finding about the coding frame, and the frame should be tightened before the map is used to choose a gap.

2.10 From map to frontier: the contribution test

A gap becomes a doctoral contribution when it passes four tests: Open — the documented search shows it is not already answered; Important — an answer would change a decision someone actually makes (here, restoration ordering in emergency operations); Feasible — data, models, partners and ethics allow it within the program; Falsifiable — a stated observation would show the claim wrong. Drafting format: "In [population/context], [intervention] compared with [strongest baseline] will change [primary metric] by at least [smallest effect of interest] without worsening [safety metric] beyond [margin]; this will be refuted if [observation]."

The Cascade Study's statement (to be refined in Chapter 3): In distribution outages requiring sequential manual feeder restoration, ordering by critical-service time-to-impact, compared with ordering by customers restored, reduces predeclared weighted critical-service loss by at least 20%, while increasing customer-hours lost by no more than 15%; this is refuted if the reduction is below 20% in an independently built model of a second region, or if operators in a blinded tabletop do not choose the ordering when given the same information.

2.11 Common errors and limits

• Searching only security venues and declaring a gap that engineering has already filled.
• Citing percolation results as consequence predictions for specific places.
• Treating standards as evidence of effectiveness rather than as hypotheses about it.
• Comparing detection papers by headline F1 without checking the evaluation protocol.
• Counting studies instead of appraising their independence and validation.

• Writing a gap as a topic ("interdependencies in smart cities") instead of a falsifiable statement.

• Treating a dedicated venue such as the CRITIS series as covering the whole field, when most restoration work appears in engineering and operations-research outlets.

• Reading a framework's widespread adoption as outcome evidence; adoption shows that people chose it, not that consequences fell.
• Coding a paper as independent because its authors differ from the proposers, without checking whether it reuses the proposers' model or testbed.
• Stopping citation chaining early because the first rounds confirmed the expected gap.

Exercises — chapter 2

EX008 — Search protocol. Objective: write a reproducible cross-disciplinary search. Inputs: a question of your choice about infrastructure security or resilience. Constraints: at least three source types (engineering index, general index, policy source); citation chaining. Steps: (1) state the question; (2) build concept blocks and strings; (3) define eligibility and exclusion reasons; (4) define screening, agreement and stopping rule. Expected evidence: protocol (≤ 2 pages). Rubric: 3 = repeatable, cross-disciplinary, agreement measured, stopping rule explicit; 2 = one element vague; 1 = keyword list only; 0 = none.

EX009 — Model-paper appraisal. Objective: appraise a simulation paper for the claim it can support. Inputs: synthetic study P5 (co-simulation, historical validation, authors' own model). Constraints: use §2.2.3. Steps: list what you would check for structure, parameters, verification, validation, sensitivity, baseline and availability; state the strongest claim P5 can support and its rung. Expected evidence: appraisal form and one-sentence claim. Rubric: 3 = identifies self-built model, unknown verification, single historical event and baseline strength as decisive, claim limited to the model; 2 = one issue missed; 1 = accepts claim as L5; 0 = none.

EX010 — Model-family fit. Objective: match questions to modelling families. Inputs: four questions: (a) Which sectors lose most output after a week-long regional power loss? (b) How long until a hospital loses water pressure after a feeder outage? (c) Do operators share fuel informally between utilities during long outages? (d) Is a two-network system with random coupling prone to abrupt collapse? Constraints: one primary family per question, with a reason and a limit. Steps: (1) restate what each question asks you to predict or explain; (2) choose the primary modelling family from §2.4; (3) justify the choice by the claim it supports; (4) name the family's most important limit for that question. Expected evidence: table. Rubric: 3 = (a) input–output, (b) flow/co-simulation or buffer model, (c) empirical/qualitative or agent-based informed by interviews, (d) topology/percolation, each with sound limits; 2 = one mismatch; 1 = two or more; 0 = none.

EX011 — Standard as hypothesis. Objective: turn a standard into a testable claim. Inputs: IEC 62443-3-2 zones, conduits and SL-T (§2.3). Constraints: one testable hypothesis; name the outcome measure and a feasible design. Steps: state the implicit causal claim of the standard; write a hypothesis; propose a design (e.g., red-team exercises on testbed zones at different SL-T); name two confounders. Expected evidence: one page. Rubric: 3 = hypothesis observable, design safe and feasible, confounders real (assessor skill, asset age); 2 = design vague; 1 = restates the standard; 0 = none.

EX012 — Repair the literature map. Objective: make a coding rule match a stated standard. Inputs: Lab 2. Constraints: offline; keep all rows. Steps: (1) add a hazard field (P5 and P7 "cyber", all others "all-hazards"); (2) change the rule so that a claim about cyber-induced outages is supported only by independent strong validations with hazard "cyber"; (3) run and record exact output for C3; (4) explain in 100 words what changed and why it matters. Expected evidence: modified code, exact output, explanation. Rubric: 3 = correct code; C3 remains single-source (P7 only), and the learner notes that C1, C2 and C4 now have no strong independent support for cyber-induced outages, with a clear explanation of hazard transfer; 2 = output correct, explanation thin; 1 = rule wrong; 0 = not run.

EX013 — Classify the gap. Objective: distinguish gap types. Inputs: four synthetic statements: (a) "Two flow-model studies disagree on whether water storage or generator fuel dominates hospital outage timing"; (b) "Hospital surge-capacity research exists, but no study links it to restoration ordering"; (c) "Three vendor white papers claim their platform halves restoration time"; (d) "No study in our documented search compares CCE with vulnerability-driven prioritization." Constraints: one type each, justified; propose the next study. Steps: (1) restate each as a question; (2) list the evidence for it; (3) assign one gap type; (4) name the study that would close it. Expected evidence: four paragraphs. Rubric: 3 = conflicting, untransferred, weak, absent with sound next steps; 2 = one error; 1 = two errors; 0 = none.

EX014 — Falsifiable statement and frontier memo. Objective: convert a topic into a contribution. Inputs: the topic "resilience of payment systems during regional power outages". Constraints: use the drafting format in §2.10; the refuting observation must be feasible; 400–600 words; cite only sources you have read. Steps: (1) write the statement; (2) apply the four tests; (3) revise once; (4) explain which adjacent question must be answered first and why. Expected evidence: statement, test notes, revision, memo. Rubric: 3 = passes all tests with a feasible refuter and a justified ordering of questions; 2 = one test weak; 1 = still a topic; 0 = none.

Chapter synthesis

The infrastructure-security frontier is spread across five literatures with different vocabularies; a doctoral search must cross them deliberately and document how. Standards and regulations are hypotheses about what reduces consequence, and outcome evidence for them is scarce. Interdependency models come in families that support different claims; topological results give structural insight, input–output models give sector-level economics, and flow or co-simulation models give engineering timing — none substitutes for validation. Detection research is improving its evaluation practice; for CI, detection matters as a buffer measured against time-to-consequence. Appraise independence and validation, not counts. The Cascade Study's gap — dependency-aware restoration ordering is often proposed and weakly tested — is open, important, feasible and can be made falsifiable.

Continue studying — chapter 02 of 08

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.