Chapter 24 — Critical infrastructure and sector security: methods I

Chapter 24 — Critical infrastructure and sector security: methods I

Lesson map

Lesson 24 published. Map, example, EX047.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["24.1 Matching method to question"]
  N2["24.2 Structured risk assessment"]
  N3["24.3 Simulation with verification and validation"]
  N4["24.4 Exercises with people"]
  N5["24.6 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX047"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["24.1 Matching method to question"]
  N2["24.2 Structured risk assessment"]
  N3["24.3 Simulation with verification and validation"]
  N4["24.4 Exercises with people"]
  N5["24.6 Practical activity"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX047"]

[Learning outcomes and connection]
    |
    v
[24.1 Matching method to question]
    |
    v
[24.2 Structured risk assessment]
    |
    v
[24.3 Simulation with verification and validation]
    |
    v
[24.4 Exercises with people]
    |
    v
[24.6 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX047]

Learning outcomes and connection

After this chapter you can (1) select analysis methods appropriate to a design question — risk assessment, STPA, simulation, testbed experiment, tabletop exercise; (2) run a structured risk assessment and document it reproducibly; (3) plan a simulation study with explicit verification and validation; and (4) choose evidence proportionate to the decision. It builds on Chapters 15, 21 and 23 and prepares the design studio (Chapter 25).

24.1 Matching method to question

Engineering projects use several; a common mistake is using one method to answer another's question — for example, a tabletop exercise "showing" that a restoration time is achievable.

24.2 Structured risk assessment

A reproducible assessment documents: scope and assumptions; system model version; threat sources and their assumed capabilities; scenarios (threat event → vulnerability → consequence); existing controls; likelihood and consequence scales with definitions; ratings with rationale; and recommended controls. Scales must be defined in the organisation's terms (people-hours without water, not "high"). Ratings without rationale are opinions; with rationale, they can be challenged and improved.

TMRP's scales use people-hours without water at the hospital and other customers, so ratings mean the same thing to operators and managers.

24.3 Simulation with verification and validation

Verification asks whether the model is implemented correctly (does the code do what the model says?); validation asks whether the model represents reality well enough for its purpose. Sargent (2013) describes techniques: comparison with analytic results (Lab 1's Euler versus exact), extreme-condition tests, comparison with historical data, face validity with operators, and sensitivity analysis. State the model's intended use; a model valid for hold-up estimation may be invalid for transient pressure analysis.

For TMRP, the hold-up model is validated against a historical planned outage before it is used for the combined grid and telemetry scenario.

24.4 Exercises with people

Tabletop exercises walk a team through a scenario to test plans, roles and decisions; functional exercises perform some actions for real. Design them with objectives, injects, observers and an after-action report that records gaps without blame. They show whether people know what to do and where plans are ambiguous; they do not measure equipment performance.

TMRP's night functional exercise of local manual mode at PS3 and PS4 is the example: it uses real night staffing, records the time taken to establish manual operation, and reports the gaps it finds, but it cannot show whether the pumps or gateways meet their own requirements.

24.5 Worked example: choosing methods for TMRP (synthetic)

TMRP has four open questions: (1) which scenarios deserve funding — risk assessment with consequence scales in people-hours; (2) whether operators can switch PS3/PS4 to local manual within 1 h — a functional exercise at night with real staffing; (3) whether the gateway rejects forged and replayed frames — testbed tests T1–T2; (4) whether the reservoir lasts long enough during a combined grid and telemetry outage — Lab 1-style simulation validated against a historical planned outage. The plan names each method's evidence and its limit, so nobody later cites the tabletop as proof of R6.

24.6 Practical activity

Run a 45-minute tabletop with two classmates on the scenario "SCADA servers encrypted at 02:00", using the TMRP requirement set. Record decisions, times and gaps in an after-action report.

Assign roles before you start: the night operator, the duty manager and a facilitator who delivers injects. Use TMRP's requirements as the yardstick, especially local manual operation within one hour and restoration of remote operation within eight. Record each decision with its time and who made it. The after-action report should list what the plan did not cover, without naming anyone as the cause, and should state that a tabletop cannot show whether the eight-hour restoration is achievable.

24.7 Common errors and limits

• One method stretched to answer all questions.
• Undefined likelihood and consequence scales.
• Simulation presented without V&V or intended use.
• Exercise reports that blame individuals or record only successes.
• Evidence disproportionate to the decision (too little for safety-critical, too much for trivial).

TMRP's method plan guards against the first error by naming each method's limit, so a tabletop is never cited as proof that R6 is met. Its likelihood and consequence scales are defined in people-hours, and the hold-up simulation states its intended use.

Exercises — chapter 24

EX047 — Method match. Objective: select methods. Inputs: four questions: (a) would forged setpoints at PS4 cause overpressure? (b) does the vendor's anomaly detector find Modbus write floods? (c) can the duty manager authorise local manual mode at night? (d) what is the annual risk ranking of eight scenarios? Steps: choose a method for each, its evidence and its main limit. Expected evidence: table. Rubric: 3 = (a) simulation/hydraulic analysis plus STPA, (b) testbed experiment, (c) exercise, (d) risk assessment, with honest limits; 2 = one mismatch; 1 = one method for all; 0 = none.

EX048 — Validate a model. Objective: plan V&V. Inputs: Lab 1 model. Steps: propose three verification checks and three validation checks, including one with historical data, and state the model's intended use and one use for which it is invalid. Expected evidence: list. Rubric: 3 = verification and validation distinct, historical comparison specified, invalid use identified (e.g., pressure transients, water quality); 2 = V and V mixed; 1 = vague; 0 = none.

Chapter synthesis

Match each question to a method that can answer it and know each method's limit. Make risk assessments reproducible with defined scales and rationale; verify and validate simulations for a stated purpose; use exercises to test people and plans, not equipment; and scale the evidence to the decision it supports.

Continue studying — chapter 24 of 50

← Chapter 23 · Course chapter index · Chapter 25 →

Continue to the next authored lesson.