Chapter 1 — Critical infrastructure and sector security: foundations and decisions

Chapter 1 — Critical infrastructure and sector security: foundations and decisions

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["1.1 What makes a service critical"]
  N2["1.2 Consequence first"]
  N3["1.3 Three public incidents, briefly"]
  N4["1.4 Writing a risk sentence"]
  N5["Visual 1 — a risk statement that leads to a decision"]
  N6["1.5 The newcomer's three decisions"]
  N7["1.7 Practical activity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["1.1 What makes a service critical"]
  N2["1.2 Consequence first"]
  N3["1.3 Three public incidents, briefly"]
  N4["1.4 Writing a risk sentence"]
  N5["Visual 1 — a risk statement that leads to a decision"]
  N6["1.5 The newcomer's three decisions"]
  N7["1.7 Practical activity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes and connection]
    |
    v
[1.1 What makes a service critical]
    |
    v
[1.2 Consequence first]
    |
    v
[1.3 Three public incidents, briefly]
    |
    v
[1.4 Writing a risk sentence]
    |
    v
[Visual 1 — a risk statement that leads to a decision]
    |
    v
[1.5 The newcomer's three decisions]
    |
    v
[1.7 Practical activity]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes and connection

After this chapter you will be able to:

• explain in your own words what critical infrastructure and an essential service are, and name several sectors;
• explain why, in these services, safety and availability usually come before confidentiality;
• describe, at a high level, three public incidents and what each teaches;
• write one clear risk sentence with a cause, an event and a consequence;
• choose sensibly among the three decisions every newcomer faces: notice, report, or leave it to the owner.

The chapter builds on everyday digital literacy. It prepares Chapter 2, which sets the boundaries of what you may do with that understanding.

1.1 What makes a service "critical"

Most people meet critical infrastructure only when it stops: the tap runs dry, the lights go out, the card machine says "declined", the bus does not come. Critical infrastructure is the set of systems, assets and services whose disruption would seriously harm a society's safety, health, economy or public order. An essential service is one of the things that infrastructure delivers to people: clean water, electricity, emergency care, payments, transport.

Governments list these sectors so that they can plan for them. The United States, for example, recognizes sixteen critical-infrastructure sectors, including energy, water and wastewater, healthcare and public health, transportation, financial services, communications and emergency services (CISA, Critical Infrastructure Sectors). The European Union's NIS2 Directive places duties on "essential" and "important" entities in sectors such as energy, transport, banking, health, drinking water and digital infrastructure (Directive (EU) 2022/2555). Lists differ between countries, but the idea is the same: some services matter so much that their failure is everyone's problem.

A second useful idea is the function rather than the organization. CISA describes a set of National Critical Functions — such as "supply water" or "provide medical care" — grouped under four verbs: connect, distribute, manage and supply (CISA, National Critical Functions Set). Thinking in functions helps a newcomer ask the right question: not "what does my employer own?" but "what does my workplace do for people, and what happens to them if it stops?"

1.2 Consequence first

In an ordinary office, the classic worry is that information is stolen. In an essential service, the first worry is usually that people are harmed or that the service stops. A helpful order of concern for this course is:

This is an order for thinking about harm, not a rule that confidentiality does not matter. A leak of patient records is serious and may carry legal duties to tell people quickly. The point is that a newcomer who only thinks about passwords and data will miss the risks that matter most in these sectors. The NIST Cybersecurity Framework 2.0, a widely used high-level guide, organizes security outcomes into six functions — Govern, Identify, Protect, Detect, Respond and Recover — precisely because keeping a service running and bringing it back matter as much as keeping data secret (NIST CSF 2.0).

1.3 Three public incidents, briefly

You do not need technical detail to learn from real events. Read each source yourself; the summaries below stay at the level the publishers released.

• Power in Ukraine, December 2015. CISA reports that attackers caused power outages affecting about 225,000 customers, operating breakers remotely and making recovery harder; the utilities restored power by switching to manual operation (CISA IR-ALERT-H-16-056-01). Lesson: attacks on computers can reach the physical world, and people who can run things by hand are part of resilience.
• WannaCry and the English NHS, May 2017. The UK National Audit Office found that the ransomware disrupted at least a third of NHS trusts in England and led to thousands of cancelled appointments and operations (NAO, Investigation: WannaCry cyber attack and the NHS). Lesson: ordinary IT malware becomes a healthcare availability problem; patients feel it, not only computers.
• Water facilities, 2023. CISA and partner agencies reported that actors compromised internet-exposed industrial controllers at multiple U.S. water and wastewater facilities, likely by using default passwords (CISA AA23-335A). Lesson: simple weaknesses — a device reachable from the internet with a factory password — can be enough.

1.4 Writing a risk sentence

"Ransomware" is a word, not a risk. A risk is something that might happen and would matter. A clear risk sentence has three parts:

Because (cause or weakness), (something) could happen (event), leading to (consequence for people or the service).

Example (synthetic): "Because the clinic's appointment PCs share one password written on a sticky note, someone walking past the desk could log in and change or delete appointments, leading to patients missing care and staff losing a morning to rebuild the list."

Good risk sentences name a real consequence (people, time, service), not just "data loss". They also make it obvious who should own the problem: here, the practice manager, not the person who noticed it.

Visual 1 — a risk statement that leads to a decision

flowchart LR
    A[Cause or weakness] --> B[Possible event]
    B --> C[Consequence for people or service]
    C --> D[Named owner reviews the report]
    D --> E[Authorized response]

Text alternative: describe a cause, then a possible event, then the harm to people or service. Report that chain to the owner, who decides on an authorized response. Sam does not perform the response merely because Sam noticed the risk.

1.5 The newcomer's three decisions

As a beginner you are not expected to fix security. You are expected to notice, to report through the right channel, and to leave the fix to the owner. Faced with something that looks wrong, ask:

1. Is anyone in danger now? If yes, follow the safety or emergency procedure first; security comes second.
2. Does someone need to know? If it could affect the service, people or private data, report it to your supervisor or the stated channel today.
3. Is it mine to change? Almost always, no. Describe what you saw; do not "just check" or "just fix" it.

1.6 Worked example: Sam's first week (synthetic)

Sam Reyes starts at the Larkfield Community Clinic front desk. In the first week Sam notices four things:

Sam writes one risk sentence for (b): "Because staff are receiving convincing fake MedBook emails, someone could enter their password on a fake page, leading to an outsider locking or changing appointments and the clinic being unable to see patients for hours." Sam marks one assumption: "Assumed: MedBook logins are not protected by a second factor — I don't know."

Notice what Sam did not do: investigate, test the link, restart the PC, or touch Larkfield Water. Each decision is small, but together they are exactly what a newcomer adds.

1.7 Practical activity

Pick an essential service you use (your water supplier, local hospital, bus company or bank). In no more than one page, write: the function it delivers to people; who would be harmed first if it stopped for a day; one risk sentence with cause, event and consequence; and one thing you are assuming. Keep it general — use public information only and do not probe the service in any way.

Swap pages with a classmate who chose a different service and check each other's risk sentence: does it name a cause, an event and a consequence for people? Then compare who you said would be harmed first. A hospital and a bus company give very different answers, which is exactly the point of thinking in functions.

1.8 Common errors and limits

• Thinking security is only about passwords and data. In essential services, start with safety and continuity.
• Writing risks as single words ("hackers", "virus") instead of sentences someone can act on.
• Trying to fix things yourself. Your job at this level is to notice and report.
• Treating one incident summary as the full story. Public reports are deliberately incomplete.

• This chapter simplifies: real organizations use formal risk methods, and laws on critical services differ by country.

• Assuming that whoever noticed a problem should own it. Sam noticed the sticky-note password, but the practice manager decides what to do about it.

• Forgetting to mark assumptions. Sam's note that MedBook logins may lack a second factor is labelled as unknown, not stated as fact.

Exercises — chapter 1

EX001 — Spot the essential services. Objective: recognize essential services. Inputs: a list: drinking water, a cinema, a hospital emergency department, a card-payment network, a clothing shop, a regional power grid, a city bus network, a video-game server. Steps: mark each essential or not and give a one-line reason. Expected evidence: eight marks with reasons. Rubric: 3 = water, emergency department, payments, grid and buses marked essential with harm-based reasons, others not, with a note that "essential" depends on context; 2 = correct marks, weak reasons; 1 = several errors; 0 = none.

EX002 — Sector match. Objective: connect services to sectors. Inputs: the five essential services from EX001. Steps: name the sector each belongs to using the CISA sector list. Expected evidence: five pairs. Rubric: 3 = all correct (water and wastewater; healthcare and public health; financial services; energy; transportation systems); 2 = four correct; 1 = two or three; 0 = fewer.

EX003 — Function, not organization. Objective: think in functions. Inputs: Larkfield Community Clinic, Larkfield Water, Larkfield Bus. Steps: write the function each provides to people as a verb phrase. Expected evidence: three phrases. Rubric: 3 = "provide medical care / dispense medicines", "supply clean water", "move people" or equivalent, each centred on people; 2 = one describes the organization instead; 1 = lists buildings or software; 0 = none.

EX004 — Order of concern. Objective: apply consequence first. Inputs: (a) patient addresses copied; (b) a water-treatment dose changed without approval; (c) the clinic's appointment system unavailable for a morning; (d) a pump screen showing "running" when the pump has stopped. Steps: rank from most to least concerning and justify each. Expected evidence: ranking with reasons. Rubric: 3 = (b) first (safety), then (c) or (d) with reasoning about continuity versus trust, (a) last for immediate harm but noted as legally serious; 2 = correct first item only; 1 = (a) first with no reasoning; 0 = none.

EX005 — Why not "data first"? Objective: explain the priority shift. Inputs: section 1.2. Steps: in three or four sentences, explain to a friend why essential services think about safety and availability before confidentiality. Expected evidence: short paragraph. Rubric: 3 = mentions physical harm, people depending on continuity, and that confidentiality still matters; 2 = two of these; 1 = one; 0 = none.

EX006 — Incident lesson: Ukraine 2015. Objective: draw a lesson from a public source. Inputs: CISA IR-ALERT-H-16-056-01. Steps: read the summary and write the number of customers affected, how power was restored, and one lesson for a newcomer. Expected evidence: three short answers. Rubric: 3 = about 225,000 customers, manual operation, a lesson about physical consequence or manual fallback; 2 = two correct; 1 = one; 0 = none.

EX007 — Incident lesson: WannaCry and the NHS. Objective: connect IT malware to service harm. Inputs: the NAO report summary. Steps: write who was harmed and how, in two sentences, without technical terms. Expected evidence: two sentences. Rubric: 3 = patients harmed by cancelled appointments/operations and disrupted trusts, framed as availability; 2 = mentions disruption without people; 1 = only "computers were encrypted"; 0 = none.

EX008 — Incident lesson: water controllers. Objective: recognize simple weaknesses. Inputs: CISA AA23-335A. Steps: name the two simple conditions that made compromise possible and say why each is a beginner-level lesson. Expected evidence: two conditions with reasons. Rubric: 3 = internet exposure and default passwords, each explained as an everyday hygiene failure; 2 = both named, no reasons; 1 = one; 0 = none.

EX009 — Rewrite three risks. Objective: write risk sentences. Inputs: the words "phishing", "old computer", "open door" set at the Larkfield clinic. Steps: rewrite each as "Because…, …could happen, leading to…". Expected evidence: three sentences. Rubric: 3 = each has cause, event and a consequence for people or service; 2 = one lacks a consequence; 1 = still generic; 0 = none.

EX010 — Find the owner. Objective: see that risks have owners. Inputs: your three sentences from EX009 and the Larkfield people list. Steps: name who should own each risk and why it is not Sam. Expected evidence: three owners with reasons. Rubric: 3 = practice manager or clinic director for process and premises, IT contractor for the computer (with the manager deciding), reasons about authority; 2 = owners without reasons; 1 = Sam named as owner; 0 = none.

EX011 — Three decisions. Objective: apply notice/report/leave-to-owner. Inputs: a colleague says "the fridge alarm for vaccines beeped all night but I switched it off". Steps: walk through the three questions of section 1.5. Expected evidence: three short answers. Rubric: 3 = recognizes possible patient-safety issue first, reports today to the practice manager, does not adjust the fridge or alarm settings; 2 = reports but misses safety; 1 = tries to fix; 0 = none.

EX012 — Know versus assume. Objective: separate facts from assumptions. Inputs: Sam's risk sentence for (b) in 1.6. Steps: list two facts Sam knows and two things Sam assumes. Expected evidence: four items. Rubric: 3 = facts: fake emails arrived, they ask for passwords; assumptions: no second factor, that the email is fake rather than a real MedBook notice (or similar); 2 = three correct; 1 = mixes them up; 0 = none.

EX013 — Not your system. Objective: respect boundaries outside your workplace. Inputs: item (d) in 1.6. Steps: write the message Sam might send the friend. Expected evidence: two or three sentences. Rubric: 3 = encourages the friend to tell their supervisor or security contact, does not ask for details or passwords, does not suggest trying the tool; 2 = encourages reporting but asks for details; 1 = suggests checking; 0 = none.

Chapter synthesis

Critical infrastructure delivers functions people cannot do without, and its security is judged by consequence: safety first, then continuity, trustworthiness and confidentiality. Real incidents show that computer problems reach patients, homes and streets, and that simple weaknesses are often enough. A newcomer's tools are a clear risk sentence, an honest mark on what is assumed, and three decisions: notice, report, leave the fix to the owner.

Continue studying — chapter 01 of 04

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.