Physical infrastructure vulnerabilities exposed

Much coverage has been given to the cyber threat posed by terrorism, but Nick Cowley argues that much more thought needs to be given to the importance of physical security.

The threat of a cyber attack on the UK’s critical national infrastructure (CNI) has been a major concern for quite a while now, so much so that Channel 4 aired its “what if” drama Blackout as far back as 2013. The drama drew attention to the chaos that would ensue if a terrorist organisation made a successful cyber attack on our national grid. However, there are more ways to cause harm to our electricity or water systems.

In November 2015, George Osborne, former chancellor, warned that terrorist organisation ISIS posed a significant threat to the UK’s infrastructure – particularly regarding the likelihood of a cyber attack. To protect against such a threat, the government is investing £2 billion in cyber security to bolster the country’s defences.

However, Mikko Hypponen, a cyber security specialist who has advised governments in the UK, US and Asia, thinks a wider view is needed to protect CNI. While Hypponen acknowledges that terror groups do pose a cyber threat, he believes that they are equally likely to target our infrastructure physically.

In November 2015, global headlines reported that Paris was on high alert over a potential chemical attack on its water supply. This came about after threats from ISIS and the theft of 12 protective suits used to guard against chemical products and viruses like Ebola from a hospital complex, along with over 30 pairs of protective boots. The threat level was so severe that the French army was posted to various key facilities around Paris and regular water tests were undertaken.

The physical threat to our water system is as real and potentially crippling as the cyber security threat and must be treated as such, something that is reflected in the importance placed on “resilience” in the Water Act 2014. The act came about to encourage reform in the water industry, in terms of both innovation and the resilience of water supplies.

In addition to the primary duties outlined for water providers in England and Wales, the act stresses the need for long-term resilience of water and wastewater systems and service provision when faced with increasing external stresses. The latest government advice on the matter is included in a cabinet office paper entitled “Keeping the Country Running”. This guidance defines resilience as “the ability of assets, networks and systems to anticipate, absorb, adapt to and/or rapidly recover from a disruptive event”.

Two of the key pieces of advice covered are resistance (proofing a system so that it is resistant to known risks) and reliability (a system that operates effectively, irrespective of whether or not risks materialise). Achieving both things to avoid disruption to vital water services relies heavily on physical security.

The Centre for the Protection of National Infrastructure (CPNI), which protects national security by providing protective security advice, describes physical security as “measures [that] aim to either prevent a direct assault on premises or reduce the potential damage and injuries should an incident occur”.

Among the measures CPNI considers to be priorities are CCTV, access control, perimeter protection, hostile vehicle mitigation, and explosives and ballistics protection. All of which are very important to protect key sites in our national infrastructure such as water treatment plants.

However, what is rarely discussed in such detail by any organisation assessing the protection of our water or electricity supply are the more remote, smaller points where damage can be done – utility kiosks. These kiosks are usually at key points in the water network, including sites with equipment for the chlorination and treatment of the water supply and borehole sites, and they are often in remote locations away from populated areas.

The nature of these locations often rules out effective perimeter or access control measures that would isolate these vulnerable areas of infrastructure. This means that the kiosks themselves must be able to withstand any attempt to do harm.

British Security Industry Association chief executive James Kelly says: “It is imperative that integrated and robust security measures are in place to secure sites of critical national importance, such as the nation’s many utilities sites. A combination of technology, physical security and the deployment of trained personnel is often the most effective method of security integration, creating several layers of defence to protect the most sensitive parts of the network.

“When it comes to utility kiosks, site accessibility must also be a consideration. Characterised by their, often remote, locations, maintenance visits can be irregular and conducted by different staff. Therefore a balance needs to be found between security and accessibility. Solutions which can offer temporary access to mobile employees while balancing the need for high security, the ability to withstand attack and cope with potentially corrosive weather conditions would be beneficial to these sites.”

This is why kiosk manufacturers have to closely examine the materials and techniques they use when designing utility kiosks. We have invested time in researching and developing kiosks that can stand up to tampering. As a result, we can provide glass reinforced plastic kiosks, which can withstand the elements and possible attack.

We cannot be complacent about critical national infrastructure like our water supply. One weak link in the chain and the next drama from Channel 4 on the topic won’t be a “what if” drama, it will be a documentary. Just because utility kiosks are out of sight, they cannot be out of mind if we are going to protect our CNI.