Operators and Stakeholders

The most important utility from the critical-infrastructure viewpoint is electric power, without which almost everything else comes to a standstill; but there are other critical systems such as oil refining, railway signalling and water treatment. It was realised fifteen years ago that such networks were becoming exposed to cyber-attack because of the rapid adoption of IP networking. The protocols most commonly used in industrial control systems evolved in a world of closed and dedicated networks with no need for authentication or encryption. The move to IP was driven by cost pressures but left operators vulnerable; anyone in the world who knew the IP address of a sensor could read it, and anyone who knew the address of an actuator could operate it. Since the alarm was sounded in 1998, and especially since 9/11, considerable efforts have been expended by both state and private-sector actors in protecting critical control systems. In what follows we will discuss the electricity industry; similar comments apply, mutatis mutandis, to petrochemicals, signalling, water-treatment and indeed industrial production.