The Importance of Resistance in the Context of Critical Infrastructure Resilience: An Extension of the CIERA Method

1. Introduction

The term resilience in ecology context was first defined by Holling [1] in 1973 as “a measure of the persistence of systems and of their ability to absorb change and disturbance and still maintain the same relationships between populations or state variables”. This formulation was originally proposed for systems which can be characterized as ecological. However, over time, the concept of resilience began to be reflected in other scientific areas as psychology, economy, and sociology. It is therefore logical that resilience has found its application and added value in technically oriented social fields as well.

CI resilience was first defined in 2009 in the Critical Infrastructure Resilience Final Report and Recommendations [2]. Resilience is perceived here as “the ability to absorb, adapt to, and/or rapidly recover from a potentially disruptive event”. Based on this definition, three key components (i.e., robustness, recoverability, and adaptability) have been identified in this document to determine resilience. Although these components are key determinants of resilience, a closer examination reveals that they only have a responsive character. Their impact on the CI resilience is only apparent at the time of the incident [2]. On this basis, it can be concluded that there is no preventative component in the process of resilience building. This role could be played by resistance which could be understood as the CI ability to prevent the incident occurrence.

The Britannica Dictionary [3] defines resistance as the ability to prevent something from having an effect. The term resistance is used by authors from a number of scientific fields, e.g., in medicine to refer to antibacterial resistance to antibiotics [4,5] or in sociology to refer to a manifestation of social resistance [6,7]. An important area from which the resistance concept is taken and transformed into engineering is the ecology field. Here the term was firstly used in relation with resilience by Sugden [8] in connection with Alpine lake ecosystems. The author defined basic logical differences between resistance and resilience to understand resistance as a fact, such as an ecosystem is capable of sustaining a disturbance, such as the introduction of a new genus. Resilience is then a response and recovery measure of the ecosystem after eliminating the source of change.

Over the past decade, the CI resilience issues has been analysed by several authors. Some works deal more generally with the importance of resistance in the context of CI resilience, e.g., [9,10,11,12,13]. Other publications already define preventive factors of resilience and point to the necessity of their separation from robustness, e.g., [14,15,16,17]. However, there are also several frameworks that already define and evaluate resistance variables when assessing the level of CI resilience, e.g., [18,19,20]. From this point of view, resistance can be perceived as an important component of resilience, which should be defined and determined through basic factors.

Based on the above, added value of paper is to define CI resistance and the proposal for its implementation in the CIERA method [21]. The most substantial part of the article also includes the expression of individual the CI resistance factors and the methodological procedure of their assessment with ambition to strengthening the resistance of these infrastructure systems. The paper thus contributes significantly to defining a comprehensive concept of CI system resilience.

2. Materials and Methods

The essence of the article is the effort to prove the suitability of integrating resistance into resilience. For this reason, it is necessary to first define resilience and its meaning in the CI system. Meaning of the word resilience is of Latin origin and means resiliere which is literally bounce back [22]. In the context of CI, resilience was first defined in 2009 [2], whereas this definition has been already expanded, in 2012 by the US National Academies of Science, to include preparation and planning: “the system’s ability to prepare and plan for, absorb, recover from, and successfully adapt to disruptive events” [23].

In the last decade, there has been essentially no change in the perception of CI resilience. This fact is illustrated by the definitions of CI resilience published in several important publications [12,24,25,26,27,28,29,30]. All the definitions summarised in these documents are oriented towards so-called technical resilience which refers to the critical infrastructure elements (CIE) and is expressed by their absorption capacity and their ability to recover and adapt to incidents that have occurred.

A slight shift in the understanding of CI system resilience occurred in 2022, when the European Union issued a Directive that focuses on the critical entities resilience [31]. Resilience in this context is seen as “a critical entity’s ability to prevent, protect against, respond to, resist, mitigate, absorb, accommodate and recover from an incident”. From this definition, it is evident that it is primarily about organisational resilience, whose main framework is to increase the entities resilience that are responsible for these CIEs [32]. For this reason, the following text continues to focus on CIE technical resilience.

Based on the summary of the conclusions from the definitions presented in the previous text, it can be stated that CI resilience is defined by four phases which together form the so-called CI resilience cycle [33]. The essence of this cycle is the ever-increasing CIEs protection. Resilience is strengthened especially in the phase of adaptation to an incident that has occurred. However, in some cases, the strengthening of resilience can already be noticed in the recovery phase, for example by installing a completely new, more resilient technology.

The initial phase of the CI resilience cycle is prevention. The importance of prevention is preventing the incident occurrence as a result of the threat impact on a CIE. These are measures aimed at early detection of an incident and the element’s preparedness for its impact. When an incident occurs, resilience moves into the absorption phase. The essence of this phase is to absorb the incident effects on the CIE. The element ability to absorb the incident effects is referred to as robustness.

After the incident ends, resilience moves into recovery phase. The essence of this phase is to remove the consequences of the incident impact on the CIE and restore its performance to its initial level. The final stage of the CI resilience cycle is adaptation. The importance of this phase is CIE adaptation to the incident that took place and thereby strengthen the overall resilience of this element.

As noted in the introduction to this paper, CI resilience is currently determined by three components, but these components characterise only three of the above phases. Specifically, these are the following components of resilience [2]:

• robustness is “the ability of the system to absorb the effects of a disruption without significant deviation from normal operating performance”;
• recoverability is “the ability of the system to recover quickly from potentially disruptive events”;
• adaptability is “the ability of the system to adapt to a shock to normal operating conditions”.

Research on these three components has been carried out in the past by a number of reputable authors [33,34,35,36,37,38,39,40]. Based on a detailed analysis of these publications, there were defined variables determining individual the CIE resilience components (see Figure 1), as part of the creation of the CIERA method [21].

Based on the above, it can be concluded that there is currently no characteristic component that expresses the first resilience phase (i.e., prevention). This component could be resistance which in the context of ecology (from which the whole resilience concept was defined) is seen as the ability of an ecosystem to protect itself against a perturbation [8].

3. Results

The following text is a key part of the paper, as the authors present the results of their original research. These results consist mainly in (1) defining the CI resistance, (2) defining the factors determining this resistance, and (3) defining a methodological procedure for assessing these factors in order to strengthen the CIEs resistance.

The term resistance was first defined by Georg Ohm in 1827 in relation with the difficulty of passing an electric current through a substance [41]. Another use of the term resistance was recorded in 1862, in the sense of organised opposition to an invader [42]. In the following period, the term was increasingly used in a military-political context to refer to underground resistance movements in any country. Over time, the term resistance has come to the fore in other scientific fields, such as medicine (e.g., antibiotic or antimicrobial resistance, immune resistance, psychological resistance), ecology (e.g., ecological or environmental resistance, pesticide resistance) or economy (e.g., resistance economy).

In context of CI, the term resistance has not yet been defined. Some authors consider resistance and resilience as two distinct concepts [43]. They see resistance as being similar to prevent or protect, while resilience is akin to respond or recover. Other authors put the two terms in context but consider resistance as the component of resilience responsible for reducing the severity or consequences of a hazard [34]. In both cases, it can be stated that this interpretation is inaccurate, as resistance in all the above mentioned fields is a factor preventing the emergence of an incident. It is thus a fundamental component of resilience that has clearly preventative but not mitigating character. Based on these facts, the authors of this paper have created a definition where they view resistance as “the critical infrastructure ability to prevent the occurrence of an incident”.

Based on the above, it is therefore possible to define resistance in the CI resilience context. It is clear from the previous text that resistance must be seen as one of the essential resilience components, especially in its initial phase. Other resilience components are robustness, recoverability, and adaptability. The authors’ perceptions of these components with regards to an incident are presented in Figure 2.

In the following part of the article and with reference to Figure 1, it is possible to define the variables determining the CIEs resistance (see Figure 3). It is clear from the above definition of resistance that the essence of these variables must be their ability to prevent incidents. For this reason, all these variables must be of a preventative character.

The default variable is crisis preparedness. The essence of crisis preparedness is to increase the CI entities readiness of against threats. This preparedness consists in a thorough assessment of risks and the subsequent processing of security planning documentation. Risk assessment is a systematic and effective way of identifying, analysing, and evaluating risks and determining the most effective costs and means to minimize these risks [44]. For this purpose, it is advisable to use the recommended risk assessment techniques [45]. Security planning documentation includes especially emergency plans and a CI entity’s crisis preparedness plan [46]. An emergency plan is a document containing a comprehensive set of preventive measures aimed at preparing the CI entity for an accident or other incident, including natural and man-made threats. The crisis preparedness plan serves CI entities to ensure their own functioning in crisis situations.

The second variable is anticipation ability. The substance of this variable is the ability of the CI entity to predict the possible incident emergence as a result of the threat impact. These are basically the activities of the entity in the context of defining the risk environment that affects the CIEs [34]. For this purpose, the disruption indicating procedure of the CIE resilience [47] can be used, which assess the elements resilience level and the possibility of their disruption through indicators. On the basis of the possible element resilience disruption assessment, preventive measures are implemented to prevent the emergence of an incident. Other measures that can be used to predict the emergence of incidents are audits or the use of relevant information support enabling the incidents prediction.

The third variable is physical resistance. The substance of this variable is the CIE ability to resist the effects of natural and man-made threats, through the material and structural resistance of these buildings [48]. The core areas of physical resistance are fire, seismic and explosion resistance. Fire resistance is the ability of building structures to sustain the effects of a fully developed fire, without particularly affecting their load-bearing capacity and stability, integrity and insulating ability. Seismic resistance is the ability of building structures to sustain the effects of earthquakes through sufficient elasticity or ductility. Explosion resistance is the ability of buildings to prevent explosions (i.e., active explosion protection) or to eliminate the effects of an explosion (i.e., passive explosion protection) through their layout and measures.

The last variable is security measures. The essence of these measures is monitoring and physical protection of CIEs. The goal of monitoring is mainly to check the technical condition of the elements, their function and the services provided by them [49]. If any deficiencies are identified through monitoring, it is advisable to start the process of repairing or modernizing these elements. The essence of modernization is especially maintaining the technical state of elements with current trends and technologies [50]. A suitable preventive tool for the CIEs protection is also a physical protection system which is determined by regime, organizational and technical measures [51].

A comprehensive overview of the variables and their parameters describing the CIEs resilience is presented graphically in Figure 4. The structure of this figure is designed in the form of a descending classification, where the first level consists of variables, the second level of parameters, and the third level recommends some potentially suitable criteria.

The above defined variables and their parameters can be used in particular to assess the CIEs resistance, e.g., through the assessment mechanism of the semi-quantitative CIERA method [21]. This method is suitable for assessing the elements resilience in technical infrastructures, such as energy, transport, communication and information systems or water management. For this purpose, it is necessary to assess all parameters level that determine each variable. These parameters must be evaluated against the specific threat, as the level of resistance of the elements cannot be generalised. The assessment can be carried out, similar to the CIERA method, through point evaluation where 5 points is the best and 1 point the worst.

The level of each resistance variable is then calculated by a weighted average of the individual parameters (see Equation (1)). Because the parameter level is represented as a score between 1 and 5, the resulting value must be multiplied by 20, which gives a result expressed as a percentage.

$$V_r=20{\displaystyle \sum }_{s=1}^t{P}_s{w}_s$$

(1)

where $V_r$ = the r^th CIE resistance variable [%]; $P_s$ = the s^th CIE resistance parameter [points]; $w_s$ = the s^th standardised weight of the s^th CIE resistance parameter in the interval $⟨0;1⟩$; $t$ = the number of parameters in the r^th variable. The standardised weights of the parameters were determined using the pairwise comparison method [52] and are presented in Table 1.

The resulting level of CIE resistance is expressed by the weighted average of the individual variables (see Equation (2)):

$$R={\displaystyle \sum }_{r=1}^t{V}_r{h}_r$$

(2)

where $R$ = the CIE resistance [%]; $V_r$ = the r^th variable of CIE resistance [%]; $h_r$ = the r^th standardised weight of the r^th variable of CIE resistance [$⟨0;1⟩$]; $t$ = the number of variables expressing the CIE resistance. The standardised weights of the variables were expressed using the pairwise comparison method [52] and are presented in Table 2.

A possible graphical representation of the resulting level of CIE resistance and its variables is presented in Figure 5.

The resulting level of CIE resistance is expressed as a percentage which in itself provides only a rough idea of the protection of the element. A more detailed evaluation of this level is necessary by classifying it according to the reference scale (see Figure 6) which is based on the CIERA method [21].

The acceptability of resistance is diversified into five rating levels is driven by the desire increase the interest of users to examine the composition of resistance in more detail, i.e., to retrospectively break down resistance into individual variables and parameters. If resistance reaches a level of ≤ 68%, identification of weaknesses consisting in a breakdown of the resistance assessment results should be carried out at the level of the parameters concerned. For parameters scoring 2 or less, it is necessary to review the affected area of the assessed element and start the process of strengthening its resistance.

To strengthen the resilience of these parameters, it is appropriate to use, for example, resilience strengthening tools for CIEs [53] which would be suitable for implementation to strengthen the resistance of elements through relevant variables. In general, it is possible to divide these tools into external and internal tools and, due to their nature, into thematic groups. In some cases, these are tools regulating process and functional areas of organization management, i.e., personnel, financial and process tools. On the other hand, the tools are focused on external factors (principle of the PESTLE method), considering political, economic, social, legislative, technological, and environmental aspects. Tools suitable for strengthening resistance variables are presented in Figure 7.

4. Practical example of resistance assessment for a selected energy CIE

Finally, it is appropriate to demonstrate the practical applicability of the results obtained in the paper by their application to a selected energy CIE. The selected element is the electrical station of the transmission system which is a European CIE. In the Czech Republic, there are a total of 33 electrical stations in operation in the transmission system, of which 4 stations ensure the connection between the 400 kV and 220 kV systems, 32 stations ensure the connection between TS and DS, 10 stations ensure the output of power from power plants, and 8 stations it is composed of 400 kV and 220 kV substations. The assessed electrical station is anonymized for security reasons and only its basic description is provided in Table 3.

In the subsequent section, there is carried out a semi-quantitative assessment of this selected element’s resistance to the selected threat. This threat is a terrorist attack using an explosive device aimed at physical damage to the control workplace and causing a widespread blackout.

The assessment of the resistance of the selected energy CIE is realised in the three steps:

• Step 1: Analysis and scoring of each parameter;
• Step 2: Calculation of the level of each variable;
• Step 3: Determine the resulting energy CIE resistance level.

Step 1: The results of the analysis including the point rating and its rationale for individual parameters determining the element resistance are showed in Table 4.

Step 2: The results of calculating the level of each variable according to Equation (1) are showed in Table 5.

Step 3: The results of determining the resulting level of resistance of the energy CIE according to Equation (2) are presented in Table 6.

Considering assessment results presented above, it is possible to state that the element’s resistance level achieved is low. For this purpose, it is necessary to determine weak and vulnerable points and define measures to strengthen the resistance of the selected energy CIE. The identification of weaknesses consists of breaking down the assessment results at the level of the parameters concerned, in doing so identifying all parameters that scored 2 or less. Regarding this case study, these parameters are:

• Regular checks and surveys ($P_{2.2}$),
• Seismic resistance ($P_{3.2}$).

There is subsequently important to identify appropriate tools for strengthening the resistance variables (see Table 3) of these parameters. And based on these tools, propose specific security measures at the level of the affected parameters.

First parameter Regular checks and surveys ($P_{2.2}$) belongs to the variable Anticipation ability. In the context of the assessed threat, it is necessary to look for strengthening tools in the field of material tools for this variable. A Monitoring tool has been identified in this area. As part of the analysis of existing security measures, it was found that the monitoring of this element is implemented only remotely and the real arrival time of the response unit is set at one hour. Such measures are insufficient from the element’s resistance point of view. A suitable solution is to reduce the arrival time of the response unit or continuous supervision within the given element and the implementation of irregular physical inspections with a constant frequency per day.

The second parameter Seismic resistance ($P_{3.2}$) belongs to the variable Physical resistance. In the context of the assessed threat, it is necessary to look for strengthening tools for this variable also in the field of material tools. In this context, the technical elements of the physical protection tool were identified. As part of the analysis of existing security measures, it was found that the technical means for protecting this element are the least resistant at the level of the materials used. For this reason, a suitable solution is to use more durable materials for strengthening the cooling oil fairing, or to build protective blocks.

From the example presented above, it is clear that the methodical procedure for assessing resistance is particularly suitable for technically oriented infrastructures, such as information and communication technologies or transport structures. For the needs of assessing the of other infrastructures elements resistance, especially of a socio-economic character, it would first be necessary to carry out a review of parameters. These are currently mainly set up to assess the infrastructure objects resistance.

5. Conclusion

Technical sectors are currently essential part in the CI system. The premise that resilience is an important factor having a positive impact on provided services reliability is respected not only to households, but especially to dependent sectors of CI. Disruption to these supplies would result in widespread impacts on the functioning of society as a whole. The elementary starting point for ensuring the security of these supplies is increasing the CIEs resistance. This resistance is defined by the authors of the article as the ability of a CIE to prevent the emergence of an incident. A pragmatic conclusion can therefore be that the CIE resistance is an integral part of resilience, also due to its preventive character.

Considering the original research results, the authors of the paper identified four basic variables that determine the CI resistance. For each variable, the individual parameters and the principle of their semi-quantitative evaluation were further defined. Subsequently, a methodological procedure for resistance assessment was defined to identify weak points and the subsequent infrastructure elements resistance strengthening. The whole process was demonstrated in the conclusion of the article in the form of a practical example using a selected energy CIE. At the same time, it should be noted that the presented methodological approach for resistance assessment has already been successfully applied and verified on selected European energy CIEs.

The main contribution of the article is to broaden the perception of CI resilience which has so far been determined only by incident response factors, i.e., robustness, recoverability, and adaptability. The integration of resistance into resilience thus allows the CIEs protection to be extended to include a preventative component. This integration can be practically used e.g., for modification of the CIERA method used for CIEs resilience assessment. Continuing research could be focused on the developing factors determining the infrastructure elements resistance and their specification in relation to specific technical, but also selected socio-economic, CI sectors.