GOVCERT.NL Symposium 2008

Eric Luiijf M.Sc. Principal Consultant TNO Defence, Security and Safety

Eric Luiijf M.Sc.(Eng) works as Principal Consultant in Information Operations and Critical Infrastructure Protection at TNO Defence, Security and Safety. Eric has been involved in most of the Dutch studies on Critical (Information) Protection (C(I)IP) since 2000. He participated in the KWINT study (vulnerability of the Dutch Internet), which resulted in the establishment of GOVCERT.NL and the Waarschuwingsdienst. He was project leader of the TNO-KEMA study on the (in)security of Supervisory Control and Data Acquisition systems (SCADA) and he developed a set of SCADA Good Practices. As a core team member, he participates in EU CIP projects, such as Vital Infrastructures Threats and Analysis (VITA), Critical Information Infrastructure Research Co-ordination (CI2RCO), Integrated Risk Reduction of Information Infrastructure Systems (IRRIIS) and DIESIS.

Eric is one of the editors of the European CIIP newsletter. He has been interviewed many times by national and international newspapers, monthly publications, radio and national TV on topics relating to information operations ("Cyber warfare") and C(I)IP. He has published many popular articles, reports, as well as scientific publications.

Critical Infrastructure Dependencies hurt, don’t they? Tuesday 16 September, 11:30 - 12:15, Mees Auditorium

Disruption or destruction of critical infrastructure may seriously affect our economy, our societal life, the freedom to act by the government, and may even result in the loss of life of citizens and animals. ICT increasingly controls and bridges critical infrastructures. The perceived risk is about dependencies between critical infrastructures causing cascading outages that darken society, or even multiple societies. Is this perceived risk based on a risk perception that is too negative, or are all our cascading scenarios too optimistic and is doomsday around the corner? Are dependency outages which “bite their own tail” likely?

TNO Defence, Security and Safety, maintains a database on critical (information) infrastructure disruption events which occur all over the world, including information from news reports and official reports by critical sectors and government agencies. Analysis of the data, as part of Dutch national and European projects, has resulted in a better understanding of dependencies between infrastructures and the cascading phenomena. From that, a recent new, although complex, dependency model gives an improved understanding of the dependency risk factors.

During the session, based on partial reality, an insight of the most harmful critical infrastructures – when disrupted – will be highlighted. The audience will be introduced to the new dependency model, which will aid the understanding of dependencies, interdependencies, cascades and related issues. Some well-known events will be analyzed in terms of their ICT dependency failures. What were the main pitfalls? Where does convergence of technologies and services come into play? What are the lessons that should have been learned, but that you do not, as yet, practice? What can you do and what can ISACs do to increase the resilience of your organization and the society?