The NCSC research problem book
Page 20 of 21
CP6 - How do we build resilience across a ‘system of systems’?
How do we build resilience across a ‘system of systems’?
In critical infrastructure, we often focus on the knock-on effects of an incident, where there is impact on one system because of an event in a different system. The two systems might even exist in different sectors.
We also talk about ‘cascading failures’, where an incident may progress in an uncontrollable way because of a reliance on other systems, sometimes with far-reaching consequences. As technology changes, we see how these technologies rely on each other, as well as on wider infrastructure, for example in telecoms and electricity. It’s important to understand how these systems interact and support each other with new operating models, as well as identifying any new critical activities that underpin these new ways of living.
This problem brings together experts from different disciplines and sectors to provide real insights into the challenges of cross-sector incidents.
Strands or sub-problems
-
Modelling
To understand the real impact of major incidents, there is a need to build detailed representations of system interoperability that allows accurate prediction of cause and effect across multiple systems and sector boundaries.
-
Risk
Where solutions can’t provide the safeguards we might like, we need to really understand the risk of knock-on impact. This includes understanding the scale and severity of impact of failures and how likely they are to happen. At a sector level, we also need to consider risk aggregation, where common components are used widely and multiple systems are vulnerable to the same attacks.
-
Research from other disciplines
There is a good understanding of cascading failures and major outages in the field of natural disasters. Bringing similar tools, techniques and ways of thinking to security could help uncover new approaches to secure highly connected and reliant systems.