關鍵基礎建設防護之績效評估

Evaluation of the Effectiveness of Critical Infrastructures Protection

黃士育(Shih-Yo Huang)

指導教授 ： 范金鳳

元智大學/資訊學院/資訊工程學系/碩士(2007年)

摘要

隨著科技的進步，民眾對於各項基礎建設的依賴性日漸增高，倘若這些基礎建設遭到破壞，會為民眾的生活帶來多大的衝擊呢?由於關鍵的民生基礎建設攸關國家安全、社會秩序以及人民生命財產安全的問題，所以美國、加拿大等先進國家均加強了關鍵基礎建設的保護計畫。尤其在911事件發生之後，恐怖份子的攻擊方式更是千變萬化，可能危及到各項民生基礎建設，如電水力、交通建設、金融、醫療體系等。
為了評估基礎建設的保護效能，各國均發展相關的模擬工具。本研究提供關鍵基礎建設防護量化評估的工具，這個工具分為兩個部份，第一個部份開發了一套CIIP-CMM的量化評估工具，以了解關鍵基礎建設保護計畫的完備性及其成熟度。第二部份模擬關鍵基礎建設之間的相互相依關係(interdependency)，藉此模擬找出基礎建設受攻擊後所引起的後續影響，以了解最為關鍵的相互相依性，也可產生各種攻擊劇情以便回答萬一…如何(what-if)的問句，讓我們去找到關鍵基礎建設保護(Critical Infrastructure Protection, CIP)的弱點。
我們的研究提供使用者一套基礎建設防護計畫的量化評估工具，並且可以模擬關鍵基礎建設之間的相互相依關係，用來找出關鍵基礎建設保護之間的弱點。

關鍵字

關鍵基礎建設 ； 相依性 ； CIIP-CMM ； 模擬

並列摘要

As technology advances, the general public becomes heavily dependent on critical infrastructures. If the critical infrastructures are under attack, what will be the severe effects on people’s daily life? Because critical infrastructures concerns national security, social order, and the general public’s safety, most developed countries, such as the United States, Canadian, etc., strengthened their protection plans for critical infrastructures. Especially after 911 attacks on the US, people realizes that the terrorists may apply various attack schemes endangering different kinds of critical infrastructures; for instance, electric power, drinking water, traffic system, financial networks, computer networks, etc.
To evaluate the effectiveness of infrastructure protection, many countries have developed relevant simulation tools. Our research provides two tools for quantitative evaluation of Critical Infrastructures Protection. Our tools include two parts; the first part is a tool assisting the quantitative evaluation using CIIP-CMM for estimating the maturity of different countries’ Critical Infrastructure Plan (CIP). The second part is a simulator simulating interdependencies of critical infrastructures. It aims to simulate the cascading influence effects due to attacks on connected infrastructures so that critical interdependency and vulnerable points can be identified, various attack scenarios can be simulated, and what-if questions can be answered.
Our research provides quantitative evaluation methods and tools for critical infrastructure protection. Our tool simulates interdependencies among critical infrastructures, and can identify the weakness in Critical Infrastructure Protection (CIP).

並列關鍵字

Critical Infrastructures ； interdependencies ； CIIP-CMM ； simulator

參考文獻

[5] Chung-Wei Chen, “Development and Application of Effectiveness Assessment Model for Critical Information Infrastructure Protection Measures”,ICS 2006

[9] DHS: National Infrastructure Protection Plan www.dhs.gov/xprevprot/programs/editorial_0827.shtm.

[10] American Government, Homeland Security Act, http://www.dhs.gov/interweb/assetlibrary/hr_5005_enr.pdf

[13] Steven M. Rinaldi, James P. Peerenboom, and Terrence K. Kelly, “Identifying, Understanding, and Analysis Critical Infrastructure Interdependencies”, 2001 Control

[14] Steven M. Rinaldi, “Modeling and Simulating Critical Infrastructures and Their Interdependencies,” Proceedings of the 37th IEEE Hawaii International Conference on System Sciences – 2004.