HLSSS3

International Journal of Disaster Risk Reduction 60 (2021) 102316

Available online 12 May 2021 2212-4209/© 2021 Elsevier Ltd. All rights reserved.

Review Article

Critical review of the threats affecting the building of critical infrastructure resilience

Robert Osei-Kyei *, Vivian Tam, Mingxue Ma, Fidelis Mashiri School of Engineering, Design and Built Environment, Western Sydney University, Sydney, Australia

A R T I C L E I N F O

Keywords: Critical infrastructure Critical infrastructure resilience Threats Hazards

A B S T R A C T

In modern society, critical infrastructures (CIs) resilience has become a critical issue in crisis management and CIs protection. However, various threats/hazards could lead to disruption and failure of developing CIs resil- ience, which inevitably can lead to negative repercussions to humanity and national economy. In this regard, detailed understanding of the threats/hazards and their impacts are critical to improve a country’s preparedness for unexpected situations such as the COVID-19 pandemic. This paper aims to conduct a critical analysis of the potential threats to governments’ efforts and capacity to build CI resilience. A three-stage systematic review process is adopted and a total of 35 papers are carefully selected. Results show that during the past two decades, researchers’ interest in exploring the threats/hazards in CIs resilience has increased. Further, most of the research publications emanate from the United States and United Kingdom. Lastly, a total of 31 threats/hazards are identified, with the most reported threats/hazards being: (1) natural disasters, (2) ageing and decay, (3) cyber threats, (4) terrorist activities, (5) contamination and (6) cascading failure/threat. The findings of this study provide a solid foundation for future research on developing CIs resilience. Additionally, the findings will inform policy makers and government authorities of the salient threats affecting the building of CIs resilience.

1. Introduction

In these contemporary times, critical infrastructures (CIs) are of great importance because they are physically and logically essential to a nation [1]. Importantly, CIs are necessary to support public welfare, economic growth and government day-to-day functions [2]. Examples of CIs include supply of energy (oil, gas, and electricity), information and communication technology (including telecommunications and navi- gation), nuclear industry, water supply, healthcare (hospital, medicines, and vaccines), provision of financial services (banks and insurance), civil administration (government functions and facilities), and function of transportation systems (road transport, railway transport, and air traffic) [1]. CIs are always known to be highly interconnected and complex [3]. This means that the operation of one CI is dependent on the operation of other CIs. For instance, steady supply of electricity is fundamental to the function of water and telecommunication systems [2]. In this regard, any disruption of a single CI could lead to cascading effects in other CIs, and further trigger regional or national impacts [2, 4]. The complicated interdependencies of CIs network brings difficulties in managing potential crisis [5].

Considering the complicated interdependencies of CIs network, in recent years it has become very necessary for many governments to build resilient CI systems which will ensure the continuing function of a nation’s economy. Generally, CI resilience refers to the ability of CIs to absorb, resist, adapt and recover from the effects caused by a disruptive event [6]). In fact, protecting CIs is good, however, developing resilient CIs system is considered prudent because it allows a country to adapt to change and withstand unexpected situations or pandemics. More importantly, resilient CIs system enable a country to develop urban community resilience which ensures that communities can absorb disturbance while maintaining their functions and structure [6]).

However, different forms of threats including natural disasters, cyber threats, technical damages, human errors, and malicious attacks have the possibility to disrupt governments’ efforts to develop resilient CIs system or network [7]. Essentially, some threats/hazards would not only cause a disruption to a government’s efforts to develop CI resilience but can lead to a total breakdown of a country’s CIs network, thus making the national economy and society unfunctional [8]. For instance, In Japan, the Tohoku earthquake with subsequent tsunami caused the complete loss of internal and external support for Fukushima Daiichi

* Corresponding author. E-mail address: [email protected] (R. Osei-Kyei).

Contents lists available at ScienceDirect

International Journal of Disaster Risk Reduction

journal homepage: www.elsevier.com/locate/ijdrr

https://doi.org/10.1016/j.ijdrr.2021.102316 Received 10 February 2021; Received in revised form 3 May 2021; Accepted 3 May 2021

International Journal of Disaster Risk Reduction 60 (2021) 102316

2

nuclear power plant which led to a large-scale release of radioactive contamination [9]. Given this, there is the need to critically ascertain the prevailing variety of threats/hazards that can jeopardize the efforts and capacities of governments to develop resilient CIs system in their country. In fact, this will help policy makers, governments, and all stakeholders of CIs to develop proper policies and strategies that will help reduce the impact of these threats/hazards on CI resilience. Further, a detailed knowledge of the threats/hazards affecting the development of CIs resilience will help improve governments and stakeholders’ preparedness for unforeseen situations and improve the efficiency of response.

Although, there are many studies on the potential threats/hazards associated with CIs in general and CI resilience, little attempt has been made to consolidate the existing threats on governments’ ability and capacity to develop CI resilience from previous studies. In fact, the threats/hazards have been scattered in literatures and this has a nega- tive implication on the effective development of resilient CIs system because practitioners and researchers may not be able to ascertain the emerging threats/hazards. Against this background, this paper aims to systematically review the potential threats/hazards affecting the build- ing of CI resilience with the following derived objective:

1. To assess the annual publication trend on threats/hazards to CIs resilience from 1990 to 2020;

2. To identify active contributors in exploring the threats/hazards to CIs resilience from 1990 to 2020;

3. To identify countries with most publications on the threats/hazards to CIs resilience and the impact on the countries’ CI system; and

4. To ascertain a consolidated checklist of the potential threats/hazards to building CIs resilience and develop a conceptual model of the threats to CI resilience.

The findings of this study provide in-depth knowledge and infor- mation which will be useful to policy makers and governments on the development of CI resilience. Further, CI operators and managers will be informed of the potential risks associated with CIs. Lastly, the findings open a discussion on the need for countries to develop CI resilience instead of only focusing on the protection of CI.

2. Research methodology

Literature review is a secondary study which identifies, evaluates and interprets valuable researches related to a specific topic or area [10]. The development of literature review is based on a transparent process of selecting target papers, analysing and reporting of findings from previous studies [10]. The three-stage systematic review process adopted in this study follows the description of Osei-Kyei and Chan [11] and Yi and Wang [12]. This review process was utilised to select and analyse published papers on the threats to CI resilience from 1990 to 2020 (both years inclusive). Fig. 1 presents the overall view of the sys- tematic processes. The three stages are: (1) identifying primary studies; (2) selecting target papers; and (3) analysing target papers.

2.1. Identifying primary studies

In stage 1, Scopus database was selected to identify primary studies which satisfy the review criteria. The terms ‘barriers’, ‘challenges’, ‘threats’, ‘problems’ and ‘hazards’ were entered under the ‘title/

Search Engine

Paper identification

T/A/K Search

Paper identification

Final outputs

Contributors & countries &

institutes

Threats/ hazards

identification

Annual publication

trend

Conclusion

Visual examination

Visual examination

Fig. 1. The research framework of this study.

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

3

abstract/keyword’ (T/A/K) area of Scopus. In addition, the exploration is restricted within the field related to CIs resilience by using the key- words ‘critical infrastructure’ and ‘critical infrastructure resilience’. Besides, the search was limited to journal articles published between 1990 and 2020 and the language was restricted to English. The full search code is given below:

TITLE-ABS-KEY (“Barriers” OR “Challenges” OR “threats” OR “problems” OR “Hazards”) AND TITLE-ABS-KEY (“Critical infrastruc- ture” OR “Critical infrastructure resilience)) AND DOCTYPE (ar) AND PUBYEAR > 1989 AND (LIMIT-TO (LANGUAGE, “English”)).

A total of 748 primary studies were identified from the initial search using the above code.

2.2. Selecting target papers

Stage 2 comprises of two phases to select target papers for further analysis. In phase 1, the 748 studies identified in stage 1 were filtered through a visual examination. The titles and abstracts of papers were visually checked to remove any irrelevant papers. Through this exercise, 673 papers were removed. Another round of visual examination through reading the full text was carried out in phase 2. The papers whose full texts are not related to research questions or related area of CI were eliminated. At the end of the phase 2 exercise, a total of 35 papers were selected for further analysis. The selected papers are presented in Table 1 (including authors). It should be mentioned that although this study aims to holistically review the threats/hazards affecting the building of CI resilience, the 35 journal articles may not represent the entire population of journal articles. Nevertheless, the 35 journal articles can be considered adequate for a further detailed analysis because they are papers which comprehensively discuss issues related to the threats/ hazards of CI in general and/or building CI resilience. More importantly, these journal articles were published in leading journals (see Table 1) in the CI research domain, therefore the findings of this study can be considered reliable and adequate for a further empirical investigation and future practice.

2.3. Analysing target papers

In stage 3, the 35 selected papers were subjected to a thorough content analysis to derive the annual publication trend, the most pro- ductive authors, institutions, and countries on the threats/hazards of CIs resilience. Finally, the most reported threats/hazards to CIs resilience were derived and a conceptual model was developed based on that.

3. Results and discussion

3.1. Annual publication trend on the threats/hazards affecting the building of CIs resilience

Fig. 2 presents the annual publication trend on the threats/hazard to developing CIs resilience. It should be emphasized that the figure only presents the publication years of the 35 target papers selected in this study. During the period of 2003–2014, the number of publications is relatively low, such as 1 publication in 2003, and 0 in 2004 and 2005. Since 2014, this number experienced a dramatic increase and reached to a peak of 5 publications in 2015. During the years between 2016 and 2020, the distribution line fluctuated and processed to 5 publications in 2020.

Also, as shown in Fig. 2, studies on threats/hazard to develop CIs resilience seem to be relatively few, particularly during the period be- tween 1990 and 2000. In fact, the lowest number of publications was recorded between these years (0 publications for one decade). This finding is not surprising because the concept of CIs resilience was not topical in the 1990s. In fact, it was in recent times that many govern- ments attention have now been drawn to the fact that resilience of CIs are critical to a nation’s development. Further, in recent years, CIs

Table 1 Results of selected publications.

Ref. Authors Publications Year Journals

1 Michel-Kerjan, E [13]

New challenges in critical infrastructures: A US perspective

2003 Journal of Contingencies and Crisis Management

2 Baecher, G. B [14]. Mitigating water supply system vulnerabilities

2006 Protection of Civilian Infrastructure from Acts of Terrorism

3 Thedéen, T [15]. Setting the stage: The vulnerability of critical infrastructures

2006 Protection of Civilian Infrastructure from Acts of Terrorism

4 Burgess, J. P [16]. Social values and material threat: the European programme for critical infrastructure protection

2007 International Journal of Critical Infrastructures

5 Masera, Marcelo, Igor Nai Fovino, and Rafal Leszczyna [17]

Security assessment of a turbo-gas power plant

2008 International Conference on Critical Infrastructure Protection

6 Li, H., Apostolakis, G. E., Gifun, J., VanSchalkwyk, W., Leite, S., & Barber, D [18].

Ranking the risks from multiple hazards in a small community

2009 Risk Analysis

7 Ansell, C., Boin, A., & Keller, A [19].

Managing transboundary crises: Identifying the building blocks of an effective response system

2010 Journal of Contingencies and Crisis Management

8 Huang, Y., & Fan, Y [20].

Modelling uncertainties in emergency service resource allocation

2011 Journal of Infrastructure Systems

9 Novelo-Casanova, D. A., & Suarez, G [21].

Exposure of main critical facilities to natural and man- made hazards in Grand Cayman, Cayman Islands

2012 Natural Hazards

10 Armbruster, Ginger, Barbara Endicott- Popovsky, and Jan Whittington [22].

Threats to municipal information systems posed by ageing infrastructure

2013 International Journal of Critical Infrastructure Protection

11 Hurst, W., Merabti, M., & Fergus, P [23].

A survey of critical infrastructure security

2014 International Conference on Critical Infrastructure Protection

12 Hurst, W., Merabti, M., Iram, S., & Fergus, P [24].

Protecting critical infrastructures through behavioural observation

2014 International Journal of Critical Infrastructures

13 Wilson, G., Wilson, T. M., Deligne, N. I., & Cole, J. W [25].

Volcanic hazard impacts to critical infrastructure: A review

2014 Journal of Volcanology and Geothermal Research

14 Zhang, Zili, Xiangyang Li, and Hengyun Li [3]

A quantitative approach for assessing the critical nodal and linear elements of a railway infrastructure

2015 International Journal of Critical Infrastructure Protection

15 Laugé, A., Hernantes, J., & Sarriegi, J. M [26].

Critical infrastructure dependencies: A holistic, dynamic and

2015 International Journal of Critical Infrastructure Protection

(continued on next page)

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

4

resilience has become a wide discussed topic, as a result of the need for the coexistence of CIs protection and CIs resilience [45]. Changing conditions, including rapid development in technology, increased in- terdependencies among CIs, complexity of CIs network, and severity of CI failures/disruptions have raised concerns on CIs resilience [46]. Also, several natural and man-made hazards in the early 21st century raised concerns about the security of the general public and therefore the need to build CI resilience [47]. For example, the 9/11 terrorist attack not only caused fatalities and injuries, but also result in severe environment and economic damages, which raised global interests on developing CIs resilience [13]. According to the distribution in Fig. 2, only ten publi- cations have been made on threats/hazards to CIs resilience during the period from 2003 to 2013. The results indicate that although CIs resil- ience emerged in the early 21st century, exploration of the threat- s/barriers of CIs resilience was still at a infancy stage.

Given the above analysis, it is projected that in the next couple of years, more research studies will be conducted to investigate into the development of CI resilience due to the increasing advocacy for the coexistence for CI protection and CI resilience by international organizations.

3.2. Most productive authors, institutions, and countries of publications on threats/hazards of developing CIs resilience

A simple count of papers has been adopted in this section to inves- tigate the most productive authors, institutions and countries. The most active authors are Hurst, W., Merabti, M., and Fergus, P. who have published two papers in related fields. Further, the three authors are from the same institution; Liverpool John Moores University, England (one of the two productive institutions). Another productive institution is the European Commission Joint Research Centre.

For the most productive countries in investigating threats/hazards to building CIs resilience, the United States and the United Kingdom have the highest number of publications from 1990 to 2020, with 12 and 7 research papers, respectively. United States has taken measures to eliminate effects from threats/hazards and to enhance CIs resilience, because this country has experienced numerous threats/hazards since

Table 1 (continued )

Ref. Authors Publications Year Journals

quantitative approach

16 Alcaraz, C., & Zeadally, S [1].

Critical infrastructure protection: Requirements and challenges for the 21st century

2015 International Journal of Critical Infrastructure Protection

17 Apan, A., & McDougall, K [27]

Vulnerability assessment and interdependency analysis of critical infrastructures for climate adaptation and flood mitigation

2015 International Journal of Disaster Resilience in the Built Environment

18 Siergiejczyk, M., & Dziula, P [28].

Threats to transport systems catalogue

2015 Journal of KONBiN

19 Pathirage, Chaminda, and Khalifa Al-Khaili [29].

Disaster vulnerability of Emirati energy sector and barriers to enhance resilience

2016 Built Environment Project and Asset Management

20 Klügel, J. U [9] Risk and hazards Assessment of extreme natural events for critical infrastructures

2016 International Journal of Safety and Security Engineering

21 Bartnes, M., & Moe, N. B [30]

Challenges in IT security preparedness exercises: A case study

2017 Computers & Security

22 Ongkowijoyo, Citra, and Hemanta Doloi [31].

Determining critical infrastructure risks using social network analysis

2017 International Journal of Disaster Resilience in the Built Environment

23 Bie, Z., Lin, Y., Li, G., & Li, F [32]

Battling the extreme: A study on the power system resilience

2017 Proceedings of the IEEE

24 Tidwell, Vincent C., Thomas S. Lowry, David Binning, Jenny Graves, William J. Peplinski, and Roger Mitchell [33]

Framework for shared drinking water risk assessment

2018 International Journal of Critical Infrastructure Protection

25 Banerjee, J., Basu, K., & Sen, A [34].

On hardening problems in critical infrastructure systems

2018 International Journal of Critical Infrastructure Protection

26 Cedergren, A., Johansson, J., & Hassel, H [35].

Challenges to critical infrastructure resilience in an institutionally fragmented setting

2018 Safety Science

27 Serre, D., & Heinzlef, C [36].

Assessing and mapping urban resilience to floods with respect to cascading effects through critical infrastructure networks

2018 International Journal of Disaster Risk Reduction

28 Curt, C., & Tacnet, J. M [37]

Resilience of critical infrastructures: Review and analysis of current approaches

2018 Risk Analysis

29 Kure, H., & Islam, S [38].

Cyber threat intelligence for improving cybersecurity and risk management in critical infrastructure

2019 Journal of Universal Computer Science

30 Assad, A., Moselhi, O., & Zayed, T [39].

A new Metric for assessing resilience

2019 Water

Table 1 (continued )

Ref. Authors Publications Year Journals

of water distribution networks

31 Karakitsios, S., Busker, R., Tjärnhage, T., Armand, P., Dybwad, M., Nielsen, M. F., … & Sarigiannis, D [40]

Challenges on detection, identification and monitoring of indoor airborne chemical- biological agents

2020 Safety Science

32 Panda, A., & Bower, A [41]

Cyber security and the disaster resilience framework

2020 International Journal of Disaster Resilience in the Built Environment

33 Gunduz, M. Z., & Das, R [42].

Cyber-security on smart grid: Threats and potential solutions

2020 Computers Networks

34 Govindarajulu, D [43].

Strengthening institutional and financial mechanisms for building urban resilience in India

2020 International Journal of Disaster Risk Reduction

35 Cui, Y., Quddus, N., & Mashuga, C. V [44]

Bayesian network and game theory risk assessment model for third-party damage to oil and gas pipelines

2020 Process Safety and Environmental Protection

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

5

the early 21st century, such as terrorist attacks on the twin towers in 2001, Northeast blackout in 2003, Hurricane Katrina in 2005, and Superstorm Sandy in 2012 [48]. Also, between 1996 and 1998, United States released national policies for continued operation of CIs and set national goal for CIs protection [2]. During this period, some institutions and departments obtained government funding to conduct thorough research on CI protection and resilience, which has therefore increased the number of publications from these countries.

Further analysis shows that most of the selected publications (33 of the 35 target papers) are from developed countries, including 12 from the United states, 7 from the United Kingdom, 15 from European countries and 2 from Australia. Specifically, the United Kingdom has the second highest number of publications. This country has recognised the importance of CIs resilience and spent some efforts to enhance CIs resilience. In addition, the number of publications from European countries is significant, because Europe quickly caught on through the North Atlantic Treaty Organization (NATO) and European Union (EU) after the concept of CIs resilience became popular in the United States [45].

In Australia, the need to develop CIs resilience has also received attention from state governments. Several state governments have established CI departments and regulations to ensure the effective development of CI resilience. A typical example is the NSW Resilience department and the introduction of the NSW Critical Infrastructure Resilience Strategy 2018.

Two studies related to threats/hazards to develop CIs resilience were published in China. Essentially, in the last decades, the rapid develop- ment of the Chinese economy has resulted in the creation of many CIs projects in China [49]. Therefore, developing CIs resilience has become one major concern for Chinese government in recent years, thus it is not surprising that some publications are emanating from China.

Interestingly, the number of publications emanating from developing countries is relatively low. This could be that the development of CIs resilience is relatively slow in developing countries. Another reason might be that papers from developing countries might be published in other journals which were excluded at the stage 1 of literature process or which are not indexed in Scopus database.

3.3. Research findings on the threats/hazards affecting the building of CIs resilience

A thorough content analysis of the findings of the 35 papers was conducted to derive a checklist of threats/hazard to CIs resilience. Table 2 presents the threats/hazards to CIs resilience derived from the 35 target papers. The total number of identified threats/hazards is 31, and the threats/hazards are classified into eight groups, based on their commonality and description. The eight groups are: environmental,

social, political, managerial, technical, operational, financial and generic (i.e. no specific classification). Table 2 also displays the detailed description and accumulated number of times that each threat/hazard appears in the targeted papers. The accumulation is used to rank the 31 threats/hazards. As presented in the table, the most reported threats/ hazards are: (1) natural disasters, (2) ageing and decay, (3) cyber threats, (4) terrorist activities, (5) contamination, (6) cascading effects, which were identified 13, 4, 13, 11, 4, and 12 times by previous studies. These threats/hazards require additional attention.

3.3.1. Natural disasters There has been an increase in the occurrence of natural disasters such

as volcano, drought, earthquakes, tsunamis, hurricane, ice storm, flooding, tornado, wildfire and cyclones in the last decade, and this has negatively affected more than two billion people globally [50,51]. In fact, in the past 15 years, the annual incidence of natural disasters was found to be increased by 2% [36]. Specifically, the number of floods has increased to more than 600 events in 2007 [36]. The frequency of rainfall events and tropical cyclones has also increased under the global warming context [43].

Impacts of natural disasters are far-reaching on the function of so- ciety, including failure and disruption of CIs, which result in both direct or indirect loss in economy, society and environment [50,52]. For instance, flood is regarded as a significant hazard in Europe, because increases in rainfalls have resulted in considerable losses [53]. In addi- tion, the incidence of floods have exhibited frequent electricity blackout [53]. Besides these, natural disasters can also trigger some side effects on the environment, such as fires, explosions, and release of hazardous substances [54]. For example, Hurricane Harvey in Texas in 2017 was followed by oil spills and release of chemicals, while widespread nuclear contamination in 2011 was one significant consequence of Tohoku earthquake and tsunami in Japan [54]. In recent years, CIs resilience to natural disasters has become one critical goal, therefore governments and policy makers should continue to make efforts considering the findings in this review paper to develop CI resilience [52].

3.3.2. Terrorist activities Terrorism is not a new threat to CIs resilience, but its influences are

far-reaching and devastating. An effective terrorist attack could lead to death of thousands of people. In the United States, terrorism related threats were given the priority in CIs resilience debate, even before 9/11 [45]. After the bombings in Madrid and London in 2004 and 2005 respectively, release of European Programme for Critical Infrastructure Protection (EPCIP) targeting terrorist attacks were imperative, in order to enhance preparedness and protect populations from impacts of deliberative attacks on CIs [45]. CIs are tempting targets for terrorists who intend to create fear, panic and disturbance in target country,

Fig. 2. Annual publication trend on threats/barriers to CIs resilience.

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

6

Table 2 Threats/hazards to CIs resilience.

Ref Threats/hazards Description References (Refer to Table 1)

Total

1 Environmental Natural disasters (volcano eruptions, drought, earthquakes, tsunamis, hurricane, ice storm, flooding, tornado, wildfire, cyclone, climate change)

Natural disasters are caused by natural processes of earth, including earthquake and hurricane. They are featured for unpredictability, which could damage CIs and pose threat to security.

[19][24][20][30][27] [23][16][9][6][28] [18][17][3][13]

14

2 Ageing and decay Function interruption of CIs could be caused by old or antiquated components, as ageing could increase vulnerability of infrastructures.

[24][10][ 30][27] 4

3 Lack of available land New CIs might be developed in risk areas because of unavailability of lands.

[27] 1

4 Contamination Contamination include chemical substances, volcano ash, and radioactive elements which could form intractable masses and cause damage to functioning area of CIs [50].

[19][24][18][3] 4

5 Social Cyber threats Along with introduction of new technologies, CIs largely rely on digital control systems, resulting to more vulnerabilities to cyber threat. Cyber threat could cause loss of valuable and sensitive data.

[22][24][5][11][29] [32][12][33][30][23] [6][28][3]

13

6 Terrorist activities CIs are tempting targets for terrorists who intend to spread fear and panic. Impacts caused by a terrorist attack are not only casualties, but also disruption of essential services with additional loss in economy, finance and society [40].

[19][31][2][1][30] [27][23][28][18][17] [4]

11

7 Thefts Thieves of CIs elements such as railway contact wires, copper, and water are typically individuals or organized groups who are motived by quick profits.

[22] [18] 2

8 War CIs might be hampered by war related attacks, including bombing, violence, and biological warfare.

[19][3] 2

9 Overloading Along with the development in economy, some CIs are highly demanded. Overloading could cause failure in certain components.

[30] 1

10 Concentration of population in urban areas High concentration of population in urban areas results in a dramatic increase in infrastructure needs and difficulties in risk management (Chapman et al., 2013). However, municipalities might not fully prepared or equipped, which might cause overloading of CIs [36].

[22] 1

11 Political Political unrest Protests, contentious gatherings and violations could pose threat to functioning of surrounding CIs.

[1][18] 2

12 Absence of national government legislation and initiatives on disaster management

Government legislations and initiatives should be in place to plan emergencies and coordinate responses. The absence of supportive legislative context poses barriers in dealing with vulnerabilities [29].

[19] 1

13 Managerial Uncertainties Uncertainties, including uncertainty about the source, evolution and possible solutions of a failure/disruption, could decrease effectiveness of emergency responses.

[7][28] 2

14 Decrease in capacity There is a need to establish an incident-response capacity to respond unexpected threats. It requires continuous revise and improvement [30].

[7][21] 2

15 Lack of interconnected preparedness Some authorities lack interconnected preparedness (underestimation of vulnerabilities, little information and weak vulnerability assessment) to efficiently organize and coordinate responses to emerging threats [13].

[20] 1

16 Ineffective response to threats An effective response to threats/hazards is challenging, as collaboration of various organizations is required to identify, allocate, transport and deliver resources [19].

[7] 1

17 Ineffective communication with the public In a threat/hazard, public expect authorities to reduce anxiety and provide information of what is undergoing.

[7] 1

18 Technical Human error It refers to accidental errors made by workers which are caused by working environment, such as poor lighting, complexity in processes and inadequate communications.

[24][18][3] 3

19 Physical component failure It refers to damages to CIs components and infrastructures cannot function with the survived elements.

[22] [18] 2

20 Equipment failure Equipment stop working or fails to meet intended expectations. [23] 1 21 Technical damages Technical damages include damages to information systems

and control or monitoring systems [28]. [18] 1

22 Under rate maintenance Regular maintenance is required to keep CIs in a good condition. In addition, increasing load on CIs require additional attention on maintenance [22].

[22] 1

23 Operational Unclear responsibility, lack of experience and issues of power and trust

Personnel are incompetent to respond threat/hazard, because of inadequate training [30].

[26][21] 2

24 Unavailability of personnel The absence of one type of competent personnel might lead to incorrect decisions and might cause incidents [30].

[21] 1

25 Conflicting interests Conflicting goals for exercise might cause confusions in participants who are unable to focus on the solution to the given problems [30].

[21] 1

26 Financial [10][34] 2

(continued on next page)

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

7

because CIs are normally fixed assets [40]. In addition, a great number of infrastructures are subject to threats of terrorism, including buildings, bridges, airports, and nuclear facilities, and terrorists could choose several CIs as potential targets [55]. However, it is difficult to predict a deliberate attack and materialize the subsequent consequences [13]. Terrorists could purposely maximize losses on society and economy through disruption of essential services, such as electricity systems, transport infrastructures and public healthcare [40].

There are different types of terrorist activities: (1) hijacks of CIs (such as transportation means) (2) destruction of part or entire CIs infra- structure (including setting fires, explosives, and shooting down); and (3) chemical and biological attack, including spraying of toxins, viruses, bacteria and hazardous chemicals [28]. Specifically, chemical and bio- logical attack would not only contaminate environment, but also potentially lead to the loss of customers [14]. For instance, although minimal rates of mortality or morbidity are caused by chemical or bio- logical attack and its following consequences (such as water contami- nation), the acceptance level of water which is subject to contamination is low [14]. However, there is a high degree of uncertainty about terrorism related threats, and its consequences rely on the time of the day of the attack [55]. It is of great importance to analyse historical events, consider threat scenarios, comprehensively understand the po- tential consequences of terrorist attacks and predict the probability of future attacks [56]. In addition, governments in some countries have released a great number of laws and documents to protect CIs from terrorism [56].

3.3.3. Cyber threats Along with the adoption of advanced technologies, operational ef-

ficiency and reliability of CIs are increasingly dependent on digital control systems and extensive networking resources [23]. Control sys- tems are widely used in many CIs, including smart grids, air traffic, transportation, electricity plants, and nuclear power plants [42], which are typically computer-based facilities [57]. Supervisory control and data acquisition (SCADA) systems are two categories of industrial con- trol systems, which remotely monitor and supervise processes and functions of CIs [23]. In modern society, CIs are moving from isolation into a ‘system-of-system’ environment [58]. Integration of CIs into public network, such as internet, is required to acquire real-time data and therefore enhance productivities [59]. However, since monitoring and controlling of CIs largely relies on internet, CIs becomes an attrac- tive target for cyber terrorism [42]. Serious consequences affecting performance, reliability and security of other CIs could be caused by a disrupted cyber infrastructure, because of heavy dependence on inte- grated systems [1].

In recent years, cyber-attacks have become more frequent than previous, because the time required for preparing an attack has reduced and sophisticated technologies could be used to attack CIs easily [60].

These attacks could be complex and sophisticated, which exploit the cyber and physical characteristics of CIs and therefore result in signifi- cant damages [58]. Apparently, an immediate response to cyber-attacks is difficult, because of inadequate experts in analysing and responding to these attacks [60]. For instance, the internet computer worm ‘slammer’ penetrated the core of control systems at a nuclear power plant in Ohio in August 2003 and infected more than 90% of vulnerable hosts in 10 min [58]. In addition, different security goals of organizations would largely determine the approaches used to secure the integrated CIs network and the diversity in design patterns would provide attack entry points into CIs network [59]. Although there are constructions of secu- rity operation centres in place now, preventing CIs from cyber-attacks is still extremely difficult, because security events are too many to be analyse and respond [60].

3.3.4. Ageing and decay Ageing infrastructure is a common problem to CIs resilience [33].

Interruption of CIs could be caused by old or antiquated components. This is because ageing is often associated with an increase in the vulnerability of infrastructures. The ageing of CIs (including hardware, software, database, communication networks, and transformers) often leads to unreliable and untrustworthy systems and therefore increases potentials to threats and related attacks [61], which also makes lifelines protection more difficult [36]. Further, the global climate change has accelerated the speed of erosion and ageing of CIs [62] and this is because of the increased in intensity of natural disasters. In fact, the concentration of population in urban areas (50% of populations living in urban areas) can also not be overlooked when it comes to the ageing and decay threat. This is because CIs are in a high demand, therefore they are being overloaded to satisfy the increase in demand. This ends up accelerating the rate of erosion and ageing of CIs [36].

The issue of ageing infrastructure has been on the rise in recent years in many countries. This is because several CIs equipment were con- structed or installed between the period of 1950s to early 1960s(after World War II), and these CIs and equipment are coming to the end of their useful life [63]. However, maintenance of CIs requires adequate amount of fiscal investment to keep the CI elements and network in a ‘good condition’ [22]. Aside CIs becoming older, the operating costs of CIs has also increased drastically [63]. Essentially, around $3.6 trillion is estimated to be required to meet the operation costs and future main- tenance of a CI for a period of five years [22].

3.3.5. Contamination There is an increasing concern in safety and security of water dis-

tribution systems (a type of CI), because they are vulnerable to chemical, biological and radiological contaminants [64]. When contaminants accidentally or intentionally enter public water supply systems, the contaminated water might cause illness, reduce trust in reliability of

Table 2 (continued )

Ref Threats/hazards Description References (Refer to Table 1)

Total

Financial challenges (such as economic downturns, no revenues for maintenance)

Ongoing operation and maintenance costs require adequate investment to ensure operation of CIs. Financial challenges can interfere with planned maintenance [22].

27 Interest rates instability Interest rates instability would impact borrowing cost and investment earnings.

[7] 1

28 Exchange rates instability [22] 1 29 Generic Cascading failure The CIs network is highly interconnected and complex.

Disruption or failure of a single CI could lead to cascading effects in other CIs.

[14][15][25][11][32] [26][1][27][16][6] [28][17]

12

30 Supply shortage Supply shortage could negatively impact normal operation of CIs. For instance, a lack in water supply would affect the electricity generation in power plants (Rübbelke and Vögele, 2011).

[24][23] 2

31 Loss of customers Customers disrupted by failures of CIs might undergo direct losses and therefore loss confidence (Pant et al., 2018).

[24] 1

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

8

water distribution systems and interrupt use of water for non-consumptive purpose (including firefighting) [65]. In addition, a contamination event might lead to changes in consumers’ behaviours. Certainly, customers are unwilling to use contaminated water and reduce their water demands [14].

Managing the threats from contamination is of great importance. Proper allocation of resources is critical to protect water utilities from possible events [65]. In addition, there exist several technologies to detect and identify viruses and pathogens [64], for example, one effec- tive water treatment process such as filtration can be used to remove many common organisms [66].

3.3.6. Cascading failure/threat CIs network is a complex system, which is highly interdependent. In

order to ensure distribution of essential services, social stability and economic prosperity, CIs are coupled and mutually dependent on each other [67]. However, a cascading failure can occur due to the high de- pendency of CIs on each other. In fact, one CI could cause the breakdown of multiple CIs [67]. Cascading failure/threat could be caused by various factors, including terrorism, and natural hazards. In fact, cascading failure has the possibility to amplify costs and casualties which will be as a result of the failure of single CI [3]. For instance, Northeast blackout of 2003 in the United State caused a major disruption in transportation (including trains and subways), loss of water pressure, disruption in cellular communication devices, and shutdown of industries [67].

Four types of interdependencies were identified in previous studies: (1) physical; (2) geographic; (3) cyber; and (4) logical [1,68]. A physical

interdependency exists when the operation of a CI depends on the re- sources or raw materials from other CIs [1,68]. A geographical inter- dependency presents a spatial proximity of CIs, such as power-oil transmission systems and road–railway transportation systems [69]. While a dependency of information and communication systems results in a cyber interdependency of CIs, a logical interdependency presents a connection between one agent in one CI with an agent in another CI, which are not physical, geographical or cyber interdependent [1].

Nevertheless, because of the highly interdependencies of CIs, the frequency of disasters which the CIs are faced with appears an increasing trend [69]. The interdependency is a concern to governments; therefore, efforts should be made to develop a proper plan on the management of CIs interdependencies. This will help protect the chain of in- terdependencies of CI systems, thereby ensuring a more CI resilience development.

3.4. Conceptual framework on the threats/hazards affecting the building of CIs resilience

Fig. 3 presents a conceptual framework of different classes of threats/hazards to governments efforts to develop CI resilience. Essen- tially, the conceptual framework shows the proposed interrelations and clusters of the eight different categories of threats to governments effort to build CIs resilience. The proposed interrelations and clusters pre- sented in the framework is developed based on the description of the 31 threats/hazard identified in the targeted papers. As mentioned previ- ously, in this study, the 31 threats/hazards identified from past studies

Environmental

Social Managerial

PoliticalTechnical

Operational FinancialOthers

Organisation al cluster

Socio-political and economic cluster

Fig. 3. Conceptual framework for threats in building CIs resilience.

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

9

were divided into eight different groups: environmental, social, politi- cal, managerial, technical, operational, financial and generic, based on the commonalities and differences among these threats/hazards. Although these threats/hazards have been classified into specific groups, some of them could belong to other categories based on their characteristics.

Overall, threats/hazards under categories of ‘environmental’, ‘so- cial’, ‘political’, ‘managerial’, ‘technical’, ‘operational’ and ‘financial’ have the potential to negatively impact on governments efforts to develop CI resilience. Essentially, the ‘managerial’, ‘technical’ and ‘operational’ categories belongs to one cluster which can be termed as organisational cluster, whereas the environmental, social, and political also belong to one cluster, namely, socio-political and economic cluster. This is because of the similarities of the threats under each category.

4. Recommendations for future practice and research

Considering the pioneering nature of this review paper in CI resil- ience research domain, the findings of this paper or study make signif- icant contributions to practice and future research. The outputs of this research will inform policy makers and governments of the strategic measures they can develop to build CI resilience. Based on the findings of this research, some proposed strategies that can be adopted by gov- ernments to overcome the threats include;

1. Countries should develop both their public and private organisa- tional capacities to build CI resilience. Essentially the organisational capacity should focus on the managerial, technology and operational aspects. For managerial, there should be a proper communication channel between public institutions and CI operators to enhance the rapid exchange of critical information relating to CI subsystems. Also, risk mitigation plans should be prepared and evaluated frequently to help resolve any unexpected attacks to CI systems. For the technology aspect, frequent maintenance of equipment and tools and the update of firewall software relating to CI systems should be done. On operational aspect, both public institutions and CI opera- tors should continuously build the capacity of their staff or em- ployees so that they will be informed of the latest information and knowledge in relation to the management of CI systems.

2. The socio-political and economic situation of a country also have huge impact on the efforts to build CI resilience. Within the social context, it is proposed that countries should continuously evaluate their security threats particularly terrorist attacks to CI systems. Also, controlling the rapid growth rate in urban areas is critical when building CI resilience. For political aspect, countries should try as much as possible to build political consensus on issues and policies related to CI systems and resilience. Additionally, political unrests should be minimized as they can greatly impede the development of CI resilience. On the economic aspect, countries should maintain stable macro-economic indicators such as interest and exchange rates. This is crucial to enable CI operators to continuously raise funds in the country’s financial market to effectively operate and manage CI systems.

For future research directions, undoubtedly, the threats and hazards presented in this study are enormous and would require significant ef- forts from governments to deal with. This will pose a huge burden on the national resource in terms of human capacity; therefore, it is recom- mended that collaborations between the private sector and governments should be strengthened to address these threats [6]. It is recommended that more research should be conducted on the adoption of public-private partnership in the development of CI resilience. More future research efforts on CIs should be channelled into the effective development of CI resilience through Public-Private Partnership (PPP) and its risk assessment.

5. Conclusions

In modern society, CIs are physically and logically essential to sup- port public welfare, economic growth and government function. How- ever, the complicated interdependencies of CIs brings difficulties in management of potential crisis. CIs resilience has become one critical goal in crisis management and CIs protection, which ensures security and reliability of the whole CIs network. There exist various threats/ hazards leading to disruptions/failures of CIs, which inevitably damage performance of CIs and therefore cause severe loss in society and economy. Detailed understanding of threats/hazards and their impacts on a CI could improve preparedness for ahead of time, reduce vulnera- bilities of CI to certain threats, improve the efficiency of response. A great collection of past studies has investigated threats/hazards which could lead to failure/disruptions of CIs. However, the focus of majority studies was on specific threat/hazard in certain CI sectors. The holistic examination of existing literatures on threats/hazards in CIs are insuf- ficient. This study aimed to conduct a systematic review to explore the potential threats/hazards to CIs resilience from literatures between 1990 and 2020.

A three-stage systematic review process was adopted in this study and a total of 34 papers were selected. Over the past two decades, re- searchers’ interests in exploring the threats/hazards in CIs resilience has increased, from 0 publication during the period from 1990 to 2000 to 5 publications in 2020. The three most active authors were Hurst, W., Merabti, M., and Fergus, P. who have published two papers in related fields. United States and United Kingdom had the highest number of publications from 1990 to 2020. The two countries have recognised the importance of CIs resilience and taken measures to eliminate effects from threats/hazards, in order to enhance CIs resilience. In addition, a total of 31 threats/hazards were identified from target papers, and these threats/hazards were classified into eight groups: environmental, social, political, managerial, technical, operational, financial and generic (others). The most emphasized threats/hazards were: (1) natural di- sasters, (2) ageing and decay, (3) cyber threats, (4) terrorist activities, (5) contamination, (6) cascading failure.

Findings of this study will provide a solid foundation for future research on threats/hazards in CIs resilience. First, the checklist of threats/hazard to CIs resilience and conceptual framework will inform governments, policy makers and operators of CIs of the salient risks and barriers to the development of CI resilience. In fact, this will help countries develop resilience against any form of threats and disruption in the day-to-day activities of their citizens. Second, the findings of this research, will provide a solid knowledge base and foundation for the on- going international debate on the need for countries to consider devel- oping CI resilience in addition to existing measures to protect CIs. Essentially, the list of threats presented in this study, will guide inter- national conversations in this domain. Further, the most productive countries and institutions will inform researchers of the active writers and institutions who may be available for possible collaboration on further research on CI resilience.

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

References

[1] C. Alcaraz, S. Zeadally, Critical infrastructure protection: requirements and challenges for the 21st century, International Journal of Critical Infrastructure Protection 8 (2015) 53–66.

[2] M. Ouyang, Review on modeling and simulation of interdependent critical infrastructure systems, Reliab. Eng. Syst. Saf. 121 (2014) 43–60.

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

10

[3] Z. Zhang, X. Li, H. Li, A quantitative approach for assessing the critical nodal and linear elements of a railway infrastructure, International Journal of Critical Infrastructure Protection 8 (2015) 3–15.

[4] A. Abou El Kalam, Y. Deswarte, A. Baïna, M. Kaâniche, A security framework for critical infrastructures, International Journal of Critical Infrastructure Protection 2 (2009) 154–169.

[5] P. Chen, C. Scown, H.S. Matthews, J.H. Garrett, C. Hendrickson, Managing critical infrastructure interdependence through economic input-output methods, J. Infrastruct. Syst. 15 (2009) 200–210.

[6] D. Rehak, P. Senovsky, S. Slivkova, Resilience of critical infrastructure elements and its main factors, Systems 6 (2) (2018) 21, https://doi.org/10.3390/ systems6020021.

[7] M. Ouyang, Y. Fang, A mathematical framework to optimize critical infrastructure resilience against intentional attacks: a mathematical framework to optimize CI resilience, Comput. Aided Civ. Infrastruct. Eng. 32 (2017) 909–929.

[8] Y.-P. Fang, G. Sansavini, Optimum post-disruption restoration under uncertainty for enhancing critical infrastructure resilience, Reliab. Eng. Syst. Saf. 185 (2019) 1–11.

[9] J.U. Klügel, Risk and hazard assessment of extreme natural events for critical infrastructures, International Journal of Safety and Security Engineering 6 (2016) 96–103.

[10] R. Merli, M. Preziosi, A. Acampora, How do scholars approach the circular economy? A systematic literature review, J. Clean. Prod. 178 (2018) 703–722.

[11] R. Osei-Kyei, A.P.C. Chan, Review of studies on the critical success factors for public–private partnership (PPP) projects from 1990 to 2013, Int. J. Proj. Manag. 33 (2015) 1335–1346.

[12] H. Yi, Y. Wang, Trend of the research on public funded projects, Open Construct. Build Technol. J. 7 (2013) 51–62.

[13] E. Michel-Kerjan, New challenges in critical infrastructures: a US perspective, J. Contingencies Crisis Manag. 11 (2003) 132–141.

[14] G.B. Baecher, Mitigating Water Supply System Vulnerabilities, Protection of Civilian Infrastructure from Acts of Terrorism, 2006, pp. 149–157.

[15] T. Thedéen, Setting the stage: the vulnerability of critical infrastructures, J. Konbin 27 (2006) 33–40.

[16] J.P. Burgess, Social values and material threat: the European Programme for critical infrastructure protection, Int. J. Crit. Infrastruct. 3 (3–4) (2007) 471–487.

[17] M. Masera, I.N. Fovino, R. Leszczyna, Security assessment of a turbo-gas power plant. International Conference on Critical Infrastructure Protection, Springer US, Boston, MA: Boston, MA, 2009.

[18] H. Li, G.E. Apostolakis, J. Gifun, W. VanSchalkwyk, S. Leite, D. Barber, Ranking the risks from multiple hazards in a small community, Risk Anal.: Int. J. 29 (3) (2009) 438–456.

[19] C. Ansell, A. Boin, A. Keller, Managing transboundary crises: identifying the building blocks of an effective response system, J. Contingencies Crisis Manag. 18 (4) (2010) 195–207.

[20] Y. Huang, Y. Fan, Modeling uncertainties in emergency service resource allocation, J. Infrastruct. Syst. 17 (1) (2011) 35–41.

[21] D.A. Novelo-Casanova, G. Suarez, Exposure of main critical facilities to natural and man-made hazards in Grand Cayman, Cayman Islands, Nat. Hazards 61 (3) (2012) 1277–1292.

[22] G. Armbruster, B. Endicott-Popovsky, J. Whittington, Threats to municipal information systems posed by aging infrastructure, International Journal of Critical Infrastructure Protection 6 (2013) 123–131.

[23] W. Hurst, M. Merabti, P. Fergus, A survey of critical infrastructure security, International Journal of Critical Infrastructure Protection 441 (2014) 127–138.

[24] W. Hurst, M. Merabti, S. Iram, P. Fergus, Protecting critical infrastructures through behavioural observation, Int. J. Crit. Infrastruct. 10 (2) (2014) 174–192.

[25] G. Wilson, T.M. Wilson, N.I. Deligne, J.W. Cole, Volcanic hazard impacts to critical infrastructure: a review, J. Volcanol. Geoth. Res. 286 (2014) 148–182.

[26] A. Laugé, J. Hernantes, J.M. Sarriegi, Critical infrastructure dependencies: a holistic, dynamic and quantitative approach, International Journal of Critical Infrastructure Protection 8 (2015) 16–23.

[27] A. Apan, K. McDougall, Vulnerability assessment and interdependency analysis of critical infrastructures for climate adaptation and flood mitigation. International Journal of Disaster Resilience in the Built Environment, 2015.

[28] M. Siergiejczyk, P. Dziula, Threats to transport systems catalogue, J. Konbin 27 (2015) 23–30.

[29] C. Pathirage, K. Al-Khaili, Disaster Vulnerability of Emirati Energy Sector and Barriers to Enhance Resilience, Built Environment Project and Asset Management, 2016.

[30] M. Bartnes, N.B. Moe, Challenges in IT security preparedness exercises: a case study, Comput. Secur. 67 (2017) 280–290.

[31] C. Ongkowijoyo, H. Doloi, Determining critical infrastructure risks using social network analysis. International Journal of Disaster Resilience in the Built Environment, 2017.

[32] Z. Bie, Y. Lin, G. Li, F. Li, Battling the extreme: a study on the power system resilience, Proc. IEEE 105 (7) (2017) 1253–1266.

[33] V.C. Tidwell, T.S. Lowry, D. Binning, J. Graves, W.J. Peplinski, R. Mitchell, Framework for shared drinking water risk assessment, International Journal of Critical Infrastructure Protection 24 (2019) 37–47.

[34] J. Banerjee, K. Basu, A. Sen, On hardening problems in critical infrastructure systems, International Journal of Critical Infrastructure Protection 23 (2018) 49–67.

[35] A. Cedergren, J. Johansson, H. Hassel, Challenges to critical infrastructure resilience in an institutionally fragmented setting, Saf. Sci. 110 (2018) 51–58.

[36] D. Serre, C. Heinzlef, Assessing and mapping urban resilience to floods with respect to cascading effects through critical infrastructure networks, International Journal of Disaster Risk Reduction 30 (2018) 235–243.

[37] C. Curt, J.M. Tacnet, Resilience of critical infrastructures: review and analysis of current approaches, Risk Anal. 38 (11) (2018) 2441–2458.

[38] H. Kure, S. Islam, Cyber threat intelligence for improving cybersecurity and risk management in critical infrastructure, J. Univers. Comput. Sci. 25 (11) (2019) 1478–1502.

[39] A. Assad, O. Moselhi, T. Zayed, A new metric for assessing resilience of water distribution networks, Water 11 (8) (2019) 1701.

[40] S. Karakitsios, R. Busker, T. Tjärnhage, P. Armand, M. Dybwad, M.F. Nielsen, J. Burman, J. Burke, J. Brinek, J. Bartzis, T. Maggos, M. Theocharidou, P. Gattinesi, G. Giannopoulos, D. Sarigiannis, Challenges on detection, identification and monitoring of indoor airborne chemical-biological agents, Saf. Sci. 129 (2020) 104789.

[41] A. Panda, A. Bower, Cyber security and the disaster resilience framework. International Journal of Disaster Resilience in the Built Environment, 2020.

[42] M.Z. Gunduz, R. Das, Cyber-security on smart grid: threats and potential solutions, Comput. Network. 169 (2020) 107094.

[43] D. Govindarajulu, Strengthening institutional and financial mechanisms for building urban resilience in India, International Journal of Disaster Risk Reduction 47 (2020) 101549.

[44] Y. Cui, N. Quddus, C.V. Mashuga, Bayesian network and game theory risk assessment model for third-party damage to oil and gas pipelines, Process Saf. Environ. Protect. 134 (2020) 178–188.

[45] C. Pursiainen, Critical infrastructure resilience: a Nordic model in the making? International Journal of Disaster Risk Reduction 27 (2018) 632–641.

[46] J.M. Yusta, G.J. Correa, R. Lacal-Arántegui, Methodologies and applications for critical infrastructure protection: state-of-the-art, Energy Pol. 39 (2011) 6100–6119.

[47] W. Liu, Z. Song, Review of studies on the resilience of urban critical infrastructure networks, Reliab. Eng. Syst. Saf. 193 (2020) 106617.

[48] F.D.P. Petit, G.W. Bassett, R. Black, Resilience Measurement Index: an Indicator of Critical Infrastructure Resilience, U.S. Department of Energy, United States, 2013.

[49] S.X. Zeng, H.Y. Ma, H. Lin, R.C. Zeng, V.W.Y. Tam, Social responsibility of major infrastructure projects in China, Int. J. Proj. Manag. 33 (2015) 537–548.

[50] T.M. Wilson, C. Stewart, V. Sword-Daniels, G.S. Leonard, D.M. Johnston, J.W. Cole, J. Wardman, G. Wilson, S.T. Barnard, Volcanic ash impacts on critical infrastructure, Phys. Chem. Earth 45–46 (2012) 5–23.

[51] M. Perry, Natural disaster management planning: a study of logistics managers responding to the tsunami, Int. J. Phys. Distrib. Logist. Manag. 37 (2007) 409–433.

[52] L.M. Shakou, J.-L. Wybo, G. Reniers, G. Boustras, Developing an innovative framework for enhancing the resilience of critical infrastructure to climate change, Saf. Sci. 118 (2019) 364–378.

[53] G.M. Karagiannis, Z.I. Turksezer, L. Alfieri, L. Feyen, E. Krausmann, Climate Change and Critical Infrastructure – Floods Joint Research, Centre European Commission, 2017.

[54] E. Krausmann, S. Girgin, A. Necci, Natural hazard impacts on industry and critical infrastructure: natech risk drivers and risk management performance indicators, International Journal of Disaster Risk Reduction 40 (2019) 101163.

[55] M.G. Stewart, Risk-informed decision support for assessing the costs and benefits of counter-terrorism protective measures for infrastructure, International Journal of Critical Infrastructure Protection 3 (2010) 29–40.

[56] R. Zimmerman, C. Restrepo, N. Dooskin, J. Fraissinet, R. Hartwell, J. Miller, W. Remington, Diagnostic tools to estimate consequences of terrorism attacks against critical infrastructure, in: Proceedings of the US Department of Homeland Security Conference, 2004 New York, U.S., 2004, pp. 1–10.

[57] D.H. Ryu, H. Kim, K. Um, Reducing security vulnerabilities for critical infrastructure, J. Loss Prev. Process. Ind. 22 (2009) 1020–1024.

[58] B. Genge, I. Kiss, P. Haller, A system dynamics approach for assessing the impact of cyber attacks on critical infrastructures, International Journal of Critical Infrastructure Protection 10 (2015) 3–17.

[59] A. Zimba, Z. Wang, H. Chen, Multi-stage crypto ransomware attacks: a new emerging cyber threat to critical infrastructure and industrial control systems, ICT Express 4 (2018) 14–18.

[60] C.-H. Han, S.-T. Park, S.-J. Lee, The enhanced security control model for critical infrastructures with the blocking prioritization process to cyber threats in power system, International Journal of Critical Infrastructure Protection 26 (2019) 100312.

[61] S. Tweneboah-Koduah, R. Prasad, The Threats of infrastructure obsolescence to smart grid: a case study, Wireless Pers. Commun. 114 (2020) 1025–1043.

[62] E. Bellini, E. Gaitanidou, E. Bekiaris, P. Ferreira, The RESOLUTE project’s European Resilience Management Guidelines for Critical Infrastructure: development, operationalisation and testing for the urban transport system, Environment Systems & Decisions 40 (2020) 321–341.

[63] R.E. Brown, H.L. Willis, The economics of aging infrastructure, Power and Energy Magazine 4 (2006) 36–43.

[64] H. John, D.Z. Alan, M. Randall B, C.K.E. Paul, K. Radha, H. Roy C, H. Jonathan G, On-line water quality parameters as indicators of distribution system contamination, J. Am. Water Works Assoc. 99 (2007) 66–77.

[65] A. Rasekh, M.E. Shafiee, E. Zechman, K. Brumbelow, Sociotechnical risk assessment for water distribution system contamination threats, J. Hydroinf. 16 (2014) 531–549.

[66] R.M. Clark, R.A. Deininger, Protecting the nation’s critical infrastructure: the vulnerability of U.S. water supply systems, J. Contingencies Crisis Manag. 8 (2000) 73–80.

R. Osei-Kyei et al.

International Journal of Disaster Risk Reduction 60 (2021) 102316

11

[67] B. Wu, A. Tang, J. Wu, Modeling cascading failures in interdependent infrastructures under terrorist attacks, Reliab. Eng. Syst. Saf. 147 (2016) 1–8.

[68] S.M. Rinaldi, J.P. Peerenboom, T.K. Kelly, Identifying, understanding, and analyzing critical infrastructure interdependencies, IEEE Contr. Syst. Mag. 21 (6) (2001) 11–25.

[69] W. Wang, S. Yang, F. Hu, H.E. Stanley, S. He, M. Shi, An approach for cascading effects within critical infrastructure systems, Phys. Stat. Mech. Appl. 510 (2018) 164–177.

R. Osei-Kyei et al.