General Introduction | Module 5 - Risk Analysis and Risk Management | CriticalEnergyNetworks101 Courseware

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@170e71c25d6142d2bd337afc4cc06597" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@329a1980d9fc4ca2a9713d5320dc65a3"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@329a1980d9fc4ca2a9713d5320dc65a3" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p style="text-align: center;"><span style="font-size: 20pt !important; color: #003478; font-weight: bold !important;">Risk Analysis, Emerging Threats, and Risk Management</span></p> <p style="text-align: left;"><span style="font-size: 14pt !important; color: black; font-weight: bold !important; font-style: italic !important;">“We need enough mitigation to avoid the unmanageable, and enough adaptation to manage the unavoidable”</span><i> – Donald J. Wuebbles, University of Illinois<a href="https://www.anl.gov/reference/america-resilient-climate-conference-report" target="_blank"> (Argonne America Resilient Climate Conference, 2021)</a></i></p> <p>This module serves as an introduction to more advanced risk analysis concepts and seeks to provide students with an overview of hybrid or emerging threats and systemic risks, and how the concepts seen in previous modules fit into a risk management process.</p> <p style="color: #003478;">Check the following video to see why considering emerging threats is important.</p> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5d08732028f74cb2a3879281ef52a8d6"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5d08732028f74cb2a3879281ef52a8d6" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p style="text-align: center"><iframe src="https://player.vimeo.com/video/551946049" width="640" height="564" frameborder="0" allow="autoplay; fullscreen" allowfullscreen></iframe></p> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@4e6e8a93fdd94a31a2c6ee8b30af940a"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@4e6e8a93fdd94a31a2c6ee8b30af940a" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Topics and Learning Objectives</span></p> <p>This module serves as an introduction to more advanced risk assessment concepts and seeks to provide students with an overview of hybrid or emerging threats and systemic risks, and how the concepts seen in previous modules fit into a risk management process.</p> <table> <thead> <tr> <th style="border: 1px solid black; color: #003478; font-weight: bold !important; text-decoration: underline !important;"> Topics </th> <th style="border: 1px solid black; color: #003478; font-weight: bold !important; text-decoration: underline !important;"> Learning Objectives </th> </tr> </thead> <tbody> <tr> <td style="border: 1px solid black; color: black;"> <ul> <li>Advanced risk analysis concepts</li> <li>Emerging and Hybrid Threats</li> <li>Systemic Risks</li> </ul> </td> <td style="border: 1px solid black; color: black; background-color: rgba(0,136,198,.30);"> <ul> <li>Apply fundamentals of analytic tradecraft and critical thinking for risk analysis</li> <li>Understand emerging and hybrid threats</li> <li>Understand the concept of systemic risks</li> </ul> </td> </tr> </tbody> </table> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@7dbf5c22a57649b8a556fa037000c091"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@7dbf5c22a57649b8a556fa037000c091" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p>To achieve these objectives, this module is subdivided into three sections:<o:p></o:p></p> <ul> <li><span style="color:#003478; font-weight: bold !important">Section 1</span> presents a discussion among experts on the challenges encountered for considering emerging and hybrid threats for risk analysis applied to critical energy infrastructure and critical infrastructure systems.</li> <li><span style="color:#003478; font-weight: bold !important">Section 2</span> presents advanced risk analysis concepts and the risk analysis challenges.</li> <li><span style="color:#003478; font-weight: bold !important">Section 3</span> discusses the concepts of emerging and hybrid threats, and systemic risks and the challenges associated to their analysis.</li> <li><span style="color:#003478; font-weight: bold !important">Section 4</span> discusses the concepts of critical thinking.</li> <li><span style="color:#003478; font-weight: bold !important">Section 5</span> presents the risk management cycle.</li> <li><span style="color:#003478; font-weight: bold !important">Section 6</span> summarizes the important concepts presented in this module.</li> </ul> <p>At the end of the module, students will find a quiz to test their knowledge and to determine whether they need to review any of risk analysis advanced concepts.<br/><br/> Finally, additional readings are also proposed to deepen their knowledge on emerging threats, risk analysis, and risk management.</p> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@2f6e1106a95e457ebb5e813fc2863874" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e093b0ffefff48698cde65fe265dbdb8"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e093b0ffefff48698cde65fe265dbdb8" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p>In the video podcast below, <span style="color: #003478; font-weight: bold !important;">Dr. Sarah Lohmann</span>, <span style="color: #003478; font-weight: bold !important;">Mr. Mark Prouse</span>, <span style="color: #003478; font-weight: bold !important;">Mr. Michael Rühle</span>, <span style="color: #003478; font-weight: bold !important;">Mr. Jukka Savolainen</span>, and <span style="color: #003478; font-weight: bold !important;">M. Duane Verner</span> discuss the importance for decision-makers and analysts to consider emerging threats and systemic risks in risk analysis processes to enhance the security and resilience of energy networks and critical infrastructure systems.<br/><br/> The discussion specifically addresses the following questions: <ul> <li>Why is it important for public officials to understand emerging threats to infrastructure systems?</li> <li>What are the main challenges of assessing of assessing emerging threats?</li> <li>What data and modeling capabilities assessment methodology is broadening know?</li> <li>How does the confluence of geopolitics in critical infrastructure dependency influence risk?</li> </ul><br/> <span style="color: #003478;">Click on the video below to watch the discussion on emerging and hybrid threats.</span> </p> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@8cd539d20e7d40ce9d4ce5600d8c4629"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@8cd539d20e7d40ce9d4ce5600d8c4629" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p style="text-align: center"><iframe src="https://player.vimeo.com/video/646530398?h=26b9db076c" width="640" height="400" frameborder="0" allow="autoplay; fullscreen" allowfullscreen></iframe></p> <p><span style="color: #003478;">Expand the accordions below to view the discussion transcript and the expert bios.</span></p> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@a68dc5adcfdd4fd6bce6ced419aad0cf"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@a68dc5adcfdd4fd6bce6ced419aad0cf" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Video Podcast Transcript</button> <div class="panel"> <table> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left; font-weight: bold !important;" colspan="1">00:00 - General Introduction</td> </tr> <tr> <td style="background-color:white; ">Welcome to “Risk Analysis and Emerging Threats,” a component of the training “Critical Energy Networks: from Risk Analysis to Risk Management,” of the OSCE Virtual Centre for the protection of critical energy infrastructure.<br/><br/> This presentation is an informal discussion among experts on the importance of considering emerging threats and systemic risks for decision-makers and analysts.<br/><br/> <b>Mr. Duane Verner:</b> Thank you everybody once again for joining. My name is Duane Verner from Argonne National Laboratory. I will be the moderator today and we will start the discussion with brief introductions, and we will start with Doctor Sarah Lohman. Over to you.<br/><br/> <b>Dr. Sarah Lohmann:</b> Thank you for having me here today. I am a visiting professor at the US Army War College as well as a professor at the University of Washington, and the cyber lead of the NATO STO Project, Energy Security in an area of hybrid warfare.<br/><br/>So, what do we need to be looking at today? Our security must be more proactive and future proofed. So, methods of foresight analysis should always include risk management, but we need to make sure that we allow for the Black Swan events: that is what is unexpected. When we talk about emerging threats, we need to ensure we have factored in all kinds of actors, not just nation-state actors. So, we need to ensure we are looking at threats posed by vulnerabilities and emerging technology and how these vulnerabilities are increasingly used in hybrid warfare and cybercrime.<br/><br/>In conclusion, what is required of us to be good risk analysts in emerging threat environment? We have to be able to think ahead to these new vulnerabilities. We have to be able to prepare a strategy and provide security to defend against these new vulnerabilities, actors, and hybrid methods if we want our strategies to be future proofed.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Sarah. Over to you Mark.<br/><br/> <b>Mr. Mark Prouse:</b> Great. Thank you for having me today. I am Mark Prouse. I am a deputy director for the UK Government. My function, my role is really looking at the whole of the energy system whether the electricity, gas, or fuel supplies, and I am picking up on Sarah’s points, it is understanding what the risks to the essential services and the society, whether they be natural hazards, flooding, climate change, severe weather, technical failure, industrial action, or as we are discussing today, security threats, terrorism, state activity, hybrid activity that disrupts essential services to the public and ultimately hinders the freedom of the democratic states to operate in a way that it would like to in the rules-based international system.<br/><br/>Absolutely agree with what Sarah was saying, we are changing our approach to risk assessment, moving away from those traditional fixed bits of infrastructure and taking a systems approach and we can look at all threats and vulnerabilities, and particularly, we have seen this, I think, most evenly from COVID-19 over the last 18 months, not just the direct impacts of a disruptive activity, but also looks to actually in secondary in that can have such a devastating effect on society. As we become more interdependent, both nationally and internationally, more dependent on energy, particularly electricity as we move towards decarbonization, this is a really exciting time for the sector. But it is one that's fraught with opportunity and risk, and we need to be able to embrace both of those to develop ballistic mitigation strategies that ultimately keep the focus; the consumer understanding that energy is essential service that has security concerns we need to maintain. It is not a security sector that has an energy interest, and that's what we need to be bearing in mind as we move forward, and that is my job to look at the here and now, but also have one strong eye to the future so that we can future proof those systems, particularly move through this. Here in an enormous transition as we need to decarbonized societies and new ways of working with our energy systems. Thank you.<br/><br/> <b>Mr. Duane Verner:</b> Thank you, Mark. Over to you Michael.<br/><br/> <b>Mr. Michael Ruehle:</b> Hi Mike Ruehle. and I am the head of the Hybrid Challenges and Energy Security section in the Emerging Security Challenges division at NATO. We are struggling with, I think, a major shift in international security, traditional notions of military security were state centric, and they were focused on the defensive borders and territories against aggression by other states. Now, today, such scenarios are increasingly giving way to a complex mix of military and nonmilitary threats that can also affect societies from within the range from targeted manmade threats, such as cyberattacks for example, to broader phenomena, such as climate change or resource scarcity, and NATO, which is based on a very traditional notion of defense and deterrence of a piece of territory if you will.<br/><br/>For NATO this is quite a big change. In fact, the rise of deterritorialized and sometimes non kinetic threats create a whole new series of challenges. Cyberattacks, for example, have long been a tool for industrial espionage, but they have also become integraled to military campaigns today. Similarly, the effect of, let's say, politically motivated terrorism attacks, let's say against critical energy infrastructure, they were largely symbolic, but states’ sponsored attacks could have the goal, for example, of undermining a country's ability to build a coherent military response. This information can be used as a tool to destabilize the state. It can also be part of a hybrid approach to prepare for and then mask a direct military aggression against the neighboring states. Climate change, in turn, can increase the number and scale of natural disasters, with the military often being the first responder, in other words, also sometimes NATO, maybe the first military responder. But it can also aggravate conflicts between states or generate migration pressures for example. And traditional weapons such as tanks and fighter jets, they are usually owned by states, but cyber capabilities and other disruptive means are own mostly by the private sector and even by individuals.<br/><br/>So, we are talking about a completely different security environment. What can we do? Well, first of all, we need more analysis. We need more dialogue among allies. We need more sharing of best practices among allies. For example, how to deal with hybrid attacks. We meet more exercises so that we get a feel for all the things that can go wrong in the real world, and we need closer cooperation between institutions. That is all easier said and done, but we try our best to make this happen.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Michael and Jukka, over to you.<br/><br/> <b>Mr.Jukka Savolainen:</b> Hello. Thank you for this very kind invitation. I am Jukka Savolainen and I work in the European Center of Excellence for Countering Hybrid Threats, which is Helsinki-based arrangement for EU and NATO member states. I am director for Community of Interest for Vulnerabilities and Resilience and the Finnish second in the center.<br/><br/>I can only second what Michael was pointing out here that our modern society, which is quite urbanized, it has made the way of life solved in such a way that we are very dependent on critical systems such as power generation and supply, telecommunications, water cleaning and water distribution sewage, waste cleaning, healthcare, just name it. We are not doing everything at our home anymore and we are dependent on these systems, or we are very unhappy. Also, the goods we are consuming are developed through a very specialized production system. This means they are in most cases produced somewhere which is far from our own location, those goods that we want to consume.<br/><br/>And now, on this good side we are used to have a just-in-time delivery system, so there are almost no stores anywhere because that is bad for business; good should flow through a very long logistic chain directly to our close neighborhood. And all these systems are interdependent to each other and so failures in one part will lead to cascading effects everywhere else. When we add digitalization, which is there the final way of making this at mostly effective and efficient this system then we also find new vulnerabilities that I think we start only recognizing right now as Michael said to. Thank you.</td> </tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>09:02 – Importance for Public Officials to Understand Emerging Threats to Infrastructure Systems</b></td> </tr> <tr> <td style="background-color:white; "> <b>Mr. Duane Verner:</b> Thank you Jukka. Let us start the discussion now and we will start with the first question, which is why is it important for public officials to understand emerging threats to infrastructure systems? I am going to ask Michael first, but everybody chimes in as you see fit.<br/><br/> <b>Mr. Michael Ruehle:</b> Thank you, well. The first point is, from a NATO perspective, even to fulfill its very basic military tasks, NATO is increasingly dependent on civilian or privately owned infrastructure. For example, transport energy. Hence NATO officials, civilian as well as military, must understand the risks and the threats through this infrastructure because it has a direct effect on NATO's military performance. The second reason why public officials need to understand emerging threats to infrastructure is that our own infrastructure, mainly our military infrastructure, can be at risk, for example, as a result of climate change. Coastal maritime installations, for example, will be affected by rising sea levels, and this can have enormous financial implications and public officials who are asked to finance, for example, relocation need to know what's going on and what they are spending their money on. Third, the energy supply of deployed forces. For example, in forward operating bases is quite challenging, so it is important for decision makers to know these challenges and to learn how they can be overcome, for example, by new energy efficient technologies which lessen the logistical burden. Fourth, If the military is to make a contribution to the mitigation of climate change, and this is something that we, NATO, want to explore, for example, by reducing greenhouse gas emissions, leaders need to know how much fossil fuel is being consumed and how technology, such as renewables, biofuels, you name it, can probably help to bring down emissions. So, this is not just a matter for the specialists. This is an eminently political issue and, therefore, civilian decision makers also need to know what all this means. So, it is both for the military and for the civilian decision makers to learn more about infrastructure and about the challenges to their security.<br/><br/> <b>Mr. Duane Verner:</b> Great points. Mark, do you have any thoughts on that? Why is it important for decision makers to understand emerging threats?<br/><br/> <b>Mr. Mark Prouse:</b> Yes, I think Michael made some really good points there and I brought two out. One is climate change, and it is important to operations. I think everyone recognizes the challenges climate change presents in it is military operations, but it is also civil society. And as we gradually move toward a decarbonized economy, decarbonized energy systems, net zero environments, if you will, the energy sector needs to transition through that, so it needs to do so in a way that integrates security and resilience from the ground up. We all know retrofitting these security measures, these resilience measures later come at high cost to the consumers, to the governments, and to be able to do so in a stable way that takes advantage of the opportunities represented. Policymakers and the public sector need to be on top of this right now, and it is a really exciting time, I think, for the energy sector.<br/><br/>It is also an exciting time if we can use that language in the threat sector. Threats are evolving. There are new challenges we need to be on top of as public officials to protect citizens in society, and I think the decarbonization agenda is a really key part of that. And then it is the safety and security of our citizens that is the priority of any government, any state, as the first order. We are increasingly interdependent, internationally as well as domestically, and we are increasingly dependent on our energy systems. Society is arguably less resilient than it was 50-60 years ago perhaps. The importance of access to the Internet, said mobile telephone network. Communications is really key and what we need to be doing, as public officials, is not just understanding the impacts of disruption in an energy event, but the impacts that destruction of energy has on other critical services.</td> </tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>13:08 – Main Challenges of assessing Emerging Threats</b></td> </tr> <tr> <td style="background-color:white; "> <b>Mr. Duane Verner:</b> Thank you Mark. Sarah, what are the main challenges of assessing emerging threats? And it may be from taking that question from the cyber perspective.<br/><br/> <b>Dr. Sarah Lohmann:</b> Thanks. It is a great question. Threats are constantly evolving. So, in essence, the challenge is that we need to predict the unpredictable; means to assess events that have not yet come into play. So, we need to examine both the weaknesses in systems and in emerging technology, but also be thinking ahead to how newly developed technology can be mismanaged or misused by malicious actors. So, let us think about the way that we can communicate faster with ten times the volume via the 5th generation technology, what we are calling 5G. The cyber world connects everything, but at the same time, these emerging technologies that connect critical infrastructure also provide vulnerabilities. Basically, windows for malicious actors to enter with much greater impact on civilian populations than we have seen in the past, and that is what Mark was talking about. It is affecting the supply chains. It’s having ripple effects on civilian populations, on the military, on transportation, and on down the line. So, just as the Internet makes us more globalized, now, there are an infinite number of new threat factors that can be introduced due to that global connectedness. So, each new attack is different than the last, and so that deviation from normal behavior becomes difficult to measure. That is one of the main challenges, but the more we test and think outside of the box as to what potential malicious events could occur, in the future, the better will become at assessing those emerging threats.</td> </tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>14:53 – Data and Modeling capabilities</b></td> </tr> <tr> <td style="background-color:white; "> <b>M. Duane Verner:</b> Thanks Sarah. Mark picking up on Sarah's point about the challenges. What data and modeling capabilities assessment methodology and broadening? Sarah was focusing on cyber initially, but emerging threats are multidimensional. We are looking at climate. We are looking at hybrid. How do you approach that?<br/><br/> <b>Mr. Mark Prouse:</b> Sarah led to it. The complexity is enormous now and we need to be more than just security experts or energy experts. We need to bring the big data that the state and the private sector have access to, to assess those vulnerabilities, assess mitigation strategies, moving forward. And it is such a huge question and one the UK government is pushing, and it is a big learning from COVID-19 is all of the states are we have access to how we make it work for us as Society.<br/><br/>Part of that is about understanding what is critical, what is critical to those essential services to achieve the outcomes we need to support the modern state and then building on Sarah's vulnerability points. Where are those vulnerabilities? Where does the new technology, the new communications tool which makes our lives so much easier on some levels but introduce a much more complexity and vulnerability? Do we understand those?<br/><br/>From an energy specific perspective, I think it is understanding how the energy system has changed. It is very different even from what it looked like 10 years ago, but as we move through the next 10 years, the change will be enormous and understanding the way energy flows, the way our systems are set up to support them will be really key and bring in the private sector to support that assessment, the expertise they have got us is a really key part of it.<br/><br/>And interdependencies, I lead to this earlier, but understanding where those impacts can be felt by secondary and tertiary. By in large, we all know how to deal with a power cut. We know we need to torch, and we know we need to keep our key medicine nearby, water, and that sort of. Do we know how to cope with the power cut and no communications, a power cut and no water supply because the water pumps do not work. Understanding that second level of sophistication and it may be that in the contemporary society that the attack might initially target the energy sector, but the outcome and adversaries looking for, it actually realizes in a totally different sector, way out that field. So, mapping complexity of independent society and systems is really key. The last thing I would say on data really goes to that being more than a security expert. It is also understanding behavioral aspects. Bringing behavior scientists in understanding how people will really respond. This is really key, because societal resilience is everything. Societal resilience gives you the buffer to gear up the resources to the states to respond and to spoil your citizens. If it is not there, that has to happen much more quickly and also, and I think Michael would agree, emanate a perspective on how society responds when operations are taking place around them can really be a major challenge and obstacle to effective delivery, or it can be an enabler and enhance your capability. Bringing all of this together is how we improve our resilience is where we need to bring the data to build up capabilities.<br/><br/> <b>Mr. Duane Verner:</b> Thank you, how about that Michael, do you agree with Mark’s point about community society resilience.<br/><br/> <b>Mr. Michael Ruehle:</b> Yes, indeed. I do agree very much. In fact, there is a tendency now I think to look more into societal resilience, not just in technical resilience because, as Mark said, it is a psychological phenomenon that we need to look at.<br/><br/>Of course, we knew this since we were becoming victims all week, and victims of fake news, for example. How do we respond? How do we filter between what is true and what is fake in an era where deepfakes can be generated, which you can barely recognize as such? So, I think we have to teach especially younger generation which uses social media, for example, as their predominant instrument of information, how to better distinguish between truth and false? That is certainly not easy, but I think if you would neglect that part and we would focus only on technological issues, I think we would miss the biggest part of our picture. So, it is true we need to look at resilience as a very holistic concept, including its psychological dimensions.</td> </tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>19:27 – Influence on Risk of the Confluence of Geopolitics in Critical Infrastructure Dependency</b></td> </tr> <tr> <td style="background-color:white; "> <b>Mr. Duane Verner:</b> Thank you Michael. Jukka, how does the confluence of geopolitics in critical infrastructure dependency influence risk?<br/><br/> <b>Mr. Jukka Savolainen:</b> Well thank you. Such in question. These systems that we have been describing here, they are really vulnerable to two sorts of threats that have been seen very recently. They can be damaged through the cyber world by cyberattacks, where potentially the attribution meaning the capacity to say who did it is vague sometimes.<br/><br/>Actually, this opens a chance to use what could be called weapons of mass disturbance, meaning that by hitting u against these mainly privately owned systems, you can either create at least a huge distraction, meaning that the political opinion and public opinion, they do not find the point anymore because they get turned inwards because there are problems. And in worst case, this disturbance may lead to the disruption of serious systems, and a long-term or midterm loss of even military capabilities.<br/><br/>And there are some scenarios now. Then, of course, that it is about whether there is a sudden impact, and the attribution is made well. So, if we were hit by this kind of a big disturbance, but we know who did it, we get quite angry and we boost our capacities. We make a recovery, and we will give up boosted response quite soon. But if the adversary is clever enough, they will make this disturbance in the way that we are not able to do the attribution or we will even do a failing at the attribution, starting to blame some fellows that did not do it and used to be our friends. And this will lead to very interesting political consequences, this situation. And, of course, a failing attribution leads to vague or missing response to this aggression.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Jukka. Anyone else has any thoughts on the confluence of geopolitics in emerging threats? Mark, go ahead.<br/><br/> <b>Mr. Mark Prouse:</b> You can make some really good points there, and in particular is this touchpoint: the private sector and the relationship between threats that have traditionally been considered the responsibility of the state or international organizations like NATO. But actually, what we are seeing is increasingly the need for the private sector to play a critical role in security and resilience. Jukka alluded to such direct attacks on Society, and I think there is some really clear messaging there. There is also from a geopolitical perspective, the increasing foreign ownership of critical infrastructure, and this is a real opportunity investment. We need that investment to improve systems to modernize, to move towards that decarbonized society, and we should embrace that as open societies, but we need to do so in a secure manner and understanding how we bring in that foreign investment, its implications, the conurbation, the concurrency of that investment from potential competitors, or would be adversaries both now and in the future. And this has a national impact. It has an international impact, and I know Michael and his colleagues do a lot of work to look at this and what it means for the alliance. Critical courts were relying on who owns them. Will they be accessible to us? Developing a system and a framework to manage that risk, but still have an open society still bring in that investment is real key challenge an understanding where those risks might be leveraged not today, not tomorrow, but in five years, in 10 years’ time. What were the geopolitical situations look like? What vulnerability has been inadvertently introduced into our systems by not understanding the commercial aspects?</td> </tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>23:23 - CFinal Thoughts</b></td> </tr> <tr> <td style="background-color:white; "> <b>Mr. Duane Verner:</b> Thank you, Mark. OK, well this has been great and so at this point if you can take a minute to think about anything else you wanted to say and then you know we can go through those comments. Sarah, any other key points that you want to make?<br/><br/> <b>Ms. Sarah Lohmann:</b> I think we need to take the holistic perspective when we are talking about risk assessment. So, I think Mark made a really good point about having everyone sitting around the table. One challenge that we have seen is that utilities are often not asked to be at the table and so we end up seeing a separation, basically, of geopolitics, that policy process, and those who are involved in creating critical infrastructure, and those who are involved in protecting it. And so, if we include all of them in the creation of these mitigation strategies, it creates a stronger whole. We have seen dependencies on other nations for sourcing of critical infrastructure, and that can have a direct impact on national security when geopolitics is not taken into account, and attacks on critical infrastructure do not take place and avoid. They can cause ripple effects globally or serve as a response to an international security threat, and they can send warning or heightened tensions between nations, drive up oil prices, affect the stock market, turn the lights in heat out in winter and cause global insecurity. So, I do think that geopolitical indicators should be flowing into our early warning systems and risk models so that we do have better foresight to avoid direct threats to our critical infrastructure, and those can then in turn can have an impact on civilian life.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Sarah, and so I will go to you next Mark, but I also wanted to throw out a topic that I am personally very interested in and see if anybody has thoughts on the confluence of climate and security. So, the security consequences of climate change. Are we doing enough? What else should we be doing to get out in front of those potential consequences? You do not have to address that topic, but I was throwing that out there as a potential but over to you Mark for any last thoughts.<br/><br/> <b>Mr. Mark Prouse:</b> I mean, that is a big question and I think what I am seeing so many from the UK perspective, but I think across Europe and over the Atlantic with the colleagues in the US as well is for the first time a bringing together of policy portfolios to be holistic. So, we do not just see climate change policy and just see national security policy, but they are part of the same conversation. You know, I routinely now, I am talking to staff who work on climate change, you work on energy efficiency, we work in business sectors, bringing together those two policies and really seeing them hand in hand and I think it is fair to say that if we do not manage the climate change risk effectively as a whole society, not just the UK or Europe or the US, all of us are impacted by this. It will be a whole world impact. If we do not manage that effectively, the security risks and vulnerabilities will increase exponentially, and we see this through the international conferences. The COP conference later this year that the UK is hosting is bringing together people to understand this risk. It is not enough for the West or Europe or the US to progress this, we need to bring all of our international partners together to address these problems because we would all share in the impacts. And again COVID has shown us, it is not just our own security resilience we need to maintain but the actions of other countries can have a huge impact on our own society. So basic things like the restriction of movements because of wanting to control the virus, very sensible precautions during the recent pandemic that countries have made, but that has not just impacted the countries that have done those measures and implementing, but also everyone around them and understanding that confluence of issues is really key, and I think that is going to be true for climate change just as much, if not more. We need to act in concert with each other, in concert with countries who may not be our traditional allies and partners that we need to see the shared goals and objectives there to promote our security agendas and managing climate change as we go forward, and for me, they are absolutely hand in hand.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Mark. Great points. Michael, any last thoughts, any last comments?<br/><br/> <b>Mr. Michael Ruehle:</b> On the climate change. Indeed, echoing what Mark said, I think all major institutions have to play their part. For NATO, that is a double act. On the one hand, you want to adapt your forces to be able to perform in the climate change environment. Also, considering that there may be more humanitarian relief operations as a result of climate change. So, you want your forces to do these things and do them well. At the same time, you also want to admit that your forces too have to make a contribution to mitigation of climate change, which means lower environmental footprint, smaller environmental footprint. So, what we are looking for, and it is going to be quite challenging years ahead of us and now. We are looking for what we call the win-win solutions. Are there other ways to modernize the military that it performs in a new environment, but at the same time has a smaller environmental footprint like fewer greenhouse gas emissions without losing its military effectiveness? So, that is an interesting challenge for engineers as well as for the military experts, but we are on the case now.<br/><br/> <b>Mr. Duane Verner:</b> Michael, follow up question. How does NATO address the tipping points that unfortunately are out there? So, for example, in Middle East and North Africa, is NATO working with the climate scientists to understand the climate models and understand when you could have that catastrophic drought? Or when you might have heatwaves that reach a point where it could lead to a destabilizing environment, could lead to lead a mass migration? Do you have any thoughts on that?<br/><br/> <b>Mr. Michael Ruehle:</b> Well, we have been sponsoring climate-related research for decades, literally, and we have, of course, many partner countries in regions that are far more severely affected by climate change than most allies at this stage. So, there is already a dialogue on climate going on for quite some time.<br/><br/>That is part of the agenda of NATO over the next years, we will try to harness our own science and technology research frameworks to look more into the climate challenge. So, I think we will become part, I would say, of the climate discussion, including the scientific discussion which should help us to come towards this sort of agreed baseline. And we are also doing soon a major NATO wide mapping exercise to look at how climate change is actually affecting our installations, our forces and the like. So that again that we have a baseline understanding of all 30 nations of, you know, what is in store and what we need to do against it.<br/><br/> <b>Mr. Duane Verner:</b> Thank you Michael. In over to you Jukka for any last thoughts, any topics that we do not address, any comments that you would like to make.<br/><br/> <b>Mr. Jukka Savolainen:</b> Well, thank you. Well, having heard this now I had enough time to think I am interested in the climate change right now. Namely, having heard, listen to talk to with my younger generation children, they are over 20 now. And they have been under a serious climate change indoctrination throughout their whole life in this education system in Finland. And they are ready to pay extra for products that have been produced in a way that is climate-friendly, plus humanitarian standards also matter. And I think this shows that there is both tensile that markets will so the climate issue. And they will also solve humanitarian issues, and this will necessarily bring them, introduce them as a variable in global geo-economic arrangement that is to come. Well, it can also be a trap to the so-called Western states because where we are doing this indoctrination because we are a minor tiny part of population globally. If, I mean, if we start selling and buying to each other, these climate-friendly products and we do not pay attention to what happens in the rest of the world, that may lead only to a loss of a volume and that is bad from the economic viewpoint. But I think overall, this suggests that it is very important to discuss about this climate and continue it. Thank you.</td></tr> <tr> <td style="background-color:rgba(0,136,198,.30); vertical-align: middle; text-align:left;" colspan="1"><b>32:27 - Closing</b></td> </tr> <tr> <td style="background-color:white; "> <b>Mr. Duane Verner:</b> Thank you. That is an excellent way to end. I think you gave some hopeful thoughts there Jukka to end this discussion. Well, I just want to thank everybody. This was great.<br/><br/>Thank you to our experts for sharing their perspectives about emerging threats to enhance the resilience and security of critical energy networks and critical infrastructure systems. Find more information about risk analysis and emerging threats in the corresponding training module on the OSCE Virtual Centre for the protection of critical energy infrastructure. Watch other videos addressing key elements of risk analysis for critical infrastructure on the OSCE Virtual Centre for the protection of critical energy infrastructure.</td> </tr> </table> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@513f0ae4ef744ac6b32c8d2eb46fa2bc"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@513f0ae4ef744ac6b32c8d2eb46fa2bc" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <p><em><span style="color: #003478; text-decoration: underline !important; font-weight: bold !important">Meet the experts:</span><span style="color: #003478;"> Select each of the following accordions to find out more about our experts.</span></em></p> </div> </div> <div class="vert vert-4" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@7f4d4f0a69f1449fb1934cbc461befb7"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@7f4d4f0a69f1449fb1934cbc461befb7" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new1" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Dr. Sarah Lohmann</button> <div class="panel1"> <br/> <p><strong>Dr. Sarah Lohmann</strong> is a Visiting Research Professor at the US Army War College, and an Assistant Professor of International Studies at the University of Washington. Her current teaching and research focus is on cyber and energy security policy and emerging technology, and she is co-lead for a NATO Science and Technology project on “Energy Security in an Era of Hybrid Warfare”. Previously, she served as the Senior Cyber Fellow with the American Institute for Contemporary German Studies at Johns Hopkins University, where she managed projects which aimed to increase agreement between Germany and the United States on improving cybersecurity and creating cybernorms.</p> <p><em><a href="https://ssi.armywarcollege.edu/faculty-staff/sarah-lohmann/" target="[object Object]">Click here for more information</a></em></p> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new1"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-5" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@30ac5c19fc094228bc55ff9c1d14ab05"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@30ac5c19fc094228bc55ff9c1d14ab05" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new2" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Mr. Mark Prouse</button> <div class="panel3"> <br/> <p><strong>Mr. Mark Prouse</strong> is the Deputy Director Department for the UK Business, Energy and Industrial Strategy (BEIS), London, England.</p> <p><em><a href="https://www.linkedin.com/in/mark-prouse-04aab116/" target="[object Object]">Click here for more information</a></em></p> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new2"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-6" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@f9b7c988d0c54078a2d8ce9ec550fb06"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@f9b7c988d0c54078a2d8ce9ec550fb06" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new3" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Mr. Michael Rühle</button> <div class="panel3"> <br/> <p><strong>Mr. Michael Rühle</strong> is Head of the Hybrid Challenges and Energy Security Section, in the Emerging Security Challenges Division at NATO. Previously he was Head, Speechwriting, and Senior Political Advisor in the NATO Secretary General’s Policy Planning Unit. Before joining NATO’s International Staff in 1991, Mr. Rühle was a Volkswagen-Fellow at the Konrad-Adenauer-Stiftung, Sankt Augustin, Germany, and a Visiting Fellow at the Center for Strategic and International Studies (CSIS), Washington, D.C.</p> <p><em><a href="https://www.linkedin.com/in/michael-ruehle-8974bb31/?originalSubdomain=be" target="[object Object]">Click here for more information</a></em></p> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new3"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-7" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b99fe71676de4a2b9ee2b8c790aa7cc7"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b99fe71676de4a2b9ee2b8c790aa7cc7" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new4" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Mr. Jukka Savolainen </button> <div class="panel4"> <br/> <p><strong>Mr. Jukka Savolainen</strong> is Director Vulnerabilities and Resilience Community of Interest at the Hybrid COE, Helsinki Finland. His international experience includes service as the Head of Mission of the EU Police Mission in Afghanistan from 2010 to 2012. He spent 2002–2006 in Brussels, working firstly as a counsellor for border security at the Finnish Permanent Representation to the EU, and later as a national expert at DG HOME of the Council. His current team’s work concentrates on hybrid threats to critical systems supporting modern Western societies.</p> <p><em><a href="https://www.hybridcoe.fi/experts/jukka-savolainen/" target="[object Object]">Click here for more information</a></em></p> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new4"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-8" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@68fab1c0907b47cb8291424019d42f57"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@68fab1c0907b47cb8291424019d42f57" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new5" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Mr. Duane Verner</button> <div class="panel5"> <br/> <p><strong>Mr. Duane Verner</strong> is Manager of the Resilience Assessment Group in the Decision and Infrastructure Sciences Division at Argonne National Laboratory, Lemont Illinois, United States.Mr. Verner oversees staffing and technical assignments, including critical infrastructure vulnerability assessments, system modeling, and dependency analysis. He regularly contributes to the international resilience and security research community through publications and trans-Atlantic collaboration and serves as a Civil Expert for NATO’s Civil Emergency Planni ng Committee advising on all aspects of regional energy resilience.</p> <p><em><a href="https://www.linkedin.com/in/dverner/" target="[object Object]">Click here for more information</a></em></p> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new5"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@6fbb1283cd934d11b831e7989dd439cb" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@a18d32a6afef4176a5656b9bd0e2d00f"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@a18d32a6afef4176a5656b9bd0e2d00f" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>The overall success of the national infrastructure protection mission depends on strong risk analysis capabilities and the development of analysis products that effectively inform decision makers. To accurately analyze risks and prepare high-quality products, analysts need a consistent process.</p> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Risk Analysis Process</span></p> <p>A risk analysis process seeks to:</p> <ul> <li>Provide analysts with a documented, consistent, defensible, and repeatable process for conducting strong risk analyses;</li> <li>Highlight the importance of risk analytic tradecraft standards as the fundamental building blocks of strong risk analyses;</li> <li>Enhance the consistency and quality of risk analytic products; and</li> <li>Provide a foundation for specialized training on analyzing risk, developing risk products, and communicating analytic results.</li> </ul> <p>The risk analysis process consists in six phases presented in the table below.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/c3dcbd25aebf8e591913759e4dbf38d2/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Analysis-Process_v2.jpg" target="_blank"><img width="70%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/c3dcbd25aebf8e591913759e4dbf38d2/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Analysis-Process_v2.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478; font-weight: bold !important;">Risk Analysis Process</span> (DHS, 2014)</center></p> <p style="color: #003478;"> Click on the figure to enlarge it.</p> <p style="color: #003478;"> Expand the accordions below for more information on the risk analysis process.</p> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b45ffaef82014179a0fdd3cbcb3a3019"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b45ffaef82014179a0fdd3cbcb3a3019" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Planning the Analysis</button> <div class="panel"><br/> <div> <p>When beginning a risk analysis, the first step consists in developing a plan. Such a plan serves as a roadmap, maximizing the efficiency, quality, and utility of the overall analysis. The plan should define the goal, audience, and scope of the risk analysis. Carefully review the available information that will support the analysis and identify information gaps. Consider how the defined timeframe and available personnel will influence the risk analysis process. Be sure you clearly establish and understand the procedure for gaining approval for and finalizing a risk product. The table below summarizes key considerations in risk analysis planning.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center; font-weight: bold !important;" colspan="2">Risk Analysis Planning Checklist</td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px;"> <ol> <li><b>Goal:</b> What is the goal of the risk analysis?</li> <ul> <li>What critical infrastructure protection decisions is the analysis meant to inform?</li> <li>What is the analytic question at issue?</li> <li>For what purpose(s) will the analysis be used?</li> </ul> <li><b>Audience:</b> Who is the target audience for the analysis?</li> <li><b>Scope:</b> What assets, systems, and/or networks will be assessed?</li> <ul> <li>What characteristics of the product's subject are consistent with other subjects?</li> <li>What makes the subject unique?</li> <li>What threats and scenarios will be assessed?</li> <li>What vulnerabilities will be considered?</li> <li>What consequences will be considered?</li> </ul> <li><b>Information:</b> What information is available to support the analysis?</li> <ul> <li>What are the source materials?</li> <li>What previously published products are available that is similar to the subject of the product?</li> <li>What Federal, State, and local information sources and expertise can be used to develop the product?</li> <li>What are the information gaps and which ones can be filled? How can they be filled?</li> <li>What additional research is necessary?</li> </ul> <li><b>Timeframe:</b> How much time is available to conduct the analysis and prepare the product?</li> <li><b>Personnel:</b> What personnel are available to conduct the analysis and prepare the product?</li> <li><b>Product Template:</b> Is there an existing template for the product?</li> <li><b>Product Approval:</b> Who will review and approve the product?</li> <ul> <li>What process is in place to coordinate comments and resolve any disputes?</li> <li>What process is in place to establish the allowable number of drafts?</li> <li>What process is in place to finalize the product (and allow for no additional changes)?</li> </ul> </ol> </td> </tr> </table> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@3ea1ea545f444a7cbd79ce1405794d45"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@3ea1ea545f444a7cbd79ce1405794d45" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new1" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Analyzing the Risk</button> <div class="panel1"><br/> <div> <p>Risk is influenced by the nature and magnitude of a threat, the vulnerabilities and resilience of the subject infrastructure to that threat, and the consequences that could result. Therefore, a risk analysis integrates threat, vulnerability, resilience, and consequence information to produce a defensible evaluation of the risks to the particular asset, system, or network by identifying:</p> <ul> <li>What could happen?</li> <li>How likely is it to happen?</li> <li>What the consequences are if it does happen?</li> </ul> <p>Strong risk analyses inform decision making and support the selection of the most cost-effective risk management approaches. An integrated portfolio of actions that includes prevention, protection, response, and recovery measures characterizes most of these approaches.</p> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Scenario Identification</p> <p>All risk is assessed with respect to a specific scenario or set of scenarios that shapes the parameters of the assessment. Clearly, not all stakeholders face the same threats (or sources of harm). Risk analysts must identify and prioritize possible threats to the asset, network, or system they are assessing. All scenarios incorporate certain assumptions (e.g., populations at or near the facility, weather conditions).<br/><br/>Analysts should be cautious about selecting scenarios for risk analysis. If an analysis does not include consideration of a particular scenario, the customer may construe its absence, and the subsequent lack of an assignment of risk, to mean that the scenario has negligible risk. Analysts can control for this by clearly stating that the assessment covers the risk associated with a set of scenarios that includes those for which decision makers are most likely to be concerned. Scenarios which do not fall within the boundaries of this set are simply not a part of the assessment and should not be assumed to be without risk. The table below summarizes key considerations when identifying the scenario best suited for the risk analysis.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center; font-weight: bold !important;" colspan="2"> Risk Analysis Scenario Identification Checklist</td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px;"> <ol> <li><b>Categorization:</b> What is the type of hazard considered?</li> <ul> <li>Natural</li> <li>Manmade unintentional</li> <li>Manmade intentional</li> </ul> <li><b>Prioritization:</b> Have the scenarios been prioritized?</li> <li><b>Documentation:</b> Have the reasons for choosing and prioritizing scenarios been documented?</li> <li><b>Comprehensiveness:</b> Have likely threats, apparent vulnerabilities, existing resilience and security capabilities, and likely consequences been considered in nominating the scenarios?</li> <li><b>Description:</b> Have sufficient details been provided about the selected scenario?</li> <ul> <li>Does the analysis describe the event clearly enough for threat, vulnerability, resilience, and consequence analysis?</li> <li>Does the analysis avoid excessive detail that would make it difficult to estimate the likelihood of the scenario being chosen?</li> </ul> <li><b>Alternatives:</b> Have alternate conditions that may require additional scenarios been identified?</li> <ul> <li>Do the scenarios have different operating conditions?</li> <li>Do the scenarios consider various alert levels?</li> </ul> <li><b>Worst Reasonable Case:</b> Does the scenario, or the set of alternatives, consider the worst reasonable case?</li> </ol> </td> </tr> </table> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Hazard/Threat Analysis</p> <p>Hazards are events that may cause harm to an asset, system, network, or community. For the purpose of calculating risk, analysts generally estimate the threat of an intentional hazard as the likelihood of an attack being attempted by an adversary. For other hazards, they generally estimate threat as the likelihood that a hazard will manifest itself. The table below highlights elements of hazard analysis.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center; font-weight: bold !important;" colspan="2"> Hazard Analysis Checklist</td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px; "> <ol> <li><b>General Considerations</b></li> <ul> <li>Have any attack methods (physical and cyber) that may be employed been identified?</li> <li>Have any natural hazards or accidents that are likely to challenge routine operations or consequence management, with consequences extending beyond the facility and beyond the owners' and operators' direct concerns been identified?</li> <li>Have any patterns of criminal activity that are likely to challenge routine operations or consequence management and produce consequences extending beyond the facility and beyond the owners and operators' direct concerns been identified?</li> <li>Have all assumptions, subjective judgments, and uncertainty been identified, evaluated, and documented?</li> </ul> <li><b>Analyzing the Likelihood of Different Hazards</b></li> <ul> <li>Account for the adversary's ability to recognize the target.</li> <ul> <li style="list-style-type: circle">Does the target possess identifiable or unique structures, color, location, or signage that is obvious to the casual observer and calls attention to the facility or its assets?</li> <li style="list-style-type: circle">Is the facility obviously identifiable from the air or water during both day and night?</li> <li style="list-style-type: circle">Has a review to determine the amount of useful information available to an adversary on the Internet, including satellite imagery been conducted ?</li> </ul> <li>Estimate threat as the likelihood that the adversary would attempt a specific attack method against the target.</li> <ul> <li style="list-style-type: circle">Has relevant threat information (national and local) been analyzed and incorporated?</li> <li style="list-style-type: circle">Has the applicability of the target been analyzed on the basis of the threat information?</li> <li style="list-style-type: circle">Has the history of attack modes been evaluated against similar targets?</li> <li style="list-style-type: circle">Has each adversary's intent to attack the target been evaluated?</li> <li style="list-style-type: circle">Has each adversary's capability and intent to use a particular attack type been determined?</li> <li style="list-style-type: circle">Have the consequences and the adversary's likelihood of success been considered with regard to his or her intentions?</li> <li style="list-style-type: circle">Have the deterrence value of existing security measures been established and included?</li> <li style="list-style-type: circle">Have best-available analytic tools been leveraged?</li> </ul> </ul> </ol> </td> </tr> </table> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Vulnerability and Resilience Analysis</p> <p>Vulnerability analysis involves identifying areas of weakness whose exploitation by an adversary could result in consequences of concern. For intentional hazards, a common measure of vulnerability is the likelihood that an attempted attack will be successful. Vulnerabilities may be associated with physical (e.g., a broken fence), cyber (e.g., lack of a firewall), or human (e.g., untrained guards) factors. Critical dependencies (e.g., electricity, water, raw materials) and physical proximity to potential hazards are also key vulnerability categories. Resilience analysis involves identifying mitigation and adaptation capabilities. The table below highlights elements of vulnerability and resilience analysis.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center; font-weight: bold !important;" colspan="2"> Vulnerability and Resilience Analysis Checklist</td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px;"> <ol> <li><b>General Identification</b></li> <ul> <li>Identify the vulnerabilities associated with physical, cyber, and human factors; critical dependencies; and physical proximity to hazards.</li> <ul> <li style="list-style-type: circle">Have all vulnerabilities been identified and documented?</li> <li style="list-style-type: circle">Have all the critical operational processes to identify the dependencies on external infrastructure, the loss of which would comprise a new scenario been evaluated?</li> <li style="list-style-type: circle">Has the surrounding area been surveyed to identify vulnerabilities associated with physical proximity to potential hazards?</li> <li style="list-style-type: circle">If the critical infrastructure is a system, are there any scenarios in which the adversary would cause significant harm by exploiting the characteristics, dependencies, or performance of the system itself?</li> </ul> </ul> <li><b>Description</b></li> <ul> <li>Describe relevant protective and resilience measures in place and explain how they reduce the vulnerability for each scenario (deterrence and/or limiting damage).</li> <ul> <li style="list-style-type: circle">Have any general, sector-specific, and threat-specific protective and resilience measures been identified, considering each of the following categories, as applicable?</li> <ul> <li style="list-style-type: square">Planning and Preparedness</li> <li style="list-style-type: square">Personnel</li> <li style="list-style-type: square">Security Force</li> <li style="list-style-type: square">Access Control</li> <li style="list-style-type: square">Physical Security</li> <li style="list-style-type: square">Communication and Notification</li> <li style="list-style-type: square">Monitoring and Countersurveillance</li> <li style="list-style-type: square">Mitigation procedures and equipment</li> <li style="list-style-type: square">Cyber Security</li> <li style="list-style-type: square">Infrastructure Interdependencies</li> <li style="list-style-type: square">Incident Response (internal and/or external)</li> <li style="list-style-type: square">Recovery procedures and agreements</li> </ul> </ul> </ul> </ol> </td> </tr> </table> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Consequence Analysis</p> <p>Consequence analysis focuses on four primary areas:</p> <ul> <li><b>Public Health and Safety:</b> Effect on human life and physical well-being (e.g., fatalities, injuries, and illnesses).</li> <li><b>Economic:</b> Direct and indirect economic losses (e.g., cost to rebuild asset, cost to respond to and recover from attack, upstream and downstream costs resulting from disruption of product or service, long-term costs that result from environmental damage).</li> <li><b>Governance/Mission Impact:</b> Effect on Government's or industry's ability to maintain order, deliver minimum essential public services, ensure public health and safety, and carry out national security-related missions.</li> <li><b>Psychological:</b> Effect on public morale and confidence in national economic and political institutions</li> </ul> <p>A full consequence analysis takes into consideration all four consequence criteria. However, estimating potential indirect impacts requires the use of numerous assumptions and incorporation of other complex variables. An analysis of all categories of consequence may be beyond the resources available (or the precision needed) for every risk analysis. At a minimum, consequence analyses should focus on the two most fundamental impacts: the human consequences and the economic impacts most relevant to the decision maker. It is important to identify the limits of what was considered in the analysis.<br/><br/>Indirect and cascading impacts of disruptions are difficult to understand and may be even more difficult to appraise. Some may already be incorporated in estimates of economic losses, while others may require further metrics development to enable analysts to consider them in a more comprehensive risk assessment. The table below highlights elements of consequence analysis.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center; font-weight: bold !important;" colspan="2"> Consequence Analysis Checklist</td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px;"> <ol> <li><b>General Consequence Analysis Measures</b></li> <ul> <li>Use the best available models and tools (hazardous material dispersion, blast effects models, and other tools) to determine the likely damage from the incident, noting whether the models account for structural and systems vulnerabilities</li> <li>Evaluate any measures that would either protect lives and property should the incident occur or prevent the incident from affecting upstream assets, systems, or networks assessed.</li> <ul> <li style="list-style-type: circle">Have mitigation measures been identified and documented?</li> <li style="list-style-type: circle">Has it been determined whether the measures include those available to the owner and operator?</li> <li style="list-style-type: circle">Have State, local, and Federal authorities that may be available to respond been identified?</li> </ul> <li>Identify, evaluate, and document all assumptions, subjective judgments, and uncertainty.</li> <li>Use historical evidence (similar events at similar facilities) or other analytical approaches to support estimates.</li> </ul> <li><b>Public Health and Safety</b></li> <ul> <li>Estimate the number of fatalities, injuries, and illnesses both on- and off-site (as appropriate).</li> </ul> <li><b>Economic</b></li> <ul> <li>Estimate the economic loss in dollars, stating which costs are included (e.g., property damage losses, lost revenue, loss to the economy, business interruption} and what duration was considered.</li> <ul> <li style="list-style-type: circle">Have both direct and indirect economic impacts on- and/or off-site been included?</li> <li style="list-style-type: circle">Have data sources and models, that have been used to quantify the economic impact of the event, been identified?</li> </ul> </ul> <li><b>Governance/Mission Disruption</b></li> <ul> <li>Fully document the potential functional disruptions of the facility or area being assessed.</li> <ul> <li style="list-style-type: circle">Have the functional disruption including impacts "upstream" and "downstream" of the facility or area being assessed been described in quantitative terms?</li> <li style="list-style-type: circle">Have the data sources and models used to assess the upstream/downstream functional impacts of the event been identified and quantified as economic impacts or loss of life?</li> </ul> </ul> <li><b>Psychological</b></li> <ul> <li>Document the potential psychological or symbolic impacts that would directly result from an attack on the facility or area being assessed.</li> <ul> <li style="list-style-type: circle">At least in qualitative terms, have the psychological or symbolic impacts been described?</li> <li style="list-style-type: circle">Have the data sources and models used to qualify the psychological or symbolic impact of the event been identified, and if possible, quantified them as economic impacts or illness?</li> </ul> </ul> </ol> </td> </tr> </table> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new1"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5a74df703201422e893fb518387b3591"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5a74df703201422e893fb518387b3591" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new2" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Producing the Analysis Deliverable</button> <div class="panel2"><br/> <div> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Communication Effectiveness</p> <p>All risk analytic products should share one common goal: to communicate effectively. To help ensure the value of the developed products, it is important to focus on:</p> <ul> <li>Clarity and logic in expressing the material</li> <li>Including facts that are relevant to the question</li> <li>Including discussions that are of appropriate breadth and depth</li> <li>Ensuring that analysis of the facts is significant in addressing the problem</li> <li>Providing a balanced approach to recommendations, if any</li> </ul> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Consistency with Tradecraft Standards</p> <p>During product development, periodically evaluate the developing product against the tradecraft standards:</p> <ul> <li>Properly describe quality, reliability of information sources</li> <li>Properly caveat and express uncertainties or confidence in analytic judgments</li> <li>Properly distinguish between underlying intel and analysts assumptions and judgments</li> <li>Incorporate alternative analysis where appropriate</li> <li>Relevance to infrastructure protection and national security</li> <li>Use Logical argumentation</li> <li>Ensure consistency and highlight changes</li> </ul> <p>When appropriate, reviewing products after they are published to assess the accuracy of conclusions and assumptions will help to ensure that future analyses are more effective.</p> <p style="color: #003478;">Expand the accordion on Risk Analysis Standards below for additional information on the tradecraft standards.</p> <p style="color: #003478; text-decoration: underline !important; font-weight: bold !important;">Employing Alternative Analysis Techniques</p> <p>By employing some of the following alternative analyses techniques, it is possible to provide some systematic structure to the analysis.</p> <ul> <li>Using competing hypotheses or possible explanations about why something has happened, what is happening, or what will happen.</li> <ul> <li style="list-style-type: circle">Trying to refute multiple hypotheses gives the analyst a different perspective and drives a broader search for information than busy analysts may otherwise pursue.</li> </ul> <li>Questioning and checking key assumptions.</li> <ul> <li style="list-style-type: circle">Analysts must consider the consequences if the evidence on which key assumptions are based is wrong, misleading, or subject to a different interpretation.</li> </ul> <li>Creating an argument involved in your argument map or diagram that capture the logical structure of the reasoning involved in your argument.</li> <ul> <li style="list-style-type: circle">Well-designed visualizations can help analysts understand the complexities of arguments and lead to better decision making.</li> </ul> <li>Engaging in structured brainstorming, in which a team of analysts meet to consider a large number of differing ideas offered by the participants.</li> <ul> <li style="list-style-type: circle">Brainstorming encourages creative input and fosters an atmosphere that is free of criticism and judgment.</li> </ul> <li>Subjecting products to a "red team" analysis by an independent group.</li> <ul> <li style="list-style-type: circle">Such analysis challenges the writer to improve his arguments.</li> </ul> </ul> <p>These techniques help analysts question assumptions, visualize complex issues, and address various cognitive limitations and biases.</p> <p>Analytic organizations need to institutionalize sustained, collaborative efforts by analysts to question their judgments and underlying assumptions through both critical and creative modes of thought. Traditional analysis generates forecasts or explanations based on logical processing of available evidence, whereas alternative analysis seeks to help analysts and policymakers stretch their thinking through structured techniques that challenge underlying assumptions and broaden the range of possible outcomes considered.<br/><br/>The following should characterize the development of an alternative analysis process:</p> <ul> <li><b>Continuous:</b> Continuous and sustained program of small- to medium-sized efforts to explore possible outcomes and debate assumptions all linked to incoming information about the issue under consideration.</li> <li><b>Creative:</b> Alternative sense-making that helps to suspend premature judgment and make an array of possibilities come alive.</li> <li><b>Collaborative:</b> Embrace a variety of disciplines and specialties, allowing analysts to challenge logical arguments and consider different perspectives.</li> <li><b>Counter-intuitive:</b> Focus on patterns that are different, even contradictory, to those you expect to promote and helps to ensure continuous awareness of the range of possibilities and outcomes</li> <li><b>Consumer-friendly:</b></li> <ul> <li style="list-style-type: circle">Consider interactive formats (e.g., Web logs, gaming sessions) that might better capture the attention and imagination of intended audiences and strengthen the retention of insights.</li> <li style="list-style-type: circle">Strengthen personal relationships through increased face-to-face contact among individual analyst and consumers in order to facilitate informal exchanges on alterative outcomes.</li> </ul> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new2"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-4" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6a47079c209c47afb6972220a5478145"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6a47079c209c47afb6972220a5478145" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new3" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Reviewing the Risk Product</button> <div class="panel3"><br/> <div> <p>It is important to review the final products before publishing them. Several types of reviews can be conducted.</p> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Internal Review</p> <p>Prior to releasing the product for an independent review, analysts should complete a self-review of the product. Successful analysts are critical of each draft, assessing how well the product is progressing against the plan established at the outset of the process. Successful analysts will look at content and style as the product develops, identifying and executing specific improvements to each draft. Product reviews include a check for proper style and grammar, adherence to the analytic tradecraft standards, a technical edit, and a review to ensure alignment with established strategic communications guidelines. When the report has reached a final draft stage, a quality evaluation of the overall report should be conducted prior to initiating an independent review prior releasing a product for independent review.</p> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Independent Review</p> <p>Upon completion of a risk analytic product, the analyst should submit the product for independent review(s). The review(s) should cover both content and style, so separate reviews by a technical peer and an editor may be required. Analysts should structure the reviews to assure that the document meets tradecraft standards. Specifically, the content reviewer will evaluate the document to ensure the following:</p> <ul> <li>Information sources are reliable, high-quality, and properly referenced</li> <li>Factors contributing to uncertainty are described</li> <li>Assumptions used to address or simplify analysis of the issue are explained</li> <li>Alternative analyses are considered and incorporated as appropriate</li> <li>Key findings and conclusions are relevant to infrastructure protection and security</li> <li>Arguments supporting the product are logical and unbiased</li> </ul> <p>The style review should focus on the editorial and style standards established by the analysts' organization. Analysts can develop specific guidance for the product review to help the reviewers.<br/><br/>Reviewers will document their finding for the analysts and work with them to address issues affecting the content or style of the product. Analysts will document the resolution of the issues identified during the review.<br/><br/>This review and collaboration among analysts are separate and distinct from the final product clearance process. The lead agency must adhere to a documented clearance process for getting a product approved and signed prior to release.</p> <p style="font-size: 13pt !important; color: #003478; text-decoration: underline !important; font-weight: bold !important;">Briefing Review</p> <p>When the product of the risk analysis is a briefing to decision makers, the approach is similar to that used for any other analytic product: review the briefing product for adherence to the tradecraft standards and the editorial and style guides of the organization.</p> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new3"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-5" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@605386822ef64ab2b3a95d9db5c61640"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@605386822ef64ab2b3a95d9db5c61640" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new4" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Presenting the Risk Product</button> <div class="panel4"><br/> <div> <p>After a risk product is modified and revised to address changes from the reviewers, analysts will finalize the product for delivery to the audience or decision makers. Multiple means of product delivery are available; the final decision about product delivery is made because of discussions with the receiving organization to effectively address time, media, and format preferences effectively.<br/><br/>Common product delivery methods are briefings, white papers, and cover letters. Each of these methods is subject to the preparation and review procedures detailed in this guidebook and each requires analysts to provide a synopsis of the product. These abbreviated versions of the product must present the subject materials as intended although being concise. The mechanism (letter, white paper, or brief) will contain the key findings and the supporting information.</p> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new4"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-6" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@8a8c39e0a56e4df38ec1430c150ef0ee"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@8a8c39e0a56e4df38ec1430c150ef0ee" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new5" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Assessing the Risk Product</button> <div class="panel5"><br/> <div> <p>Risk analysts need to understand how the risk products they develop are being received and used by the audience and decision makers. Analysts need to establish mechanisms for receiving feedback on the effectiveness of their products to establish a baseline for improvement and provide the basis for building long-term confidence with the decision makers. Risk analysts should allow opportunities for the decision makers and peers to provide guidance on improving product quality both immediately following delivery and over the long term.<br/><br/>Written products may include formal review mechanisms such as a product review sheets that allow peers and managers to provide both general and specific feedback on the products. Transmittal letters can also include requests for critiques of the written product. The products themselves can include specific actions that require approval, disapproval, or approval with recommendations that support evaluation of the effectiveness of the product. Analysts may choose to include instructions to guide the collection of feedback in the transmittal letter or during the closing of a product briefing. In all cases, analysts need to provide appropriate contact to receive feedbacks.<br/><br/>After receiving feedback from the audience and peers, analysts can combine that information with other analyses and historical information to perform a self-evaluation of their effectiveness over time. </p> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new5"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-7" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@995e1b44af504856819894511b2004fd"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@995e1b44af504856819894511b2004fd" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new6" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Risk Analysis Standards</button> <div class="panel6"><br/> <div> <p>Analysis tradecraft standards are fundamental to conducting risk analysis and developing associated risk analytic products. Strict adherence to these tradecraft standards allows analysts to think critically, meet partner expectations, and communicate key messages. The consistent use of these standards will also help ensure that risk analyses are consistent, defensible, and repeatable. The table below lists the analytic tradecraft standards.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="2"> <b>Analytic Tradecraft Standards</b></td> </tr> <tr> <td style="background-color:white; border: 1px solid black; padding: 15px;"> <ol> <li><b>Properly describe quality and reliability of information sources</b><br/>A risk product must demonstrate honesty and integrity by accurately reflecting the quality and reliability of the information resources used to conduct the analysis.</li> <ul> <li>What information was key to the analytic judgments and why?</li> <li>Have all factors that affect the quality and reliability of the information been highlighted? <ul> <li style="list-style-type: circle">Authoritativeness</li> <li style="list-style-type: circle">Bias</li> <li style="list-style-type: circle">Access</li> <li style="list-style-type: circle">Currency</li> </ul> </ul> <li><b>Properly caveat and expresses uncertainties or confidence in analytic judgments</b><br/>A risk product should explain uncertainties and their basis (gaps, contrary information). Excellent risk products further identify factors that would alter confidence in or cause revision of the judgments and key findings.</li> <ul> <li>Has the level of confidence in the analytic judgments been explained?</li> <li>Have information gaps or significant contrary reporting been identified?</li> <li>Have indicators that would enhance or reduce confidence or prompt revision of the existing judgments been identified?</li> <li>Have indicators that would signal whether assumptions and judgments are more or less likely to be correct been identified?</li> </ul> <li><b>Properly distinguish between underlying intelligence and analysts’ assumptions and judgments</b><br/>High-quality analytic products consistently distinguish source material from judgments and assumptions and explain assumptions that are important to the analysis. Excellent products identify indicators that could validate or refute assumptions and judgments and explain implications for analytic judgments if assumptions are not correct.</li> <ul> <li>Have critical assumptions on which the analysis is based been explained?</li> <li>Have indicators that would signal whether the assumptions and judgments are more or less likely to be correct been identified?</li> </ul> <li><b>Incorporate alternative analyses where appropriate</b><br/>Risk products should present structures analytic techniques that affectively add insight and explain the strengths and weaknesses of alternative hypotheses. Excellent risk analytic products display a sophisticated and thorough approach to alternative analysis, identifying and discussing indicators that, if detected, would alter the relative likelihood of the alternatives presented.</li> <ul> <li>Have the strengths and weaknesses of alternative hypotheses, viewpoints, or outcomes been identified and explained in the light of both available information and information gaps?</li> <li>Have alternatives linked to key assumptions been explained and/or assessed?</li> <li>Have structured analytic techniques been applied and have indicators that, if detected, would help clarify which alternative hypothesis, outcome, or viewpoint is more likely emerge been identified?</li> </ul> <li><b>Demonstrate relevance to infrastructure protection and national security</b><br/>A risk product should provide relevant information in a useful context. The product should analyze a significant threat or hazard. High-quality products reflect the analyst's expertise; assess longer-term, second order effects, identify risks, and identify opportunities to mitigate those risks.</li> <ul> <li>Has the intended audience been provided with useful context, warning, or opportunity analysis?</li> <li>Is the information unique and likely to be difficult to obtain without analytic expertise?</li> <li>Have the direct, near-term implications of the analytic judgments been addressed?</li> </ul> <li><b>Use logical argumentation</b><br/>A risk product should use information effectively to support key analytic points and associated confidence levels. Arguments should be internally consistent. Graphics should support key points and be able to stand alone (i.e., separate from the body of the report). In an excellent product, judgments about the trends and dynamics that shape events are explicit. Excellent products clearly explain interactions among raw data, assumptions, and inferences.</li> <ul> <li>Has it been assured that key points have effective support from reliable information and reflect coherent, logical reasoning?</li> <li>Have appropriate language and syntax to convey unambiguous meaning been used?</li> <li>Is the product internally consistent and has any contrary information that could affect key judgments been acknowledged?</li> <li>Has it been assured that graphics and images are clear and easily understood?</li> </ul> <li><b>Exhibit consistency of analysis over time or highlights changes</b><br/>Risk products should highlight and explain the rationale behind changes in judgments over time while incorporating significant new insights or improved understanding. Excellent risk analytic products discuss the implications of a change or of new insights for the analytic product line.</li> <ul> <li>Has a key message that is consistent with those in previous products been delivered</li> <li>If the key analytic message has changed, has the change been delivered and explained?</li> </ul> <li><b>Incorporate effective visual information where appropriate</b><br/>Risk products should consistently be reviewed after publication in order to check the validity of conclusions or assumptions made within the analysis.</li> <ul> <li>Have products been reviewed to validate or invalidate previous conclusions or assumptions?</li> </ul> </ol> </td> </tr> </table> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new6"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-8" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@106ced76a2a14476b3a7a16f87c4760d"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@106ced76a2a14476b3a7a16f87c4760d" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>Risk analysis is the foundation of risk assessment and management processes. Results of the risk analysis informs the risk assessment, which helps identifying and categorizing the risks. Finally, risk management involves the identification, analysis, evaluation, and prioritization of potential risks, and the definition of resilience and protection enhancement strategies.</p> <p>An interesting approach to guide these strategies is to use the As Low As Reasonably Practicable (ALARP) principle, which is generally used in safety engineering.</p> <p><span style="font-size: 13pt !important; font-family: Calibri; color: #003478; font-weight: bold !important; text-decoration: underline !important;">ALARP Principle</span></p> <p>The ALARP principle recognizes that the risk 0 does not exist and that we might not be able to eliminate all risks but we must control and mitigate them. Time and money are limited but it remains important to implement measures to reduce negative outcomes and residual risks. The ALARP principle defines four broad levels of risks:<p> <ol> <li><b>Negligible</b> where the level of risk is below concern.</li> <li><b>Acceptable</b> where the level of risk is generally regarded as sufficiently low, insignificant, and adequately controlled.</li> <li><b>Tolerable</b> where the level of risk is of concern but tolerable in view of the benefits obtained by accepting it.</li> <li><b>Unacceptable</b> where the level of risk is unacceptable regardless of the benefits associated with the activity.</li> </ol> <p>The following figure illustrates the ALARP principle and the associated conditions of risk management.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/071fb64a72c42a67f173b48343f83d40/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod1_ALARP.jpg" target="_blank"><img width="50%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/071fb64a72c42a67f173b48343f83d40/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod1_ALARP.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478;"><b>ALARP Principle</b> <a href="https://www.researchgate.net/publication/264040801_ALARP_and_the_Risk_Management_of_Civil_Unmanned_Aircraft_Systems" target="[object Object]"> (Clothier <i>et al.</i>, 2013)</a></span></center></p> <p style="color: #003478;"> Click on the figure to enlarge it.</p> <p>The main objective of risk management is therefore to implement resilience and protection measures to deter threats, mitigate vulnerabilities, minimize consequences, and keep risks at acceptable or tolerable levels.</p> </div> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@19574eafe5be4016946b9339a17be6f5" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@03f5fc4315dd4a1fb15bd6269f02e851"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@03f5fc4315dd4a1fb15bd6269f02e851" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>One of the main challenges in risk analysis is to accurately identify hazards, vulnerabilities, resilience features, and consequences, in order to characterize the risk profile. This requires knowing not only your infrastructure but also its operating environment. The identification of risks is made difficult due to the need to consider compound layers of complexity:</p> <ul> <li>The inherent complexity of critical energy infrastructure’s operational characteristics, including their vulnerability and resilience.</li> <li>The variability of the hazards and threats landscape.</li> <li>The increase of interdependencies with other critical infrastructure systems.</li> </ul> <p>Traditional approaches mainly use historical data and case studies to define and characterize the risks that should be considered during the analysis. But what about what we have not experienced before or what we do not know yet (i.e., the notorious black swan event)?</p> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@0f705d953cd44ce8a0d0033f40118cb5"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@0f705d953cd44ce8a0d0033f40118cb5" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Black Swan Events</span></p> <table> <tr> <td style="vertical-align: middle; text-align:center; border: 0px; width: 20%" colspan="1"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/85ab363996525821fbeb237614009479/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Black-Swan.jpg" alt="Get Alt Text" /></td> <td style="border: 0px;" colspan="1"><i>People always thought swans were white, until an expedition to Australia in the 18th century captured two black swans proving their existence.</i><br/><br/>In the field of risk analysis, black swans are defined as rare, random, and high-impact events and are characterized to be catastrophic and broad<a href="https://erm.ncsu.edu/library/article/risk-planning-blackswan/" target="[object Object]"> (Enterprise Risk Management Initiative, 2013)</a>. Nassim Taleb used the metaphor of the black swan to describe extreme outlier events that come as a surprise to the observer, and in hindsight, the observer rationalizes that they should have predicted it<a href="https://botrader.org/books-en/nassim-nicholas-taleb-the-black-swan/" target="[object Object]"> (Taleb, 2010)</a>. </td> </tr> </table> <p>Black Swans pose significant challenges for risk analysis. Rapidly transforming operational and environmental landscapes require to capture what is known but to also try to anticipate potential surprises (i.e., the unknown). The knowledge differentiation between the known and the unknown can be done for both the occurrence of hazards and the potential resulting consequences as shown in the figure below.</p> <p><center><img width="70%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/d6921d88b8fd3e08994abcae84d1c08d/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Categories.jpg" alt="Get Alt Text" /><br/> <span style="color: #003478; font-weight: bold !important;">Risk Categories</span><a href="https://info.veritasts.com/insights/unknown-unknowns-how-to-manage-risk-against-the-unexpected#:~:text=%20Known%20Unknowns%3A%20Risks%20that%20we%20can%20capture,know%20what%20it%20will%20be%20tomorrow.%20More%20" target="[object Object]"> (Veritas, 2022)</a></center></p> <p>An analogy can be made to represent these four risk categories with the visible and hidden parts of an iceberg.</p> <table> <tr> <td style="vertical-align: middle; text-align:center; border: 0px; width: 40%" colspan="1"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/f5f697c2ab5f35a872b7aedc60ec381c/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Iceberg.jpg" alt="Get Alt Text" /></td> <td style="border: 0px;" colspan="1"> <p><span style="color: #003478; font-weight: bold !important;">Known-Known risks</span> are the easiest type of risks when it comes to risk management. One known stands for the fact that the organization is aware that such a risk exists. The other known is for the fact that the risk can be measured and its effects can be quantified<a href="https://www.managementstudyguide.com/known-unknown-classification-of-risk.htm" target="[object Object]"> (MSG, 2022)</a>. Known-Known risks are the risks already documented or experienced before. They constitute the tip of the iceberg. Their analysis is generally based on expertise, case studies, and the use of historical data.</p> <p><span style="color: #003478; font-weight: bold !important;">Known-Unknown risks</span> are the second category of risks that companies generally face. The organization is aware of the existence of such a risk but they don't know their probability of occurrence neither the resulting impacts if they occur<a href="https://www.managementstudyguide.com/known-unknown-classification-of-risk.htm" target="[object Object]"> (MSG, 2022)</a>. Known-Unknown risks are mainly about emerging threats. We know they will happen, but we don't necessarily have the expertise and knowledge to predict them and analyze their occurrence and impacts.</p> <p><span style="color: #003478; font-weight: bold !important;">Unknown-Known risks</span> are risks that are created due to bad risk management strategies when overlooking known hazards or vulnerabilities<a href="https://www.managementstudyguide.com/known-unknown-classification-of-risk.htm" target="[object Object]"> (MSG, 2022)</a>.</p> <p><span style="color: #003478; font-weight: bold !important;">Unknown-Unknown risks</span> are the most concerning type of risks because you are not even aware of their existence and therefore, the question of measuring and quantifying them does not even arise<a href="https://www.managementstudyguide.com/known-unknown-classification-of-risk.htm" target="[object Object]"> (MSG, 2022)</a>. Unknown-Unknown risks are typically the Black Swan… or the deep end of the "Risk Iceberg."</p> </td> </tr> </table> <p>The objective of the risk analysis is therefore to deepen the knowledge and expertise to increase the Known-Known risks and reduce the other categories while being aware that there can always be a black swan. This involves identifying of emerging hazards and assessing systemic risks.</p> </div> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b5186067004e46d2952e442462bb0f52"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b5186067004e46d2952e442462bb0f52" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Emerging Hazards</span></p> <p>An <span style="color: #003478; font-weight: bold !important;">emerging hazard</span> is an hazard that may be newly recognized; may have been recognized before but may potentially affect a new or different population, industry, or geographic area than previously affected; or may be an existing hazard that has developed new attributes. When considering critical energy infrastructure, emerging hazards mainly relate to the emergence of new technologies or the changes of their operating environment. They include for example cyberthreats, climate changes, infrastructure interdependencies, and new diseases and pandemics. The figure below illustrates the effect of climate changes.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/6dfae8f3c5ef26635df4c347cbde521c/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Climate-Energy-Nexus.jpg" target="_blank"><img width="70%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/6dfae8f3c5ef26635df4c347cbde521c/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Climate-Energy-Nexus.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478; font-weight: bold !important;">Climate Energy Nexus</span><a href="https://science.osti.gov/-/media/ber/berac/pdf/201910/Helland_BERAC_Oct2019.pdf?la=en&hash=D9459B813821252BDABA27F6E48D467B20159A7E" target="[object Object]"> (Helland, Nichols, Stevens, and Yelick, 2019)</a></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> <p>Increasing frequency of weather extremes (e.g., higher temperatures, reduced water availability, inland and coastal flooding, thawing permafrost, or extreme winds) and changing environment pose risks to energy infrastructure and the built environment.</p> <p>A Joint Research Centre (JRC) report for the European Union studied critical infrastructure damages from climate extremes and key investments in the energy, transport, industrial, and social sectors, which at present reach € 3.4 billion/year. The report revealed that these damages could triple by the 2020s, multiply six-fold by mid-century, and amount to more than 10 times the present damages by the end of the century<a href="https://www.g20-insights.org/wp-content/uploads/2020/11/T20_TF3_PB11.pdf" target="[object Object]"> (Kovarik <i>et al.</i>, 2019)</a>. The figure below shows the </p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/3805dac4dfccb76a938accb5ab8b12e8/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Climate-Damages.jpg" target="_blank"><img width="50%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/3805dac4dfccb76a938accb5ab8b12e8/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Climate-Damages.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478; font-weight: bold !important;">Evolution in the 21st century of climate hazard damages to critical infrastructures in the EU+ (EU28 + Switzerland, Norway, and Iceland)</span><a href="https://op.europa.eu/en/publication-detail/-/publication/b32e6b21-2d3c-11e6-b497-01aa75ed71a1/language-en" target="[object Object]"> (Forzieri <i>et al.</i>, 2016)</a></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> <p>Considering emerging hazards in risk analysis presents several challenges.The table below lists these challenges.</p> <table> <tbody> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="2"> Risk Analysis Challenges when Considering Emerging Threats</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:200px; vertical-align: middle; text-align:center;"> <b><u>Lack of knowledge</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Intentional nature of the hybrid threats</li> <li>How can we model and predict climate change?</li> <li>How can we identify hybrid actor’s goals and objectives?</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"> <b><u>Information reliability</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Lack of a statistical and historical data</li> <li>Possible presence of “disinformation”</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"> <b><u>Information security</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>The need to keep business and operating data from competitors or adversaries that could use them at their advantage</li> <li>The need to keep technical and sensitive information from the public</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"> <b><u>Difficulty of measuring return on investment</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>How can you know whether disruptive events were prevented?</li> <li>What consequences were avoided?</li> </ul> </td> </tr> </tbody> </table> <p>Sparse observations and inadequate model fidelity limit the ability to identify vulnerability, mitigate risks, and respond to disasters. To adapt to emerging threats, the creation of resilient infrastructure is an energy security challenge for decades to come. Assessing emerging hazards requires a strategic mindset with the ability to understand and manage hazards over the long-term. Implementing a comprehensive risk analysis should therefore not focus only on the infrastructures of concern but should promote a systemic approach and address the interactions of the physical and cyber system-of-systems with their operating environment.</p> </div> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@c2a6f6f188f44449bad41b2e77a7774e"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@c2a6f6f188f44449bad41b2e77a7774e" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Systemic Risks</span></p> <p>A <span style="color: #003478; font-weight: bold !important;">systemic risk</span> is the risk that an event or events will substantially disrupt one or more infrastructure system, resulting in significant adverse effects on the overall environment. For example, systemic disruptions could be triggered or exacerbated by the failure of a financial institution that is disproportionately large and interconnected with other firms and industries, or by a major external event (such as a pandemic or terror attack) that exhausts short-term market liquidity.</p> <p>Critical energy infrastructure and critical infrastructure systems are strongly interdependent constituting a socio-technical system-of-systems. These infrastructure are built to be highly efficient and to generate economic gains but undetected fragilities produce an array of changing systemic risks. A failure can propagate and cascade across the infrastructure system-of-systems.</p> <p>In effect, through global interconnectedness, human civilization has become a “super-organism”, changing the environment from which it evolved, and inducing new hazards with no analogue. Despite technical and analytical capabilities, human society is increasingly unable to understand or manage the risks they create. Humans have also been slow to realize that the degradation of the Earth’s natural systems is becoming a source of large-scale, even existential, threat affecting fragile social systems at local, national, regional and global scales. Far-reaching changes to the structure and function of the Earth’s natural systems represent a growing threat to human health. While global economic integration continues to strengthen resilience to smaller shocks through trade adjustments, increasingly integrated network structures also create expanding vulnerabilities to traditionally recognized and novel systemic risks<a href="https://www.ynharari.com/book/21-lessons-book/" target="[object Object]"> (Harari, 2018)</a>.</p> <p>The following figure illustrates the complexity of some systemic risks.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/5df3112a4a62a8d16d90ed3721788e39/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Systemic-Risk.jpg" target="_blank"><img width="50%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/5df3112a4a62a8d16d90ed3721788e39/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Systemic-Risk.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478; font-weight: bold !important;">Representation of Systemic Risks</span><a href="https://gar.undrr.org/sites/default/files/chapter/2019-05/chapter_2.pdf" target="[object Object]"> (UNDRR, 2019)</a></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> <p>A fundamental challenge to governing systemic risk is understanding the system as a complex network of individual and institutional actors with different and often conflicting interests, values, and worldviews. Superimposed on this governance network are the potential risk events with ill-defined chains or networks of interrelated consequences and impacts<a href="https://www.oecd-ilibrary.org/governance/systemic-thinking-for-policy-making_879c4f7a-en" target="[object Object]"> (OECD, 2020)</a>.</p> <p>The many elements of a system and the interconnections between these elements make systemic risks more difficult to define in terms of impact and likelihood. To deal with systemic risks, the risk analysis must take into account all the elements characterizing the way in which critical infrastructure systems are integrated and affected by their environment.</p> </div> </div> </div> <div class="vert vert-4" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e1515c8f18a441f9844b0f74b74aa634"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e1515c8f18a441f9844b0f74b74aa634" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p><span style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Conclusion</span></p> <p>Identifying emerging hazards is particularly important in the context of strategic risk management. By identifying potential hazard trends, critical energy infrastructure can identify potential shifts in the hazards landscape and develop systemic risk analysis approaches to inform protection and resilience enhancement strategies. This requires developing a critical thinking mindset.</p> </div> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@ae6d59e04c0045e195287e7a5a9ce20c" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b71d0d4772ab402799336d8e84b37612"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b71d0d4772ab402799336d8e84b37612" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>As we have seen in this course so far, risk analysis applied to critical energy infrastructure requires to consider several elements from the basic risk components (i.e., hazards, vulnerability, resilience, and consequences) to the critical infrastructure system-of-systems. Conducting risk analysis is inherently complex for integrating not only protection and resilience features but also physical, cyber, geographic, and logical considerations. This complexity is exacerbated by the emergence of new and sometimes hazards unexperienced before (e.g., hybrid threats and climate change) and the resulting changes occurring in the hazard landscape. Risk analysts and decision makers face tasks that seem insurmountable and it can be challenging to define where and how to start the risk analysis.<br/><br/>It is important to establish a process that is objective, consistent, and defensible enough to stand up to scrutiny and that it is repeatable enough to pass that information and methodology to other analysts and decision makers that they would be able to come up with the same results and conclusions. The risk analysis must therefore follow the risk analytic tradecraft.<br/><br/>The risk analytic tradecraft is established to meet customer expectations and answer decision maker questions. The analysis should be customer driven to provide situational awareness and to assist leadership in making a decision. This requires going beyond facts and to think critically to use available information and come up with legitimate, defensible conclusions based on that information. Lastly, effective communication, both in writing and in oral briefings, is key. If the stakeholders do not understand the so what of the analysis, the mission is not fulfilled. Analysis that cannot be or is not clearly communicated losses its value.</p> <table> <tr> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="1"> <b>Thinking critically is vital for conducting risk analysis but also for communicating effectively.</b></td> </tr> </table> <p style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">What is critical thinking?</p> <table> <tr> <td style="vertical-align: middle; text-align:center; border: 0px; width: 20%" colspan="1"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/e96323e3d7094af0dc264b1810f088c3/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Thinker-Rodin_v2.jpg" alt="Get Alt Text" /></td> <td style="border: 0px;" colspan="1">Critical thinking is a rich concept that has been developing throughout the past 2,500 years. The term "critical thinking" has its roots in the mid-late 20th century. Critical thinking is the intellectually disciplined process of actively and skillfully conceptualizing, applying, analyzing, synthesizing, and/or evaluating information gathered from, or generated by, observation, experience, reflection, reasoning, or communication, as a guide to belief and action. In its exemplary form, it is based on universal intellectual values that transcend subject matter divisions: clarity, accuracy, precision, consistency, relevance, sound evidence, good reasons, depth, breadth, and fairness <a href="https://www.criticalthinking.org/pages/defining-critical-thinking/766" target="[object Object]"> (The Foundation for Critical Thinking, 2019)</a>.</td> </tr> </table> <table> <tr> <td style="vertical-align: middle; text-align:center; border: 0px; width: 20%" colspan="1"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/57159421763a5afbacf8bbe099be49f4/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Critical-Thinking-Guide.jpg" alt="Get Alt Text" /></td> <td style="border: 0px;" colspan="1"><b>A well cultivated critical thinker</b>: <a href="https://www.criticalthinking.org/files/Concepts_Tools.pdf" target="[object Object]"> (Paul and Elder, 2008)</a> <ul> <li>raises vital questions and problems, formulating them clearly and precisely.</li> <li>gathers and assesses relevant information, using abstract ideas to interpret it effectively comes to well-reasoned conclusions and solutions, testing them against relevant criteria and standards.</li> </ul> </td> </tr> </table> <p>Critical thinking is, in short, self-directed, self-disciplined, self-monitored, and self-corrective thinking. It presupposes assent to rigorous standards of excellence and mindful command of their use. It entails effective communication and problem-solving abilities and a commitment to overcome our native egocentrism and sociocentrism <a href="https://www.criticalthinking.org/files/Concepts_Tools.pdf" target="[object Object]"> (Paul and Elder, 2008)</a>.</p> <p style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Why critical thinking is important for risk analysis?</p> <p>Everyone thinks. However, much thinking can be biased, distorted, partial, or uninformed. The quality of the risk analysis depends on the quality of analysts' thinking. Analysts should:</p> <ul> <li>become better users of information;</li> <li>conduct more refined analysis; and</li> <li>produce stronger products.</li> </ul> <p>In case of large gaps in the information or a lack of good sources, the analysis could be based on faulty assumptions and the quality of final products (i.e., briefings, documents, and trainings) are going to suffer. Ultimately, the objective is to increase effectiveness and efficiency.</p> <p style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Critical thinking and intellectual standards</p> <p>Critical thinking and intellectual standards cover common sense components such as ensuring fairness in your analysis, ensuring accuracy in the information used, and ensuring a logical argumentation. Universal intellectual standards are standards which when applied to thinking provides a means of checking the quality of reasoning about a problem, issue, situation, or question. The figure below shows the intellectual standards supporting critical thinking.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/6d8ebbd7295bfd58107a9ee7c049ef30/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Intellectual-Standards.jpg" target="_blank"><img width="60%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/6d8ebbd7295bfd58107a9ee7c049ef30/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Intellectual-Standards.jpg" alt = "Get Alt Text"/></a> <span style="color: #003478; font-weight: bold !important;"><br/> Elements of Thought</span><a href="https://www.criticalthinking.org/files/Concepts_Tools.pdf" target="[object Object]"> (Paul and Elder, 2008)</a></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> <p>The table below provides additional information on the intellectual standards as well as examples of questions that can be used to apply critical thinking and improve the risk analysis.</p> <table> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="2"> Elements Supporting Critical Thinking<a href="https://www.psychologytoday.com/us/blog/ethics-everyone/201206/standards-critical-thinking" target="[object Object]"> <span style="color: white;"> (Austin, 2022)</span></a></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Clarity</td> <td style="background-color:white; border: 1px solid black; padding: 15px;">Clarity is an important standard of critical thoughts. Clarity of communication is one aspect of this. It is important to be clear in ways thoughts, beliefs, and reasons for those beliefs are communicated. Clarity of thought is important as well; this means that we clearly understand what we believe, and why we believe it.<br/><br/> The following questions can help improve the clarity of the analysis: <ul> <li>Could you elaborate further?</li> <li>Could you give me an example?</li> <li>Could you illustrate what you mean?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Accuracy</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Accuracy is unquestionably essential to critical thinking. In order to get at or closer to the truth, critical thinkers seek accurate and adequate information. They want the facts because they need the right information before they can move forward and analyze it.<br/><br/> The following questions can help improve the accuracy of the analysis: <ul> <li>How could we check on that? </li> <li>How could we find out if that is true?</li> <li>How could we verify or test that</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Precision</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Precision involves working hard at getting the issue under consideration before our minds in a particular way.<br/><br/> The following questions can help improve the precision of the analysis: <ul> <li>Could you be more specific?</li> <li>Could you give me more details?</li> <li>Could you be more exact?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Relevance</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Relevance means that the information and ideas discussed must be logically relevant to the issue being discussed.<br/><br/> The following questions can help improve the relevance of the analysis: <ul> <li>How does that relate to the problem?</li> <li>How does that bear on the question?</li> <li>How does that help us with the issue?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Depth</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Depth of thought considers all of the complexities and difficulties of an issue. Depth is “deepness” of thought.<br/><br/>The following questions can help improve the depth of the analysis: <ul> <li>What factors make this a difficult problem?</li> <li>What are some of the complexities of this question?</li> <li>What are some of the difficulties we need to deal with?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Breadth</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Breadth of thought incorporates thinking about all of the necessary contexts of the issue at hand. Breadth is “width” of thought.<br/><br/>The following questions can help improve the breadth of the analysis: <ul> <li>Do we need to look at this from another perspective?</li> <li>Do we need to consider another point of view?</li> <li>Do we need to look at this in other ways?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Logic</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Logical correctness means that one is engaging in correct reasoning from what we believe in a given instance to the conclusions that follow from those beliefs.<br/><br/> The following questions can help improve the logic of the analysis: <ul> <li>Does all this make sense together?</li> <li>Does your first paragraph fit in with your last?</li> <li>Does what you say follow from the evidence?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Significance</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;"><br/><br/>Significance means that one should concentrate on the most important information (relevant to the issue) and take into account the most important ideas or concepts.<br/><br/> The following questions can help improve the significance of the analysis: <ul> <li>Is this the most important problem to consider?</li> <li>Is this the central idea to focus on?</li> <li>Which of these facts are most important?</li> </ul></td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center; font-weight: bold !important; text-decoration: underline !important;"> Fairness</td> <td style="background-color:white; border: 1px solid black; padding: 15px; width:300px;">Fairness involves seeking to be open-minded, impartial, and free of biases and preconceptions that distort our thinking.<br/><br/> The following questions can help improve the fairness of the analysis: <ul> <li>Do I have any vested interest in this issue?</li> <li>Am I sympathetically representing the viewpoints of others?</li> </ul></td> </tr> </table> <p>These standards of critical thinking should be part and parcel to your analysis. The figure below synthetize the application of intellectual critical thinking standards to the elements of risk analysis.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/72cc37693e8f885fd2168d55e90e4bd6/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Critical-Thinking-and-Risk-Analysis-Elements.jpg" target="_blank"> <img width="60%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/72cc37693e8f885fd2168d55e90e4bd6/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Critical-Thinking-and-Risk-Analysis-Elements.jpg" alt = "Get Alt Text"/></a><span style="color: #003478;"><br/> <b>Developing Critical Thinking</b></span></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6c82425e1d2c43eeaed8556ead2ba938"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6c82425e1d2c43eeaed8556ead2ba938" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Desired Skills to Demonstrate Critical Thinking</p> <p>Ultimately, the objective is to increase effectiveness and efficiency. Thus, it is important to:</p> <ul> <li >raise important questions and to formulate them clearly and precisely;</li> <li>gather and assess relevant information, or if it’s not available, to define how to obtain it or alternative information that might be able to be used in its place;</li> <li>come to well-reasoned conclusions and solutions that have been tested against relevant criteria;</li> <li>keep an open mind to recognize and assess one’s own assumptions; and</li> <li>communicate effectively with others.</li> </ul> <p>It is important for analysts to be self-critical in order to enhance the quality of their risk analysis. Being your greatest critic allows to answer most of leadership’s potential questions and challenges when the analysis products go through the approval review process.</p> <p>The table below summarizes the desired skills for a risk analyst.</p> <table> <tbody> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="2"> Key Skills of a Risk Analyst</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:200px; vertical-align: middle; text-align:center;"> <b><u>Meet customer expectations</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Answer decision maker questions</li> <li>Go beyond mere facts</li> <li>Base answers on available information and institutional knowledge</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"> <b><u>Think critically</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Evaluate your own assumptions, biases, and mindset</li> <li>Critically examine available information to determine if you can justify drawing conclusions or making recommendations (defensibility of product)</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Communicate effectively</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Both in writing and in oral briefings</li> <li>Thinking critically will help you communicate effectively</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Be self-critical</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Ability to find mistakes and possibilities for improvement in one's own work</li> <li>Consciously attempt not to find fault</li> <li>Recognize errors and bias in judgment</li> <li>Identify and address gaps</li> <li>Evaluate your reasoning—determine the value, worth, or merit</li> </ul> </td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>What good analysts do</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> <ul> <li>Raise important questions</li> <li>Formulate them clearly and precisely</li> <li>Gather and assess relevant information</li> <li>Interpret it effectively</li> <li>Come to well-reasoned conclusions and solutions</li> <li>Test them against relevant criteria</li> <li>Keep an open mind</li> <li>Recognize and assess one’s own assumptions</li> <li>Communicate effectively with others</li> <li>Consistent use of these standards will ensure risk analyses are consistent, defensible, and repeatable</li> </ul> </td> </tr> </tbody> </table> <table> <tr> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="1"><b>Good analysts are self-critical and best analysts let the analysis drives their conclusions.<br/>They don’t let their conclusions drive the analysis.</b></td> </tr> </table> </div> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@84a38fb6d28443d8936ffabf38128f62" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@171cbf4ac235482b9b217f93c05fe8ba"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@171cbf4ac235482b9b217f93c05fe8ba" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>Remember the information presented in the first module on the introduction to risk analysis:</p> <ul style="margin-left: .25in"> <li><span style="color: #003478; font-weight: bold !important;">Risk Analysis</span> is a <i>"systematic examination of the components and characteristics of risk."</i></li> <li><span style="color: #003478; font-weight: bold !important;">Risk Management</span> is a <i>"process of identifying, analyzing, assessing, and communicating risk; and accepting, avoiding, transferring, or controlling it to an acceptable level considering the associated costs and the benefits of any actions taken."</i></li> </ul> <table> <tr> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="1"><b>In the absence of risk analysis, decision makers will still make decisions,<br/> but will lack the benefits of the analysis you can provide.</b></td> </tr> </table> <p>Risk analysis is one of the first phases of the risk management process. Its objective is to gather significant information and to develop relevant products to inform the implementation of management strategies and to support decision making. There are two main types of decision making:</p> <ul> <li><span style="color: #003478; font-weight: bold !important;">Risk-Based Decision Making</span> is the determination of a course of action predicated primarily on the assessment of risk and the expected impact of that course of action on that risk.</li> <li><span style="color: #003478; font-weight: bold !important;">Risk-Informed Decision Making</span> is the determination of a course of action predicated on the assessment of risk, the expected impact of that course of action on that risk, as well as other relevant factors.</li> </ul> <p>Risk management applications involve various actions like strategic planning, executive planning, capabilities-based planning, mitigation of real-world events, resourcs decisions, research and development, and operational planning.</p> <p>An effective risk management follows several key principles presented in the table below.</p> <table> <tbody> <tr> <td style="background-color:#003478; color: white; border: 1px solid black; padding: 15px; vertical-align: middle; text-align:center;" colspan="2">Key Principles of Risk Management</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:200px; vertical-align: middle; text-align:center;"><b><u>Unity of Effort</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> Risk management is an enterprise-wide process that should promote integration and synchronization.</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Transparency</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> Risk management should promote open and direct communications.</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Adaptability</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> Risk managment actions, strategies, and processes should remain dynamic and responsive to change.</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Practicality</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> Risk management cannot eliminate all uncertainties nor is it reasonable to expect to identify all risks and their likelihoods and consequences.</td> </tr> <tr style="border: 1px solid black; padding: 15px; horizontal-align: middle; vertical-align: middle;"> <td style="background-color:rgba(0,136,198,.30); border: 1px solid black; padding: 15px; width:100px; vertical-align: middle; text-align:center;"><b><u>Customization</u></b></td> <td style="border: 1px solid black; padding: 15px; align: middle; vertical-align: middle;"> Risk management should be tailored to match needs and culture of the organization, and balanced with the specific decision environment they support.</td> </tr> </tbody> </table> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@69ff8ab39bcd4dc9b2b7e4ccb6a1dfb6"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@69ff8ab39bcd4dc9b2b7e4ccb6a1dfb6" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p style="font-size: 13pt !important; color: #003478; font-weight: bold !important; text-decoration: underline !important;">Risk Management Cycle</p> <p>The risk management cycle provides a common, interoperable, and systemic approaches to risk management. It promotes comparability and a shared understanding of information and analysis in the decision process. The implementation of the risk management cycle facilitates a more structures and informed decision-making. The figure below shows the seven phases of the risk management cycle.</p> <p><center><a href="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/8eeadda2b457830ec097a386648206ae/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Management-Cycle.jpg" target="_blank"><img width="60%" src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/8eeadda2b457830ec097a386648206ae/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Risk-Management-Cycle.jpg" alt="Get Alt Text" /></a><br/> <span style="color: #003478; font-weight: bold !important;">Risk Management Cycle</span></center></p> <p style="color: #003478;">Click on the figure to enlarge it.</p> <p style="color: #003478;"> Expand the accordions below for more information on the risk management cycle.</p> <p style="color: #003478;">You can also find more information on the phases of risk management <u><a href="https://www.finance.gov.au/sites/default/files/2019-11/Risk-Management-Process.pdf" target="[object Object]"> here</a></u>.</p> </div> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@bf8acd03832940a4abe10a277f712322"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@bf8acd03832940a4abe10a277f712322" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Define the Context</button> <div class="panel"><br/> <div> <p>The first stage establishes the scope of the risk analysis and assessment and defines the goals and objectives. When establishing the context for a risk assessment, it is important to consider the external context (i.e., the environment in which the critical infrastructure operates including policy, operational, cultural, political, people, environmental, legal, regulatory, financial, technological and economic factors), the internal context (characteristics of the critical infrastructure considered), and the risk management context (i.e., goals and objectives of the risk management).<br/><br/><u>Elements traditionally defined and identified at this stage:</u></p> <ul> <li>Goals and Objectives</li> <li>Decision Makers and Stakeholders</li> <li>Mission Space and Values</li> <li>Decision Timeframe</li> <li>Policies and Standards</li> <li>Risk Management Capabilities and Resources</li> <li>Scope and Criticality of the Decision</li> <li>Risk Tolerance</li> <li>Availability and Quality of Information</li> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e35b0db1327a4b6ba36019f3e59a95a4"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@e35b0db1327a4b6ba36019f3e59a95a4" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new1" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Identify Potential Risk</button> <div class="panel1"><br/> <div> <p>The aim of this stage is to develop a comprehensive and tailored list of future events which could be uncertain, but are likely to have an impact (either positively or negatively) on the achievement of the objectives. This stage seeks to define what can happen and why can this happen by identifying potential threats and hazards, vulnerabilities, resilience measures, or consequences.<br/><br/><u>Elements traditionally defined and identified at this stage include:</u></p> <ul> <li>Unusual, Unlikely, and Emerging Risks</li> <li>Scenarios - A hypothetical situation comprising a hazard, an entity impacted by that hazard, and associated conditions including consequences when appropriate</li> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new1"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-4" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@dd7f94b91c614928a86f37e30aa33dfa"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@dd7f94b91c614928a86f37e30aa33dfa" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new2" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Analyze and Assess Risk</button> <div class="panel2"><br/> <div> <p>It is at this stage that the risk analysis is carried out. The analysis is conducted based on the risks (i.e., hazards, vulnerabilities, resilience measures, and consequences) identified during the previous stage. The risk analysis is prioritized based on the probability of occurrence of hazards, the likelihood of threats, and their potential impacts.<br/><br/><u>Activities traditionally conducted at this stage include:</u></p> <ul> <li>Determine a methodology</li> <li>Gather data</li> <li>Execute the methodology</li> <li>Validate and verify data</li> <li>Analyze outputs</li> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new2"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-5" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6cdece8f453f4a128f1a21257500b906"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@6cdece8f453f4a128f1a21257500b906" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new3" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Develop Alternatives</button> <div class="panel3"><br/> <div> <p>This stage aims to determine the tolerability of each risk and to define which risks need treatment and their relative priority. The definition of alternative strategies should consider resource constraints, potential conflicting results, and expected return on investment. Alternatives must be evaluated in terms of projected risk reduction and cost effectiveness.<br/><br/><u>Activities traditionally conducted at this stage include:</u></p> <ul> <li>Review lessons learned from relevant past incidents</li> <li>Consult subject matter experts, best practices, and government guidelines</li> <li>Brainstorm to define innovative solutions</li> <li>Organize risk management actions</li> <li>Evaluate options for risk reduction and residual risk</li> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new3"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-6" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@fe2500ef423c486c9452216b2cc2ae2a"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@fe2500ef423c486c9452216b2cc2ae2a" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new4" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Decide and Implement Alternatives</button> <div class="panel4"><br/> <div> <p>This stage is the real first stage of management during which leadership will review the risk analysis products and select alternatives that will be implemented. Ensuring appropriate implementation is critical to optimize risk reduction measures.<br/><br/><u>Activities traditionally conducted at this stage include:</u></p> <ul> <li>Present Information</li> <ul> <li style="list-style-type:circle;">Feasibility of implementing options</li> <li style="list-style-type:circle;">How various alternatives affect and reduce risk</li> <li style="list-style-type:circle;">Stakeholders needs</li> </ul> <li>Document and Implement</li> <ul> <li style="list-style-type:circle;">Ensure the decision is documented and communicated</li> </ul> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new4"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-7" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@55348c3f648f43b29287fec0e33aede3"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@55348c3f648f43b29287fec0e33aede3" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new5" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Evaluate and Monitor</button> <div class="panel5"><br/> <div> <p>Risks change over time and hence risk management will be most effective where it is dynamic and evolving. Monitoring and review is integral to successful risk management. This stage uses effectiveness criteria to report performance and results. Risk management is an iterative process and it is important to assess the outcomes to feed back into the first phase of the risk management cycle.<br/><br/><u>Activities traditionally conducted at this stage include:</u></p> <ul> <li>Build a performance logic model that defines casual relationships between activities and risk management goals</li> <ul> <li style="list-style-type:circle;">Risk Management Goals</li> <li style="list-style-type:circle;">Inputs</li> <li style="list-style-type:circle;">Effort</li> <li style="list-style-type:circle;">Outcome</li> <li style="list-style-type:circle;">Outcome Performance Measures</li> </ul> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new5"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> <div class="vert vert-8" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5e75a016e97a40888a5d1e6822ab5a1e"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@5e75a016e97a40888a5d1e6822ab5a1e" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div><button class="accordion_new6" style= "font-size: 12.0pt; font-family: 'Calibri'; background-color: #003478; background-image: none; ">Risk Communication</button> <div class="panel6"><br/> <div> <p>Communication and consultation is an essential attribute of good risk management. Risk management cannot be done in isolation and is fundamentally communicative and consultative. Exchange of information with the goal of improving risk understanding, affecting risk perception, and/or equipping people or groups to act appropriately in response to an identified risk.<br/><br/><u>Activities traditionally conducted at this stage include:</u></p> <ul> <li>Plan for communications</li> <li>Maintain trust</li> <li>Use language appropriate to the audience</li> <li>Be both clear and transparent</li> <li>Respect the audience’s concerns</li> <li>Maintain integrity of information</li> </ul> </div> </div> </div> <script type="text/javascript"> var acc = document.getElementsByClassName("accordion_new6"); var i; for (i = 0; i < acc.length; i++) { acc[i].addEventListener("click", function() { this.classList.toggle("active"); var panel = this.nextElementSibling; if (panel.style.display === "block") { panel.style.display = "none"; } else { panel.style.display = "block"; } }); } </script> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@cfa050e3b37c43028f16c0cf02946ff9" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@1288afef2e8d49bb9dec4e321063e729"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@1288afef2e8d49bb9dec4e321063e729" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div> <p>The general concepts presented in this module constitute more advanced concepts of risk analysis and risk management. <p style="color: #003478; text-decoration: underline !important; font-weight: bold !important;">The seven key elements presented through this module are:</p> <p style="color: #003478; font-weight: bold !important;">1. The overall success of the national infrastructure protection mission depends on strong risk analysis processes that generally consist in six main phases:</p> <ol class="SecondOrderList" id="SecondOrderList" style="padding-left: 50px;" type="a" start="1"> <li>Planning the analysis.</li> <li>Analyzing the risk.</li> <li>Producing the analysis deliverable.</li> <li>Reviewing the risk product.</li> <li>Presenting the risk product.</li> <li>Producing the analysis deliverables.</li> </ol> <p style="color: #003478; font-weight: bold !important;">2. Risk analysis tradecraft standards are fundamental to conducting risk analysis and developing associated risk analytic products.</p> <p style="color: #003478; font-weight: bold !important;">3. Risk analysis must consider traditional risk components (i.e., hazards, vulnerability, resilience, and consequences) but also emerging threats and systemic risks.</p> <p style="color: #003478; font-weight: bold !important;">4. Critical thinking is important to establish a risk analysis that is objective, consistent, and defensible.</p> <p style="color: #003478; font-weight: bold !important;">5. Intellectual standards can be used to use critical thinking and improve the quality of risk analysis processes and products. There nine elements supporting critical thinking:</p> <ol style="padding-left: 50px;" class="SecondOrderList" id="SecondOrderList" type="a" start="1"> <li>Clarity</li> <li>Accuracy</li> <li>Precision</li> <li>Relevance</li> <li>Depth</li> <li>Breadth</li> <li>Logic</li> <li>Significance</li> <li>Fairness</li> </ol> <p style="color: #003478; font-weight: bold !important;">6. Risk analysis is the foundation of risk assessment and management processes.</p> <p style="color: #003478; font-weight: bold !important;">7. The risk management cycle provides common, interoperable, and systematic approaches to risk management. It comprises seven phases:</p> <ol style="padding-left: 50px;" class="SecondOrderList" id="SecondOrderList" type="a" start="1"> <li>Define the context.</li> <li>Identify potential risk.</li> <li>Analyze and assess risk.</li> <li>Develop alternatives.</li> <li>Decide and implement adaptation and mitigation measures.</li> <li>Evaluate and monitor.</li> <li>Communications.</li> </ol> </div> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@fd708c766b294c488f9a0e745920fce9" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@930b2839f9b74a1eaec262603a8c661e"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@930b2839f9b74a1eaec262603a8c661e" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <div>The following learning quiz will help you test your understanding of the important elements presented in the Intermediate Risk Assessment module.<br/><br/> <p>The test includes five questions.</p> <p style="color: #003478;">In case you make a mistake while answering a question, <span style="text-decoration: underline !important;">go back to the corresponding section to review the concepts presented.</span></p> </div> </div> </div> <div class="vert vert-1" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@eb21dbb2587c480c81b3cab3a87a0ac4"> <div class="xblock xblock-public_view xblock-public_view-problem xmodule_display xmodule_ProblemBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-block-type="problem" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@eb21dbb2587c480c81b3cab3a87a0ac4" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="True"> <div class="page-banner"><div class="alert alert-warning"><span class="icon icon-alert fa fa fa-warning" aria-hidden="true"></span><div class="message-content">Question 1 is only accessible to enrolled learners. Sign in or register, and enroll in this course to view it.</div></div></div> </div> </div> <div class="vert vert-2" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@93957b199d7d4727afa4741691ea09fc"> <div class="xblock xblock-public_view xblock-public_view-problem xmodule_display xmodule_ProblemBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-block-type="problem" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@93957b199d7d4727afa4741691ea09fc" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="True"> <div class="page-banner"><div class="alert alert-warning"><span class="icon icon-alert fa fa fa-warning" aria-hidden="true"></span><div class="message-content">Question 2 is only accessible to enrolled learners. Sign in or register, and enroll in this course to view it.</div></div></div> </div> </div> <div class="vert vert-3" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@e2f3f06009f944f0baa4139398ba4da1"> <div class="xblock xblock-public_view xblock-public_view-problem xmodule_display xmodule_ProblemBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-block-type="problem" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@e2f3f06009f944f0baa4139398ba4da1" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="True"> <div class="page-banner"><div class="alert alert-warning"><span class="icon icon-alert fa fa fa-warning" aria-hidden="true"></span><div class="message-content">Question 3 is only accessible to enrolled learners. Sign in or register, and enroll in this course to view it.</div></div></div> </div> </div> <div class="vert vert-4" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@870f0b12b47f4d54858139ee7a58ae39"> <div class="xblock xblock-public_view xblock-public_view-problem xmodule_display xmodule_ProblemBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-block-type="problem" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@870f0b12b47f4d54858139ee7a58ae39" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="True"> <div class="page-banner"><div class="alert alert-warning"><span class="icon icon-alert fa fa fa-warning" aria-hidden="true"></span><div class="message-content">Question 4 is only accessible to enrolled learners. Sign in or register, and enroll in this course to view it.</div></div></div> </div> </div> <div class="vert vert-5" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@c24c22272e364fa4963b8197437941b5"> <div class="xblock xblock-public_view xblock-public_view-problem xmodule_display xmodule_ProblemBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-block-type="problem" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@problem+block@c24c22272e364fa4963b8197437941b5" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="True"> <div class="page-banner"><div class="alert alert-warning"><span class="icon icon-alert fa fa fa-warning" aria-hidden="true"></span><div class="message-content">Question 5 is only accessible to enrolled learners. Sign in or register, and enroll in this course to view it.</div></div></div> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>

<div class="xblock xblock-public_view xblock-public_view-vertical" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="VerticalStudentView" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="vertical" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@vertical+block@99b11c42f5864e4cab743dae77ca96dd" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <div class="vert-mod"> <div class="vert vert-0" data-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b2043fc5160548c296f6e7d5e77d6878"> <div class="xblock xblock-public_view xblock-public_view-html xmodule_display xmodule_HtmlBlock" data-course-id="course-v1:OSCE+CriticalEnergyNetworks101+2021" data-init="XBlockToXModuleShim" data-runtime-class="LmsRuntime" data-runtime-version="1" data-block-type="html" data-usage-id="block-v1:OSCE+CriticalEnergyNetworks101+2021+type@html+block@b2043fc5160548c296f6e7d5e77d6878" data-request-token="30b221aa2ef911f0a5ff6e93a8fe03a8" data-graded="False" data-has-score="False"> <script type="json/xblock-args" class="xblock-json-init-args"> {"xmodule-type": "HTMLModule"} </script> <style></style> <table> <tbody> <tr> <td style="background-color: #003478; color: white; font-weight: bold !important;" colspan="2">Good Governance for Critical Infrastructure Resilience</td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="align: middle; vertical-align: middle; width: 15%"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/52182e20c7f7133c4aa78163c92aab34/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Ref1.jpg" alt="Get Alt Text" /></td> <td style="align: left; vertical-align: top;">This report looks at how to boost critical infrastructure resilience in a dynamic risk landscape, and discusses policy options and governance models to promote up-front resilience investments. Based on an international survey, the report analyses the progressive shift of critical infrastructure policies from asset protection to system resilience. The findings are reflected in a proposed Policy Toolkit for the Governance of Critical Infrastructure Resilience, which can guide governments in taking a more coherent, preventive approach to protecting and sustaining essential services.</td> </tr> <tr> <td colspan="2"><span style="color: #003478; font-weight: bold !important;"><em>Reference:</em></span> Organisation for Economic Cooperation and Development (OECD), 2019, <a href="https://doi.org/10.1787/02f0e5a0-en" target="_blank">Good Governance for Critical Infrastructure Resilience</a>, OECD Reviews of Risk Management Policies, ISBN 978-92-64-41050-3, accessed on April 15, 2021. </td> </tr> <tr> <td style="background-color: #003478; color: white; font-weight: bold !important;" colspan="2">The Landscape of Hybrid Threats: A conceptual model</td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="align: middle; vertical-align: middle; width: 15%"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/177cd7fac8e2e3e7759c21b80257036a/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Ref2.jpg" alt="Get Alt Text" /></td> <td style="align: left; vertical-align: top;">This publication describes the components of hybrid threats in terms of actors, their objectives, tools, the domains that can be compromised, as well as the different phases of action. The model aims to facilitate the early detection of hybrid threats, the identification of gaps in preparedness, the response to such threats, and the development of effective measures to counter this complex phenomenon. </td> </tr> <tr> <td colspan="2"><span style="color: #003478; font-weight: bold !important;"><em>Reference:</em></span> Giannopoulos, G., and H. Smith, and M Theocharidou, M., 2020, <a href="https://www.hybridcoe.fi/wp-content/uploads/2021/02/conceptual_framework-reference-version-shortened-good_cover_-_publication_office.pdf" target="_blank"> The Landscape of Hybrid Threats: A conceptual model</a>, European Union and Hybrid COE, PUBSY No. 123305 2020, accessed on April 15, 2021. </td> </tr> <tr> <td style="background-color: #003478; color: white; font-weight: bold !important;" colspan="2">2019 Global Assessment Report - Chapter 2</td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="align: middle; vertical-align: middle; width: 15%"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/34b84219be91ed33ff4d821e8f262468/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Ref3.jpg" alt="Get Alt Text" /></td> <td style="align: left; vertical-align: top;">The UN Global Assessment Report on Disaster Risk Reduction (GAR) is the flagship report of the United Nations on worldwide efforts to reduce disaster risk. The GAR is published biennially by the UN Office for Disaster Risk Reduction (UNDRR), and is the product of the contributions of nations, public and private disaster risk-related science and research, amongst others.<br/><br/>The 2019 GAR was informed by the latest data – including Sendai Framework target reporting by countries using the Sendai Framework Monitor – and infers early lessons on the state of the global disaster risk landscape.<br/><br/> Chapter 2 explores the systemic risks that are embedded in the complex networks of an increasingly interconnected world. It explores the dynamic interactions among the Sendai Framework, the 2030 Agenda, the Paris Agreement, the New Urban Agenda and the Agenda for Humanity.</td> </tr> <tr> <td colspan="2"><span style="color: #003478; font-weight: bold !important;"><em>Reference:</em></span> United Nations Office for Disaster Risk Reduction (UNDRR), 2019, <a href="https://publications.anl.gov/anlpubs/2015/06/111906.pdf" target="_blank"> Chapter 2: Systemic risks, the Sendai Framework and the 2030 Agenda</a>, A Global Assessment Report on Disaster Risk Reduction, ISBN/ISSN/DOI 978-92-1-004180-5, accessed on April 15, 2021. </td> </tr> <tr> <td style="background-color: #003478; color: white; font-weight: bold !important;" colspan="2">Climate Resilience</td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="align: middle; vertical-align: middle; width: 15%"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/91bf1b79a91c7dddc58a004b9030250c/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Ref4.jpg" alt="Get Alt Text" /></td> <td style="align: left; vertical-align: top;">Electricity is an integral part of all modern economies, supporting a range of critical services. Secure supply of electricity is of paramount importance. The power sector is going through fundamental changes with increasing pressure from climate change. Climate change directly affects every segment of the electricity system altering generation potential and efficiency, testing physical resilience of transmission and distribution networks, and changing demand patterns. Effective policy measures and co-ordinated action among key actors play a central role in building resilience to climate change. This report provides an overview of the climate impacts on electricity systems. It describes how climate change affects each segment of the electricity value chain – generation, transmission and distribution, and demand – with case studies around the world. It proposes a step-by-step application of measures for policy makers and key stakeholders to build the climate resilience of electricity systems. </td> </tr> <tr> <td colspan="2"><span style="color: #003478; font-weight: bold !important;"><em>Reference:</em></span> International Energy Agency (IEA), 2021, <a href="https://www.iea.org/topics/climate-change" target="_blank">Climate Resilience</a>, Electricity Security 2021, accessed on November 13, 2021.</td> </tr> <tr> <td style="background-color: #003478; color: white; font-weight: bold !important;" colspan="2">Good Practices Guide on Non-Nuclear Critical Energy Infrastructure Protection (NNCEIP) from Terrorist Attacks Focusing on Threats Emanating from Cyberspace</td> </tr> <tr style="align: middle; vertical-align: middle;"> <td style="align: middle; vertical-align: middle; width: 15%"><img src="//d24jp206mxeyfm.cloudfront.net/assets/courseware/v1/25cf828e69ef4a3c8be34a528b172c20/asset-v1:OSCE+CriticalEnergyNetworks101+2021+type@asset+block/Mod5_Ref5.jpg" alt="Get Alt Text" /></td> <td style="align: left; vertical-align: top;">This publication intends to provide a framework that encourages the formulation and implementation of appropriate policies and institutional management of cyber security related to NNCEI, based on a co-operative, integrated (all-hazard) and risk-based approach, and with an emphasis on achieving incident response preparedness, overall infrastructure resilience and energy reliability. Issues include: risk assessment, physical security, cybersecurity, contingency planning, public-private partnerships, community engagement (including the special contributions of women community members), and international/cross-border co-operation.</td> </tr> <tr> <td colspan="2"><span style="color: #003478; font-weight: bold !important;"><em>Reference:</em></span> Organisation for Security and Co-operation in Europe (OECD), 2013, <a href="https://www.osce.org/files/f/documents/4/b/103500.pdf" target="_blank"> Good Practices Guide on Non-Nuclear Critical Energy Infrastructure Protection (NNCEIP) from Terrorist Attacks Focusing on Threats Emanating from Cyberspace</a>, ISBN 978-92-9235-022-2, accessed on November 10, 2021.</td> </tr> </tbody> </table> </div> </div> </div> <script type="text/javascript"> (function (require) { require(['https://d24jp206mxeyfm.cloudfront.net/static/js/dateutil_factory.a28baef97506.js?raw'], function () { require(['js/dateutil_factory'], function (DateUtilFactory) { DateUtilFactory.transform('.localized-datetime'); }); }); }).call(this, require || RequireJS.require); </script> <script> function emit_event(message) { parent.postMessage(message, '*'); } </script> </div>