Designing a Security Audit Plan for a Critical Information Infrastructure (CII)
Eduardo Gelbstein · IGI Global eBooks · 2012
Critical Information Infrastructure Infrastructures (CII) have been recognized as potential targets for cyber-attacks since the late 1990s and many have already been successfully attacked since then. The attacks that took place on September 11, 2001 have increased the concerns of the impact such attacks could have and many governments, professional bodies, and vendors have put in place advisory and coordination mechanisms to share and encourage such good practices. Critical infrastructures are monitored and controlled by information systems, and this makes it increasingly difficult to distinguish a Critical Infrastructure from a Critical Information Infrastructure. It is also acknowledged that such information systems are complex, interdependent, and convergent as they share components that use a small number of products and standards. All of these systems and the products with which they are built are known to have known and unknown vulnerabilities that could be exploited by attackers.