Module: CYS6005-20 Critical Infrastructure

Level: 6

Credit Value: 20

Module Tutor: John Curry

Module Tutor Contact Details: j.curry@bathspa.ac.uk

1. Brief description and aims of module:

Clustered under the term ‘critical national infrastructure’ (CNI) are organisations, assets and supply chains that manage and deliver national provisions related to health, defence, communications, transport, power, water and emergency services, amongst others. Each of these sectors are exposed to threats from cyber criminals, terrorists and hostile states, with some critical services being more prone than others to espionage, data theft and disruption. CNI cyber resilience is therefore an important concern for the continued functioning of society. Indeed, securing key public and private sector services from cyber attack is an important component of the UK government’s National Security Strategy.

In this module you learn what CNI comprises and why it is vulnerable to cyber attack. Using real world examples, you examine in detail how critical systems are breached and what steps are necessary to withstand such breaches. This includes a critical understanding of approaches to CNI cyber resilience, with particular interest in procedures for threat resistance and strategies for response/recovery. Supporting topics cover the scope and type of threats against CNI, as well as the motivations and objectives of threat actors that target critical infrastructure. Although the UK is a focus in this module, the knowledge and perspectives you encounter can be applied with some adjustment in international contexts.

2. Outline syllabus:

• What CNI is why it is important

• Critical national infrastructure services in the UK

• The scope and Interconnectivity of CNI

• Threats and hostile actions against CNI

• The motivations and objectives of threat actors

• The implication of successful attacks

• Threat mitigation and discovery

• CNI cyber resilience

3. Teaching and learning activities:

Class Hours

Lecture and seminar activities expand on the concept of CNI, as well as facilitate discussion on relevant threats and cyber resilience strategies. Practical tasks include, amongst others, critically evaluating potential vulnerabilities to CNI services using data gathered from publicly accessible sources.

Independent Learning

Learning outside of class hours includes examination and analysis of case studies and theoretical scenarios. We recommend also that you keep up to date with publications such as the NCSC weekly threat report, as these occasionally provide insights on CNI security.

Assessment Item 1:

• Assessment Type: CW

• Description: Presentation. On an example of an attack against critical national infrastructure (10 minutes).

• % Weighting: 30%

Assessment Item 2:

• Assessment Type: CW

• Description: Vulnerability assessment (3,500 words).

• % Weighting: 70%