Full Paper: Digital Resilience in Critical Infrastructures: A Systematic Literature Review

In times of disruptive events, effective response by organizations, critical systems, and society is paramount. The response process involves pre-event preparation, impact absorption, and system restoration, which together represent the concept of resilience. Critical infrastructures (CI) are essential to the functioning of society and require a high level of resilience to ensure that they can withstand and quickly recover from disruptive events. With the incorporation of Information Systems (IS) into CI, there is a need to study Digital Resilience to identify potential risks and develop strategies to mitigate them effectively. In this research, we conducted a Systematic Literature Review on Digital Resilience to understand its scope, and classified articles based on their scope, resilience dimensions, and phases they address, as well as interdependence between systems. We aim to contribute to the scientific understanding of Digital Resilience by analyzing existing gaps and proposing possible future research directions. This study provides an overview of the current state-of-the-art, the types of research conducted, and the resulting artifacts. Additionally, it introduces a new area of focus within the field of resilience: Digital Resilience

Reviewing qualitative research approaches in the context of critical infrastructure resilience

Modern societies are increasingly dependent on the proper functioning of critical infrastructures (CIs). CIs produce and distribute essential goods or services, as for power transmission systems, water treatment and distribution infrastructures, transportation systems, communication networks, nuclear power plants, and information technologies. Being resilient becomes a key property for CIs, which are constantly exposed to threats that can undermine safety, security, and business continuity. Nowadays, a variety of approaches exist in the context of CIs’ resilience research. This paper provides a state-of-the-art review on the approaches that have a complete qualitative dimension, or that can be used as entry points for semi-quantitative analyses. The study aims to uncover the usage of qualitative research methods through a systematic review based on PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses). The paper identifies four principal dimensions of resilience referred to CIs (i.e., techno-centric, organisational, community, and urban) and discusses the related qualitative methods. Besides many studies being focused on energy and transportation systems, the literature review allows to observe that interviews and questionnaires are most frequently used to gather qualitative data, besides a high percentage of mixed-method research. The article aims to provide a synthesis of literature on qualitative methods used for resilience research in the domain of CIs, detailing lessons learned from such approaches to shed lights on best practices and identify possible future research directions

Improving resilience in Critical Infrastructures through learning from past events

Modern societies are increasingly dependent on the proper functioning of Critical Infrastructures (CIs). CIs produce and distribute essential goods or services, as for power transmission systems, water treatment and distribution infrastructures, transportation systems, communication networks, nuclear power plants, and information technologies. Being resilient, where resilience denotes the capacity of a system to recover from challenges or disruptive events, becomes a key property for CIs, which are constantly exposed to threats that can undermine safety, security, and business continuity. Nowadays, a variety of approaches exists in the context of CIs’ resilience research. This dissertation starts with a systematic review based on PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) on the approaches that have a complete qualitative dimension, or that can be used as entry points for semi-quantitative analyses. The review identifies four principal dimensions of resilience referred to CIs (i.e., techno-centric, organizational, community, and urban) and discusses the related qualitative or semi-quantitative methods. The scope of the thesis emphasizes the organizational dimension, as a socio-technical construct. Accordingly, the following research question has been posed: how can learning improve resilience in an organization? Firstly, the benefits of learning in a particular CI, i.e. the supply chain in reverse logistics related to the small arms utilized by Italian Armed Forces, have been studied. Following the theory of Learning From Incidents, the theoretical model helped to elaborate a centralized information management system for the Supply Chain Management of small arms within a Business Intelligence (BI) framework, which can be the basis for an effective decision-making process, capable of increasing the systemic resilience of the supply chain itself. Secondly, the research question has been extended to another extremely topical context, i.e. the Emergency Management (EM), exploring the crisis induced learning where single-loop and double-loop learning cycles can be established regarding the behavioral perspective. Specifically, the former refers to the correction of practices within organizational plans without changing core beliefs and fundamental rules of the organization, while the latter aims at resolving incompatible organizational behavior by restructuring the norms themselves together with the associated practices or assumptions. Consequently, with the aim of ensuring high EM systems resilience, and effective single-loop and double-loop crisis induced learning at organizational level, the study examined learning opportunities that emerge through the exploration of adaptive practices necessary to face the complexity of a socio-technical work domain as the EM of Covid-19 outbreaks on Oil & Gas platforms. Both qualitative and quantitative approaches have been adopted to analyze the resilience of this specific socio-technical system. On this consciousness, with the intention to explore systems theoretic possibilities to model the EM system, the Functional Resonance Analysis Method (FRAM) has been proposed as a qualitative method for developing a systematic understanding of adaptive practices, modelling planning and resilient behaviors and ultimately supporting crisis induced learning. After the FRAM analysis, the same EM system has also been studied adopting a Bayesian Network (BN) to quantify resilience potentials of an EM procedure resulting from the adaptive practices and lessons learned by an EM organization. While the study of CIs is still an open and challenging topic, this dissertation provides methodologies and running examples on how systemic approaches may support data-driven learning to ultimately improve organizational resilience. These results, possibly extended with future research drivers, are expected to support decision-makers in their tactical and operational endeavors

Simulation based assessment of resilience of two large-scale socio-technical IT networks

Most sectors of modern society are currently undergoing rapid digitalization. With the progress of this development IT networks are becoming an ever more crucial asset whose failure are prone to cause economic losses and risks to health and safety of the population. Due to this development, it is increasingly important that IT networks are designed to be resilient, meaning that they either maintain or quickly recover their functionality when exposed to strains of various kinds. Simulation-based methods that consider supply network topology as well as system for repairing the supply network have previously been applied and found to be useful for assessment of resilience of electricity and water networks. A method of this kind is here applied for IT networks. The method, however, considers only hardware and operator fault modes, not software and dependency faults. The IT networks are studied as socio-technical systems, here broadly understood as systems whose functionality depend on technical as well as organizational sub-systems. The aim of the present paper is to investigate if the method is applicable for assessment of resilience of large-scale IT networks that are critical to society, meaning that (1) it is possible to apply for such systems based on available data, in this case gathered mainly through interviews with focus groups, (2) the results are relevant for users/maintainers/owners of these systems and (3) it captures all relevant factors. The method is tested in case studies on the IT network of a municipality and the SCADA system of a wastewater network. Follow-up interviews were conducted with system managers to assess the perceived relevance of the method and results. It is concluded that the method can be used to obtain the resilience metrics sought for and that the method enables system owners to see if and for what levels of strain they are presently reaching their desired targets concerning system resilience. Follow-up interviews also indicate that the method is perceived by the system managers as being able to support decision making concerning improvement in system resilience