The United Kingdom's new risk assessment methodology identifies high-risk positions at critical infrastructure assets to ensure employees filling such positions pose no security risks.
Government officials in the United Kingdom are warning companies that manage the country's critical infrastructure that they haven't done enough to protect against terrorists infiltrating their organization, reports the Financial Times.
Government advisers to the private sector say many companies in these key industries have moved further to address physical and other security requirements than they have to deal with risks of sabotage from insiders. Only the transport system has so far been targeted by terrorists, and officials say it is possible that it is the complexity of other infrastructure industries that has protected them from attack. This would increase the value to a terrorist group of having members inside key organisations, officials say.
The U.K. government has settled on a new risk assessment methodology that places more emphasis on critical infrastructure that are economically vital, such as computer networks, after the previous approach was deemed unsatisfactory last year. The Centre for the Protection of National Infrastructure (CPNI), run as part of MI-5, the domestic intelligence agency, has been tasked with advising companies on how to reduce their vulnerabilities.
Part of the approach is to identify those jobs at critical infrastructure assets that create the most vulnerability and to ensure persons placed in those positions pose no security risks.
The risk assessment methodology also involves a risk scale from one to five—with five posing the most dire risk—meaning the loss of the asset would grossly harm human life, the economy, and essential services. Any company that receives a mark of three or more is advised to make the necessary adjustments to reduce their vulnerability ranking.
Officials told FT that CPNI's work has concentrated on those assets where sabotage would hurt the country most and aims to avoid moving attention from one asset to another based on the latest intelligence.
Information about how the terrorist threat is evolving from intelligence agencies and elsewhere is also used, but the aim is to avoid a short-term focus on one sector and then another - say from water to energy - based on what the latest "chatter" from terrorist suspects is revealing.
The article notes that the risk assessment also covers crowded places, such as football stadiums.