Risk & Resilience Management of Complex Socio-Technical Systems
CRITICAL INFRASTRUCTURE
The r2macs research group develops basic and action research projects covering the full spectrum of needs of different stakeholders. The interplay between technical, organisational and social aspects is particularly investigated, making use of different modelling techniques and novel risk and resilience assessment methods.
Managing CI protection and resilience entails governance models, risk assessment tools, and the promotion of good practices through the involvement of all stakeholders.
Past Projects
Institutional and Private Research Partners
e-distribuzione
Terna
Technical University of Denmark
Kennemerland Safety Region
SEA
SNAM
JRC
Scottish Government
FerrovieNord
ATM
NIER
Lombardy Region
SERRAVALLE
Oresundsbron
Risk Governance Solutions
DEMA
Autostrade per l'Italia
UNARETI
TECNALIA
CPH Capital Region Pre-hospital Services
Selected Publications
-
Trucco, P. & Petrenj, B. (2023) “Characterisation of Resilience Metrics in full-scale applications to Interdependent Infrastructure Systems”, Reliability Engineering and System Safety (RESS), Vol. 235, 109200
-
Feletti, G., Piraina, M., Petrenj, B. & Trucco, P. (2022) “Collaborative capability building for critical infrastructure resilience: assessment and selection of good practices”, Environment Systems and Decisions. https://doi.org/10.1007/s10669-022-09853-3
-
Borghetti, F., Petrenj, B., Trucco, P., Calabrese, V., Ponti, M. and Marchionni, G. (2021) “Multi-level approach to assessing the resilience of road network infrastructure” Int. J. Critical Infrastructures, Vol.17, No. 2, pp. 97-132.
-
Petrenj, B., Piraina, M., Feletti, G., Trucco, P., Urbano V., & Gelmi, S. (2021) “Cross-border Information Sharing for Critical Infrastructure Resilience: Requirements and Platform Architecture”, Proceedings of the 18th International Conference on Information Systems for Crisis Response and Management – ISCRAM 2021, May 2021, Blacksburg (VA), USA.
-
Trucco P., Petrenj B., Birkie S. E., “Assessing supply chain resilience upon Critical Infrastructure disruptions: a multilevel simulation modelling approach”, in Khojasteh, Y. (ed.), Supply Chain Risk Management: Advanced Tools, Models and Developments, Springer Nature Singapore Pte Ltd. 2018.
-
Trucco P., Petrenj B., “Resilience of Critical Infrastructures: benefits and challenges from emerging practices and programmes at local level”, in: Linkov, I. & Palma-Oliveira, J. M. (eds.), Resilience and Risk, NATO Science for Peace and Security Series C: Environmental Security, Springer Science+Business Media B.V., Dordrecht, The Netherlands, 2017.
-
Trucco P., Petrenj B., Bouchon S., Di Mauro C., “Ontology-based Approach to Disruption Scenario Generation for Critical Infrastructure Systems”. Int. J. Critical Infrastructures, Vol. 12, No. 3, 2016, pp. 248-272.
-
Trucco P., De Ambroggi M., Leva M.C., "Topological risk mapping of runway overruns: a probabilistic approach", Reliability Engineering and System Safety, Vol. 142, 2015, pp. 433-443.
-
Petrenj B., Trucco P., "Simulation-Based Characterisation of Critical Infrastructure System Resilience", Int. J. of Critical Infrastructures. Vol. 10, No. 3/4, 2014, 347-374.
-
Petrenj B., Lettieri E., Trucco P., "Information sharing and collaboration for Critical Infrastructure resilience - a comprehensive review on barriers and emerging capabilities", Int. J. of Critical Infrastructures. Vol. 9, No. 4, 2013, pp. 304-329.
-
Petrenj B., Lettieri E., Trucco P., "Towards enhanced collaboration and information sharing for critical infrastructure resilience: current barriers and emerging capabilities", Int. J. of Critical Infrastructures, Vol. 8, No.2/3, 2012, pp. 107-120.
-
Trucco P., Cagno E., De Ambroggi M., "Dynamic Functional Modelling of Vulnerability and Interoperability of Critical Infrastructures", Reliability Engineering and System Safety, Special issue on ESREL 2010, Vol. 105, 2012, pp. 51–63.
-
Ferrari, M., Schupp, B.A., Ward, D., Nordvik, J.P., Trucco, P., “Assessing Supply Chain dependency on Critical Infrastructures using Fuzzy Cognitive Maps”, International Journal of Risk Assessment and Management (Special Issue on: "Risk Analysis of Critical Infrastructures"), Vol. 15, Nos. 2/3, 2011, pp. 149-170.
-
Cagno E., De Ambroggi, Grande O., Trucco P., “Risk Analysis of Underground Infrastructures in Urban Areas”, Reliability Engineering & System Safety, Vol. 96 (1), 2011, pp.139-148.
Digital4Security (2023-2027)
Europe's new cybersecurity Master’s programme
Digital4Security is a €20 million EU-funded project awarded under the DIGITAL Europe programme. It is dedicated to equipping European small and medium-sized enterprises (SMEs) with comprehensive knowledge in cybersecurity management, regulatory compliance, and technical skills.
With a Consortium comprising 37 partners from 14 EU countries, this significant international commitment and collaboration highlights the need for a greater collective response to the biggest challenge facing the digital space. Digital4Security aims to protect economic prosperity and support long-term competitiveness and growth all over Europe by continuously adapting and evolving to counter current and emerging cybersecurity risks.
The programme will offer a unique blend of academic accreditation and industry certification, ensuring graduates are equipped with the most relevant and up-to-date knowledge and skills.Digital4Security will re-skill and up-skill graduates, professionals, managers, and business leaders, empowering them to enhance their cybersecurity infrastructure and incident prevention and management procedures. Graduates will fill high-demand roles outlined in ENISA's European Cybersecurity Skills Framework (ECSF), contributing significantly to the security and success of European businesses.
Security of Cross-border Critical Infrastructures
Sicurezza Infrastrutture Critiche Transfrontaliere (SICt)
2019-2021
The project aims to strengthen the joint risk management capacities linked to events that may partially or totally disrupt the continuity of critical transport infrastructures service with cross-border relevance. It will be achieved by advancing the sharing of knowledge and information on cross-border Critical Infrastructures through the implementation of a joint monitoring systems and communication procedures between Lombardy (Italy) and Ticino (Switzerland)
Different tools and strategies used by the two states make communication and coordination of preventive measures less effective. The action strategy of the project is to improve the effectiveness of a shared prevention system built to reduce the impact of potential disruptive events involving the cross-border area. The acquisition and exchange of selected information between the two States will allow for decision-making processes tailored to achieve greater effectiveness of the coordinated response to events. Furthermore, the development of a collaborative approach, by means of sharing knowledge and integrating tools, will allow for optimized resource management within the cross-border territory and improvement of practices in use, which benefits both countries.
Visit the SICt project website
GRRASP - DMCI – Dynamic and Functional Modelling of Vulnerability and Interdependencies
Since the adequate functioning of critical infrastructures is crucially sustaining societal and economic development, the understanding and assessment of their vulnerability and interdependency become more and more important for improving resilience at system level. The dynamic functional modelling of vulnerability and interoperability of Critical Infrastructures (DMCI) assesses the propagation of impacts in terms of disservice due to a wide set of threats at regional level. The disservice can be propagated within the same infrastructure or to other CI by means of the interdependence model, which is able to represent physical, cybernetic, geographic as well as logical interdependencies and also the shift of the demand between two infrastructures that can provide the same or fully/partially replaceable service. The model is dynamic, since both the impact of the specific threat on a generic infrastructure node and the inoperability functions are time-dependent.
The simulation tool has been implemented with the Matlab platform Simulink in order to overcome some computational limitations, that affect the first DMCI version implemented in Matlab, in quantifying the propagation of inoperability and logical interdependencies related to demand shift, and to obtain a modular and user friendly solution, even for users who are not expert at simulation.
The DMCI model has been tested with a pilot application that comprised more than 200 vulnerable nodes and covered both power transmission grid and transportation systems of the province of Milan (Italy). The most vital and vulnerable nodes have been identified under different blackout scenarios, for which specific data on vulnerable nodes has been collected directly from the operators.
Visit the GRRASP project website
The DMCI has been introduced in the Geospatial Risk and Resilience Assessment Platform (GRRASP) as a module used for the analysis of of complex networked systems taking into consideration cross-sectoral and cross-border interdependencies, taking into account functional, cyber, geographical and logical interdependencies.
GRRASP, developed by EC JRC Ispra, is a World Wide Web oriented architecture bringing together geospatial technologies and computational tools for the analysis and simulation of CI disruptions and cascading effects at regional/state level, as well as at EU level. It allows information sharing and constitutes a basis for future developments in the direction of collaborative analysis and federated simulation. Its architecture allows end users to use their own data sets for performing analyses as well as develop modules that can be plugged in the GRRASP environment.
Pilot Study on Business Continuity Plans (BCPs) Project for Supporting Critical Infrastructure Resilience
and Disaster-Risk Awareness
The project intends to ensure Business Continuity (BC) of Turkey’s Organised Industrial Zones (OIZs) in face of disasters and emergencies, in order to establish more disaster-resilient industrial facilities and lay the foundation for a stronger economy. It is done by better preparing for hazards to which OIZ are exposed (including natural and technological risks) through development of Business Continuity Plans. Once completed, the project will serve as a validated approach for a countrywide BCP implementation.
The main activities of the project include:
-
Development of a Manual on Preparation and Implementation of Business Continuity Plans for OIZs
-
Pilot application of the Manual in two selected OIZ which will be used as role-models
-
Preparation and rollout of the Training of Trainers
-
Recommendations for the nationwide development of Business Continuity Plans for OIZs
The project was carried out for the Republic of Turkey Ministry of Interior, Disaster and Emergency Management Presidency (AFAD) in partnership with NIER Ingegneria (Italy). The project was Supported by the World Bank and funded by Japanese Government through the Global Facility for Disaster Reduction and Recovery (GFDRR).
READ - Resilience Capacities Assessment for Critical Infrastructures Disruption (CIPS 2013)
READ is a research project, funded under the Prevention, Preparedness and Consequence Management of Terrorism and other Security-Related Risks Programme (CIPS) Action Programme (European Commission – Directorate-General Home Affairs). The project aims at improving resilience capacities required to manage Critical Infrastructure (CI) disruptions and enhancing current emergency management practices to better address the challenges raised by cross border CI disruptions.
The overall objective of READ is to support the improvement of European emergency management practices by integrating issues related to trans-boundary critical infrastructures disruptions and related cascading effects into the current emergency management set-up. This objective will be achieved by providing adequate knowledge, tools and related strategies to prepare for, cope with and recover from cross-border crisis situations resulting from the interruption of essential services supply.
A key part of the READ project is development of a conceptual and methodological framework to maintain resilience capabilities for coping with trans-boundary CI disruptions, allowing also emergency services to explicitly address resilience improvement measures while planning to cope with CI disruptions. The framework shall have a sound theoretical foundation as well as practical relevance for, in particular, developing assessment and training tools for CI stakeholders.
Following this limited scope of the project, the framework is by choice focused primarily on the response and early recovery phases of CI interruptions and to a lesser extent on the wider tasks of preparation (including contingency plans) and long-term recovery and possible adaptation to novel and possibly very different circumstances of service.
Visit the project website: www.read-project.eu
PReSIC – The Lombardy Region (Italy) Programme for Critical Infrastructure Protection and Resilience
In Italy, private and public operators of critical services are already committed with investments and procedures to guarantee safety and service recovery. Under this point of view, when homeland security and defense are concerned, actions and responsibilities are established at a national level.
Nevertheless, the Lombardy Region Administration is aware that thanks to better information sharing processes among actors – concerning threats, vulnerabilities and crisis management – it would be possible to enhance the efficacy of invested resources and the safety of citizens as well. Thus, the objective of the Lombardy Region Administration it is not to add a new level of control or decision-making in the context of national homeland security system. On the contrary, Lombardy Region is acting to promote extended and improved collaborative processes among actors (public and private), able to support operators of CIs in preventing and manage service disruptions deriving from events that by nature develop beyond the boundaries of a single infrastructure or require the joint intervention of more than one organization.
Starting from this subsidiary approach the Lombardy Region Administration started PReSIC, a preliminary and explorative study dealing with the definition and evaluation of an integrated system to set up inter organizational collaborations within prevention, monitoring and emergency management processes for regional CIs. In line with the contents of the Directive 114/EC/2008, the action has been focused on Energy and Transport infrastructures. Nevertheless, the boundaries of the system might evolve in the near future to include new actors and offer new functions according to an evolving scenario of increasing collaboration, subject to the demonstration of effectiveness and real benefits for all the actors involved.
To actually meet the needs of operators and other stakeholders, the objectives of PReSIC are focused on:
-
the identification of a set of well defined and agreed decision making processes and the related governance model;
-
the definition of procedures and protocols for information sharing and operational coordination;
-
the definition of the main requirements for a technological platform to support collaborative operations (a new infrastructure) with high information security standards.
MIRACLE – Multi-level Alignment of Regional Approaches to Critical Infrastructure Resilience by Learning from Experience (CIPS 2012)
Miracle is an ambitious project, that aims at supporting regional Critical Infrastructure Protection and Resilience (CIP-R) strategies, in order to improve exiting capacities of the EU Member States to prevent, prepare and protect people against security related risks, including terrorist attacks.
Regional is understood here as the administrative scale but also as the coherent territory corresponding to a CI system extension. The main assumption behind the Miracle project is that, if regional CIP-R strategies are supported, they will allow addressing Critical Infrastructure Protection issues that national and EU policies would have difficulties to address, while they will contribute to enhance the overall resilience and security levels of the EU Territory. This assumption builds on the experience of the Miracle consortium, balanced between 2 scientific partners (Fondazione Politecnico di Milano and RGS Srl) and 3 institutional partners (the Scottish Government – UK, The Public Safety and Health Region Kennemerland – NL and The Lombardy Region).
Specific objectives of Miracle are:
-
To increase awareness and knowledge on regional CIP-R strategies with focus on issues, that are also of interest at national or EU levels
-
To stimulate, promote and support the exchange of regional CIP-R experiences, in order to establish best practices and related guidelines, with the view to enhance and develop existing capacities at regional level
-
To develop and promote a multilevel framework to align regional strategies with national or EU policies, in order to increase the efficiency and coherency of existing and future CI strategies.
To answer these objectives, Miracle imoplemented the activities aiming learning from existing experiences and organized as follows: sharing experience and best practices for the implementation of regional CIP-R strategies, Learning from regional CIP-R strategies to strengthen collaboration schemes between public and private stakeholders, building a multilevel framework to align regional CIP-R strategies with national and EU policies and community buildings and dissemination activities.
Visit the project website: www.miracle-project.eu
MATRICS (Multi Actor Threat Recognition, Information and Collaboration System)
MATRICS è una piattaforma collaborativa web-based, con elevati standard di sicurezza, interoperabilità e scalabilità. I benefici di MATRICS sono:
-
Unità di crisi virtuale: garantisce un flusso informativo adeguato tra le autorità responsabili della gestione dell’evento
-
Situational Awareness e Common Operational Picture. Miglior previsione dell’evoluzione dello scenario
-
Supporto alla gestione collaborativa dell’emergenza. Maggior qualità delle informazioni scambiate
-
Decision Support. MATRICS supporta una situational awareness condivisa e l’efficacia delle decisioni di operatori di infrastrutture critiche e first responders grazie a funzionalità di knowledge management e l’integrazione di un simulatore dinamico per analisi di vulnerabilità e interdipendenza dei nodi infrastrutturali.
-
Esecuzione Piani Collaborativi. MATRICS abilita l’esecuzione di piani collaborativi attraverso l’implementazione del workflow procedurale del piano stesso, che guida lo smistamento dinamico delle informazioni condivise (messaggi) e la generazione di alert / reminder indirizzate su singoli operatori.
MATRICS è anche un approccio sistematico allo sviluppo di piani territoriali per la Protezione e Resilienza delle Infrastrutture Critiche, per:
-
Information sharing. MATRICS abilita la condivisione di informazioni tra operatori di infrastrutture critiche e first responders limitando lo sforzo richiesto agli operatori di sala operativa. Utilizzando algoritmi di business intelligence, MATRICS genera in modo semiautomatico le informazioni che l'operatore intende scambiare con altri attori del sistema.
Threat-Vulnerability Path Identification for Critical Infrastructures
The THREVI2 research project addresses one of the major challenges for Authorities or Critical Infrastructure (CI) Operators – the systematic and complete identification of meaningful accident scenarios for CIs. The project covers Energy, Transport, Water and Telecommunications sectors.
THREVI2 is establishing a comprehensive and dynamic all-hazards catalogue for CIs. The database characterizes all hazards that may threaten or impact critical infrastructure systems, and evaluates the vulnerability and resilience capacities of the system components.
A software tool will be provided to support the analyst in generating different sets of possible disruption scenarios, thus contributing to the implementation of the Directive 2008/114/EC, both at national level and at infrastructure level. This is being achieved by creating specific ontologies for the specification of CIs systems topologies and their interdependencies, and subsequently by merging them with potential threats through an ontology of relevant vulnerability models.
Specific objectives are:
-
to develop and elaborate three coordinated ontologies (Hazards & Threats, CIs topologies, CIs Interdependencies) – to capture and logically organize the available information.
-
to merge the taxonomies by identifying existing vulnerability models to assess the types of impact and the extent of damage for the rest of the critical infrastructure and interdependent systems
-
to develop a dedicated software tool for scenarios generation to support different end-users (e.g. authorities and operators).
By integrating CI, Hazards & Threats and vulnerabilities, the PATHFINDER tool enables an improved scenario generation process to support an effective risk assessment and prioritization of activities and resources in order to reduce CI risks. Indirect benefits are expected in term of quality of shared information among actors thank to a standardized nomenclature and modelling of physical and functional CI topologies.
Topological Risk Mapping of Runway Excursions
The research project developed a topological risk mapping for aircraft overruns. The proposed procedure is based on the study published in 2008 by Hall, Wong, & Ayres. In that study the authors performed an analysis of aircraft overruns and undershoots for runway safety areas proposing the ACRP hazard probability model. In the present study the model was integrated into a two-step Monte Carlo simulation procedure to assess the risk of overrun accidents and to provide a topological risk map for a specific airport area.
The model was modified to utilize traffic-related and weather-related factors described by statistical distributions of historical data of the airport under analysis. The probability distribution of overrun events was then combined with the Longitudinal and Lateral Location models to obtain a two-dimensional grid assessing the probability of each area to be the end point of a runway overrun. The expected kinetic energy of the aircraft in a given point of the grid is used as severity index.
The procedure is suitable for generalisation and it allows a more detailed planning of Airport Safety Areas (ASA), improving the correct implementation of ICAO recommendations. Results are also useful for land planning and structural analyses in airport areas.
