Road Network Operations
& Intelligent Transport Systems
A guide for practitioners!

You are here

Home // Network Operations // Network Security // Security Planning

Security Planning

The application of a security-minded approach requires road operators, working with partner organisations and security advisers, to understand potential threats and their impact, identify key vulnerabilities and analyse the nature of measures required to manage risks. (See Planning and Reporting) The goal is to enhance the safety, security and resilience of the road network and its associated infrastructure.

Three key elements in the risk management process are:

A road authority, with its partner organisations and advisers, should develop a risk management strategy that incorporates each of these three elements – such as the one in the example outlined below.

Road infrastructure security risk management strategy

A systematic approach is useful in developing a risk management strategy – for which a checklist of questions is helpful to guide practitioners through the evaluation process:

  • Step 1: identify the threats
  • Step 2: analyse vulnerabilities and impacts
  • Step 3: evaluate road network and operational resilience
  • Step 4: short-list countermeasures and risk mitigation strategies
  • Step 5: implement security measures and evaluate

Systematic approach

Step 1. Identify the threats

  1. What scenarios need to be considered?
  2. How likely is each kind of threat?
  3. In what ways is the network vulnerable?
  4. How and why?
  5. What is critical?
  6. How would network operations be compromised?
  7. What and where are the vulnerabilities?
  8. What is critical?

Step 2. Analyse vulnerabilities and impact

  1. Worst-case scenarios
  2. Difficult events and combinations of events
  3. Where is there resilience now?
  4. Recovery strategies that are available
  5. Rate the level of risk:
  6. Likelihood vs severity outcome

Step 3. Evaluate road network and operational resilience

  1. How can resilience be strengthened?
  2. What risk mitigation strategies are available?
  3. What specific security measures are available?
  4. Protection of critical sites and equipment
  5. Security through deterrence
  6. Security though design
  7. Security through detection
  8. How might network operations be adapted in response?
  9. Demonstrate benefits and cost-effectiveness of possible countermeasures

Step 4. Short-list countermeasures and risk mitigation strategies

  1. Incident response plans
  2. Partner agency working
  3. Public information strategy

Step 5. Implement security measures and evaluate

 

Risk Assessment

A risk assessment should consider the potential threats to regular road use and operations and consequential vulnerabilities. Some threats that compromise network resilience are quite common, others are less frequent or rare. (See Security Threats) An essential part of the assessment is to consider how likely it is that a particular threat might happen and how disruptive it would be. The assessment needs to consider what harm might be caused to:

  • the road infrastructure and its related systems
  • road users and others who make use of the infrastructure
  • information about the network and its users
  • the benefits for which the road network exists to deliver.

Vulnerabilities

A vulnerability in the context of road network security is defined as a weakness in the road infrastructure or operating systems that can be exploited by one or more threats.

Vulnerabilities associated with the construction, operation or maintenance of the road network relate to its scale, and how easy it is to:

  • obstruct or interfere with logistics, plant and machinery, supply routes, and staff – so as to disrupt the movement of people and goods and the supply chain
  • cause damage to cameras and sensors that provide information on the condition of the road asset
  • cause damage to new or existing roads and highway infrastructure.

Vulnerabilities that affect highway network operations concern cabling, equipment, sensors and associated processing systems that might be attacked:

  • remotely, through internet or wireless connectivity
  • through physical breaches of systems as a result of damage, either accidental or deliberate, interference or tampering
  • by personnel with administrator access.

Likelihood

The likelihood of threats may be relatively predictable for environmental, social, economic or political reasons. For example, a project’s level of profile, its controversy and its impact on local communities will influence how likely it is to provoke civil protests and strikes, malicious attacks, or theft of equipment such as construction plant.

The likelihood of a threat being realised will be greater if security is poor, for example when:

  • equipment or systems are poorly sited
  • the quality and effectiveness of physical protection measures are insufficient
  • the security-force response is too slow or ineffective
  • the value of vulnerable assets are high
  • the cyber-security systems and procedures are unsuitable or ineffective.

Risk Review

In order to maintain the security of the road network and supporting systems it is necessary to establish a process whereby:

  • risks which have changed for political, economic, social, technological, legal or environmental reasons, are identified and assessed
  • risk mitigation plans are reviewed and updated where necessary.

Further Information

Report of the PIARC Security Task Force (See Security of Road Infrastructure)

Reference sources

PIARC Security Task Force (2015)  Security of Road Infrastructure. Report 2015R01EN.  World Road Association, Paris. ISBN 978-2-84060-357-3.

Give us your feedback