# Analyzing Cascading Effects in Interdependent Critical Infrastructures

Ahmed Abdelgawad, Mohamed Saleh, Jose Gonzalez

► To cite this version:

Ahmed Abdelgawad, Mohamed Saleh, Jose Gonzalez. Analyzing Cascading Effects in Interdependent Critical Infrastructures. 3rd International Conference on Information Technology in Disaster Risk Reduction (ITDRR), Sep 2018, Poznan, Poland. pp.50-65, 10.1007/978-3-030-32169-7_5. hal-02799278

HAL Id: hal-02799278

https://inria.hal.science/hal-02799278

Submitted on 8 Jun 2020

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Analyzing Cascading Effects in
Interdependent Critical Infrastructures

Ahmed Abdelgawad, Mohamed Saleh and Jose Gonzalez

Centre for Integrated Emergency Management, University of Agder, Grimstad, Norway
ahmedg@uia.no

**Abstract.** Critical Infrastructures (CIs) are resources that are essential for the performance of society, including its economy and its security. Large-scale disasters, whether natural or man-made, can have devastating primary (direct) effects on some CI and significant indirect effects (cascading effects) on other CIs, because CIs are interconnected and depend on each other's services. Recent work by Laugé et al. expressed the dependency values among CIs as dependency matrices for various durations of the primary CI failure. For better preparedness and mitigation of CI failures knowledge of the weak points in CI interdependencies is crucial. To this effect, we have developed a MATLAB code that identifies the forward paths and loops between pairs of CIs based on a simplified version of Laugé's matrices. The code calculates the parallel forward paths and loops dependencies to identify and quantify the amplification of cascading effects of any disruption that might hit one of the CIs included in the research. A main consequence, which has implications for expert assessment of dependencies between CIs, is that the cascading effects are not limited to the direct values expressed in the dependency matrices.

**Keywords:** Interdependent CIs, Cascading effects, Parallel forward paths effect, Parallel loops effect, Path dependency, Loop dependency.

## 1 Introduction

Critical Infrastructures (CIs) are resources that are essential for the performance of society, including its economy and its security, here understood as safety of citizens and security of society's assets. Different countries might have slightly different definitions of CIs. However, there is a consensus that CIs include government, society's ICT (information and communication technology); financial sector; energy supply; water supply; transportation systems; health sector; and security services (police, military).

CIs are exposed to natural hazards and man-made hazards (human errors, human malignity). Critical Infrastructure Protection (CIP) embodies the management of risk assessment, risk mitigation, preparedness, response and recovery against serious incidents threatening the critical infrastructure of a region or nation.

CIs are highly interconnected and, hence, interdependent: a disruption diminishing the capacity of a CI affects other CIs through cascading effects (propagation of the disruption to other CIs that need services from the disrupted CI).
Society depends increasingly on the well-functioning of its information and communication infrastructure. For example, a vulnerability analysis conducted by the Norwegian Directorate for Civil Protection (DSB) [1] concluded that a cyber-attack causing complete disruption of the ICT CI's transport network in Norway would have:

* high impact on security CI;

* high impact on financial CI;

* high impact on railways and airline traffic, and moderate impact on other transport CIs;

* low impact on water CI;

* low impact on energy CI; but then secondary cascading effects from minor disruptions on energy infrastructure would increase significantly the disruption of ICT CI;

* moderate impact on health CI.

The aggregate impact of such a cyber-attack on ICT CI in Norway would be considerable in terms of financial costs (around one billion euro, or 1.2 billion US dollars, which is about 3.5 percent of Norway's gross national product). The estimate is probably conservative, since the analysis in the report concludes that the ICT CI will not recover completely for about one month. The event may cause social and political instability in addition, with unpredictable long-term consequences.

The dynamics of interconnected CIs are extremely complex. There are numerous approaches for modeling cascading effects; a recent extensive review [2] enumerates six modeling categories, viz. empirical approaches, agent-based approaches, system dynamics-based approaches, economic theory based approaches, network-based approaches, and others. The author concludes that none of the existing approaches is completely satisfactory: key challenges are difficulties of data access and collection, or lack of precise data; lack of integration of different modeling approaches, yielding conflicting outcomes; validation problems owing to insufficient or unreliable historical data, and lack of standards for relevant metrics. Furthermore, most models' predictions rarely can be validated by comparison with real data; few models of interconnected CIs correspond fully to observed scenarios.

A major additional challenge: the complexity of the system of systems of CIs makes the models hard to understand, and difficult to verify as to how well any model is a reliable “map” of the CIs that it purports to describe, since they contain a huge number of questionable relations between model variables.

Rather than focusing on detailed models with a high number of variables and relations between them, we argue that highly aggregated models, with simple model structure, have several advantages. They are simple to understand, they concentrate on a few essential factors and they request only few parameters with down-to-earth relations among them. The estimate of such relations admittedly relies on expert opinion. But the attractiveness of a simple and easy to understand model, and the fact that only few parameters need to be estimated, facilitate a focused discussion and a potentially more reliable estimate in a Delphi [3] or a wisdom of the crowd approach [4] in conjunction with model iterations.

Our approach is intended to complement two recent papers describing system dynamics models of interconnected CIs. The first paper was authored by Canzani [5] and
it was extended by Abdelgawad et al. [6]. The system dynamics model considers a
system of systems consisting of any number of interdependent CIs for the objective to
analyze the performance level of the CIs when disruptions caused by natural or man-
made disasters happen. The system dynamics model uses estimates for the effect of a
disruption of certain CIj on another CIi that were provided in the Ph.D. thesis of Ana
Laugé [7], see §3. Laugé conducted a survey with CI managers to obtain estimates on
a Likert scale for such cascading impacts caused by a disruption of less than two hours,
less than six hours, less than 12 hours, less than 24 hours, more than 24 hours and more
than one week; she computed averages of the provided estimates resulting in tables for
each of the cases [7, 8].

The survey was formed as online questionnaires with the aim of analyzing the CI interdependencies of 11 CIs mentioned in a green paper by European Commission [9], namely: Energy, ICT, Water, Food, Health, Financial, Public and legal order and safety, Civil administration, Transport, Chemical and nuclear industry, and Space and research. The survey was developed and executed in five concise steps, including a trial run, which ensured they were well written and understandable by the participating experts.

The survey was divided into three sections, where the first section relates to the ex-
perts taking the survey and they were asked to select which of the 11 CIs they were the
stewards of. The results from this part showed that, of the 52 replies out of 154 invita-
tions sent, there was an average of at least four experts for each CI that had replied. The
organizations the participating experts belonged to were predominantly Spanish and
this infers that the survey can be interpreted as representative of Spanish CI, as there
was only one category in which there was less than two Spanish experts that responded.
Because there were no more than 33.8% that responded to the survey, it creates uncer-
tainty as to the robustness of data, however. It is also not mentioned whether the re-
sponse rate refers to surveys being fully completed or partially. The second section
concerns the measurement of interdependencies and the time required to recover the
primarily disrupted CI after the interdependent CIs have recovered from the cascading
effects. These two questions were answered partially with open text which resulted in
a wide variety of answers. The answers led to the conclusion that there is no standard
recovery time, due to different equipment and procedures. Subsequently, from this the
average time to restore any of the 11 CI operations after a disruption remained unde-
fined.

The third section asked the experts to assess the effect a complete breakdown of a
networked CI had on their CI. The aim with this section was to know the magnitude of
the effects, ranging from “0 – no effect”, to “5 – very high effect”. This was concerning
a direct dependency from one CI to another and the corresponding table values were
calculated by using the average of the responses. Such a table is consistent with the
definition of a cross-impact matrix, whose cells contain numbers on an ordinal scale
evaluated with regard to some agreed-upon maximum value and expressing impacts of
one event (CI failure in this case) on another. The cross-impact matrix is “(usually)
filled by experts relevant to the analysis, either working individually or as a group”
[10]. In other words, “[a] cross-impact matrix is a square matrix (a matrix with equal
number of rows and columns) that represents a set of statements describing future states and events and their impacts on each other” [10].

Laugé et al. [8] expressed the dependency values among CIs as dependency matrices for different durations of the primary CI failure. However, the cascading effects are not limited to the direct values expressed in the dependency matrices, even after correctly considering the primary failure duration. Simply, in addition to the direct effect of the failure in one CI (the origin) on another CI (the destination), the original failure affects other CIs as well, which in turn affects others and so on, until –by the end– affects the destination CI again [10]. Furthermore, CIs connected with each other in a path that starts and ends with the same CI form a loop or cycle [11]; this loop circulates a disruption effect between the CIs that are members of this loop. This demonstrates that the overall cascading effects will be higher than just the indicated dependency mentioned in Laugé’s research. This arising issue has relevance for the reliability of expert assessment of the effect of a disruption of certain CI<sub>j</sub> on another CI<sub>i</sub>. All experts involved in the assessment must be conscious of the amplification of cascading effects along loops.

To illustrate the amplification caused by cascading loop effects we consider a simplified version of Laugé’s dependency values among CIs, as did Canzani in her research [5]. Instead of using the above mentioned 11 CIs, Canzani merely focused on Energy, ICT, Water, Financial, and Transport CIs. To conduct our analysis, developing 5×5 matrix. We followed Canzani in using her simplified version of Laugé’s dependency values among CIs. We have developed a MATLAB code that identifies parallel forward paths and loops dependencies in the simplified version of Laugé’s matrices, to identify and quantify the greater cascading effect of any disruption that might hit one of the CIs included in the research.

In the next section, we will present our methodology. This will be followed by the results section. The paper concludes with thoughts on the implications of our approach.

## 2 Methodology

A graph is a network of vertices having edges in-between connecting them [12]. A ‘digraph’ or directed graph is a special case of a graph in which edges have directions [12]. A digraph could be expressed in a matrix form known as adjacency matrix. The adjacency matrix is a square matrix having a size equal to the number of vertices of a digraph. According to Diestel [11], an element of an adjacency matrix is defined as:

$$a_{ij} = \begin{cases} 1, & \text{if there is an edge from vertex j to i} \\ 0, & \text{otherwise} \end{cases}$$

According to Laugé [7] and Laugé et al. [8], the dependency between two CIs represents the effect value which a failure in any CI<sub>j</sub> will have on CI<sub>i</sub>. Thus, the dependency between any two CIs: CI<sub>i</sub> and CI<sub>j</sub> are analogs to the gain of the edge between these two CIs. Hence, in graph theory terms, each of Laugé’s tables or the 5×5 simplified version represents a transition matrix of a digraph. **Error! Reference source not found.** shows
a simplified 5×5 CIs dependency table (CI failure for less than 2 hours) and its corresponding adjacency matrix.

<figure><img src="image_2.png" /><figcaption>Fig. 1. To the Left: Normalized 5×5 Simplified CIs Dependency Table (Based on Laugé's CI Failure for Less Than 2 Hours Table-Simplified Version) - To the Right: The Corresponding Adjacency Matrix</figcaption></figure>

Based on the analogy of the dependency with the gain, the dependency of a path of CIs is like path gain. Accordingly path gain equation [13, 14]:

$$e_{\sigma k} = \prod_{i,j \in \sigma k} e_{i,j} \qquad (1)$$

where:

<table><thead><tr><th>Notation</th><th>Meaning</th></tr></thead><tbody><tr><td>$e_{\sigma k}$</td><td>Dependency of the k<sup>th</sup> path</td></tr><tr><td>$e_{i,j}$</td><td>Effect/Impact of CI<sub>j</sub> failure on CI<sub>i</sub>, where the j<sup>th</sup> and i<sup>th</sup> CIs belong to path $\sigma k$</td></tr></tbody></table>

A cross-impact matrix is a form of the adjacency matrix whose elements represent impacts/effects from one vertex/event to another [10, 15]. Panula-Ontto [10] defined a similar total effect for a path and called it “impact chain”. However, Panula-Ontto did not clarify a theoretical basis for this equation. To illustrate the dependency of a path, **Error! Reference source not found.** shows the possible paths from the Energy CI (or the event of Energy CI failure for less than 2 hours) to the Water CI (or the event of Water CI failure as a result), in addition to the direct forward path between them.

Based on the figure and the corresponding matrix:

* The dependency of the direct forward path 1 = $e_{\sigma1}$ (colored blue in the figure) is $e_{\sigma1} = e_{1,3} = 0.27$,

* the dependency of the indirect forward path 2 = $e_{\sigma2}$ (colored red in the figure) is $e_{\sigma2} = e_{1,2} \times e_{2,3} = 0.17 \times 0.20 = 0.034$, and
* the dependency of the indirect forward path 3 = *e*<sub>σ3</sub> (colored green in the figure) is *e*<sub>σ3</sub> = *e*<sub>1,4</sub> × *e*<sub>4,2</sub> × *e*<sub>2,3</sub> = 0.53 × 0.14 × 0.20 = 0.015.

<figure><img src="image_3.png" /><figcaption>**Fig. 2.** CIs Forward Path Dependency based on Forward Paths between Energy and Water CIs
(Based on Laugé's CI Failure for Less Than 2 Hours Table-Simplified Version)</figcaption></figure>

The direct forward path in addition to the two indirect forward paths are not all the forward paths from the Energy CI to the Water CI, **Error! Reference source not found.** shows all possible forward paths between these two CIs based on the table of CI failure for less than 2 hours:

* Forward path 1: Energy → Water

* Forward path 2: Energy → ICT → Water

* Forward path 3: Energy → Financial → ICT → Water

* Forward path 4: Energy → Transport → ICT → Water

* Forward path 5: Energy → Financial → Transport → ICT → Water

* Forward path 6: Energy → Transport → Financial → ICT → Water

<figure><img src="image_4.png" /><figcaption>**Fig. 3.** All Possible Forward Paths between Energy CI and Water CI based on CIs Dependency Table (Based on Laugé's CI Failure for Less Than 2 Hours Table-Simplified Version)</figcaption></figure>
Equation **Error! Reference source not found.** can be used to calculate all gains of forward paths from 1 to 6 namely $e_{\sigma1}$, $e_{\sigma2}$, $e_{\sigma3}$, $e_{\sigma4}$, $e_{\sigma5}$, and $e_{\sigma6}$. These forward paths are in parallel. Once again, based on the analogy of the dependency with the gain, the dependency of parallel paths of CIs is like the gain of parallel paths. Accordingly, the equation of the overall dependency of all parallel paths between two CIs [13, 14]:

$$e_{\sigma(i,j)} = \sum_{\sigma k \in \sigma(i,j)} e_{\sigma k} \qquad (2)$$

where:

<table><thead><tr><th>Notation</th><th>Meaning</th></tr></thead><tbody><tr><td>$e_{\sigma(i,j)}$</td><td>Dependency of all parallel paths from the i<sup>th</sup> CI to the j<sup>th</sup> CI</td></tr><tr><td>$e_{\sigma k}$</td><td>Dependency of k<sup>th</sup> path which is one of the paths from the i<sup>th</sup> CI to the j<sup>th</sup> CI</td></tr></tbody></table>

Accordingly, the overall dependency including direct and indirect forward paths is the sum of their dependencies. Panula-Ontto [10] defined a similar total impact chain for a group parallel paths, nonetheless again did not clarify a theoretical basis for this equation either:

$$e_{\sigma(1,3)} = e_{\sigma1} + e_{\sigma2} + e_{\sigma3} + e_{\sigma4} + e_{\sigma5} + e_{\sigma6} \\ e_{\sigma(1,3)} = 0.27 + 0.034 + 0.015 + 0.019 + 0.0026 + 0.0027 \\ e_{\sigma(1,3)} \approx 0.34$$

Panula-Ontto's work [10] stopped at the level of calculating total direct and indirect forward paths impact chain or path dependency as we call it in our case. Nonetheless, the forward paths from CI<sub>j</sub> to CI<sub>i</sub> are the feedback paths from CI<sub>j</sub> to CI<sub>i</sub>. One or more of these feedback paths will constitute loops or cycles with one or more of the forward paths. Therefore, we would like to go one step further by considering all loops passing by two CIs under investigation instead of just the forward paths. Based on the analogy of the dependency with the gain, the dependency of a path of CIs, or loop dependency (as mentioned above a loop is a path that starts and ends with the same CI), is like path gain. Accordingly loop gain equation could be used to calculate loop dependency as in the following equation [13, 14]:

$$e_{\kappa l} = \prod_{i,j \in \kappa l} e_{ij} \qquad (3)$$

where:

<table><thead><tr><th>Notation</th><th>Meaning</th></tr></thead><tbody><tr><td>$e_{\kappa l}$</td><td>Loop dependency of the l<sup>th</sup> loop</td></tr><tr><td>$e_{ij}$</td><td>Effect of CI<sub>j</sub> failure on CI<sub>i</sub>, where the j<sup>th</sup> and i<sup>th</sup> CIs belong to the l<sup>th</sup> loop</td></tr></tbody></table>

**Error! Reference source not found.** shows a couple of loops that are common when considering the Effect from the Financial CI to the Water CI.

Using equation **Error! Reference source not found.** and based on the example shown in **Error! Reference source not found.** and the corresponding matrix:
* The dependency of loop 1 = e<sub>κ1</sub> (colored blue in the figure) is e<sub>κ1</sub> = e<sub>32</sub> × e<sub>24</sub> × e<sub>41</sub> × e<sub>13</sub> = 0.11 × 0.47 × 0.03 × 0.27 ≈ 0.0004, and

* the dependency of the loop 2 = e<sub>κ2</sub> (colored red in the figure) is e<sub>κ2</sub> = e<sub>35</sub> × e<sub>54</sub> × e<sub>41</sub> × e<sub>13</sub> = 0.04 × 0.02 × 0.03 × 0.27 ≈ 0.00001.

<figure><img src="image_5.png" /><figcaption>**Fig. 4.** Example of Loops Passing Through Both the Water and Financial CIs (Based on Laugé's CI Failure for Less Than 2 Hours Table-Simplified Version)</figcaption></figure>

But again these two loops are not all the loops passing through both the Water and Financial CIs. There is a set of 12 loops pass through both the Water and Financial CIs (see Figure 8 for a graphical representation of these loops):

* Loop 1: Energy → Water → ICT → Financial → Energy

* Loop 2: Energy → Water → Transport → Financial → Energy

* Loop 3: Energy → Financial → ICT → Water → Energy

* Loop 4: ICT → Water → Transport → Financial → Energy

* Loop 5: Energy → ICT → Water → Transport → Financial → Energy

* Loop 6: Energy → Water → ICT → Financial → Transport → Energy

* Loop 7: Energy → Water → ICT → Transport → Financial → Energy

* Loop 8: Energy → Water → Transport → ICT → Financial → Energy

* Loop 9: Energy → Water → Transport → Financial → ICT → Energy

* Loop 10: Energy → Financial → ICT → Water → Transport → Energy

* Loop 11: Energy → Financial → Transport → ICT → Water → Energy

* Loop 12: Energy → Transport → Financial → ICT → Water → Energy

These loops are in parallel, accordingly, the overall dependency is the sum of their dependencies as per equation (2):

$$e_{\kappa(i,j)} = \sum_{\kappa k \in \kappa(i,j)} e_{\kappa k} \qquad (4)$$

where:

<table><thead><tr><th>Notation</th><th>Meaning</th></tr></thead><tbody><tr><td>$e_{\kappa(i,j)}$</td><td>Dependency of all parallel loops passing through the i<sup>th</sup> CI and the j<sup>th</sup> CI</td></tr></tbody></table>
<table><thead><tr><th>Notation</th><th>Meaning</th></tr></thead><tbody><tr><td>$e_{\kappa k}$</td><td>Dependency of k<sup>th</sup> loop which is one of the loops passing through the i<sup>th</sup> CI and the j<sup>th</sup> CI</td></tr></tbody></table>

Accordingly:

$$e_{\kappa(3,4)} = e_{\kappa1} + e_{\kappa2} + e_{\kappa3} + e_{\kappa4} + e_{\kappa5} + e_{\kappa6} + e_{\kappa7} + e_{\kappa8} + e_{\kappa9} + e_{\kappa10} + e_{\kappa11} + e_{\kappa12}$$

$$e_{\kappa(3,4)} = 0.0005 + 0.00007 + 0.0025 + 0.0002 + 0.00001 + 0.0004 + 0.0001 + 0.00003 + 0.0002 + 0.0001 + 0.0004 + 0.0005$$

$$e_{\kappa(3,4)} \approx 0.005$$

## 3 MATLAB Code

Our MATLAB code works on Laugé's tables. The code normalizes all dependency values in Laugé's tables by dividing each value by five which the maximum value of the Likert scale of the Laugé's survey. The code then loops over these tables, one by one to calculate three different versions of Laugé's tables:

* `laugeMatricesIndirectPathsBased`: a set of six matrices, each of them has the same size of one of Laugé's tables. Each of them has the dependencies values from one CI to another based on the sum of the dependencies of all parallel indirect forward paths between these two CIs using equations (1) and (2),

* `laugeMatricesAllPathsBased`: a set of six matrices (each of them has the same size of one of Laugé's tables. Each of them has the dependencies values from one CI to another based on the sum of the dependencies of all parallel indirect forward paths in addition to the direct forward path between these two CIs, and

* `laugeMatricesLoopsBased`: a set of six matrices (each of them has the same size of one of Laugé's tables. Each of them has the dependencies values from one CI to another based on the sum of the dependencies of all loops pass through these two CIs using equation (3).

The code uses an algorithm that exhaustively traverse through the digraph to find all loops and forward paths between two vertices from Bahar and Jantzen [16]. The code also uses another function to compute the path gain from Abdelgawad [17]. The following code listing is a summarized version of our Matlab code that has all the basic functionalities.

% Laugé's tables are stored in 'laugeMatrices'

% laugeMatrices(:, : , 1) - less than two hours

% laugeMatrices(:, : , 2) - less than six hours

% laugeMatrices(:, : , 3) - less than 12 hours

% laugeMatrices(:, : , 4) - less than 24 hours

% laugeMatrices(:, : , 5) - more than 24 hours

% laugeMatrices(:, : , 6) - more than one week

% Normalize all Laugé's tables by dividing every value by 5

% N.B. max value in Laugé's survey was 5, while min was 0
laugeMatrices=laugeMatrices./5;
% Loop over Laugé's tables
for N=1=size(laugeMatrices, 3),
    % allcycsn(A) finds all cycles in an adjacency matrix A
    % allcycsn function is a part of the DIGRAPH Matlab toolbox
    % adjacency matrix is the transpose of Laugé's table
    allLoops=allcycsn(laugeMatrices(:, : , N));
    % Find all indirect forward paths
    % Sum dependencies of all indirect forward paths between Lth
    CI and Mth CI
    for L=1=size(laugeMatrices(:, : , N), 1),
        for M=1=size(laugeMatrices(:, : , N), 1),
            % Find all loops that pass through both L and M
            allLoopsbtn2CIs=...
                allLoops(and(any(allLoops==L, 2), ... 
                any(allLoops==M, 2)), :);
            % Sum dependencies of all loops passing through L and M,
            % then add it to a matrix: 'laugeMatricesLoopsBased'
            % computePathsGain(G, p) calculates paths gains for all given
            % forward paths stored in a matrix p, based on the gain matrix G
            % computePathsGain is a part of the Automated Eigenvalue analysis
            % of SD models Matlab toolbox
            laugeMatricesLoopsBased(L, M, N)=...
                sum(computePathsGain(laugeMatrices(:, : , N)', ... 
                allLoopsbtn2CIs));
            if L~=M,
                % allpathn(s, e, A) finds all forward paths going from vertex s
                % to vertex e in an adjacency matrix A
                % allpathn function is a part of the DIGRAPH Matlab toolbox
                allPathsbtn2CIs=allpathn(L, M, laugeMatrices(:, : , N));
            % Sum dependencies of direct and indirect forward paths going
            % from L to M
            laugeMatricesAllPathsBased(L, M, N)=...
                sum(computePathsGain(laugeMatrices(:, : , N)', ... 
                allPathsbtn2CIs));
                laugeMatricesIndirectPathsBased(L, M, N)=...
                    laugeMatricesAllPathsBased(L ,M ,N)-...
                    laugeMatrices(L, M, N);
            end
            end
            end
        end
    end

4 Results

As previously mentioned, any of Laugé’s 11×11 CI dependencies table is similar to gain matrix, and accordingly any of the simplified 5×5 CI dependencies tables is similar to gain matrix as well. The time needed to run our code on the Laugé’s 11×11 table is enormous on normal PCs because of the exhaustive searching algorithms. Accordingly, we ran our code on the simplified version tables. Figure 5 shows the development of the effect of ICT CI failure on other CIs over different failure durations. As can be seen in the figure, by the end of the time horizon of the graph, the effect of ICT CI failure
on Energy, Financial, and Transport CIs passed the value of 0.9 considering the normalized dependency values.

## 5x5 Tables Reconstruction based on Direct and Indirect Forward Paths

Our MATLAB code has reconstructed the 5x5 tables based on the sum of direct and all indirect forward paths from one CI to another for each of the failure time durations considered in Laugé's survey (2Hr, 6Hrs, 12Hrs, <24Hrs, >24Hrs, and >1Wk). **Error! Reference source not found.** shows a listing of all possible dependencies from one failed CI to another. The values in the reconstructed tables exceed the normalized maximum value of one in many cases, especially in the longer failure durations. Dependency values that exceed one or 100% will not mean more than a full failure in the dependent CI. Values exceeding 100% in the table were not truncated though, such values are indicators of how low the expert original direct estimates of the dependencies could be.

<figure><img src="image_6.png" /><figcaption>**Fig. 5.** Normalized 5x5 Dependency Tables for Different Failure Durations (to the Left), and Effect of ICT CI Failure on Other CIs over the Same Durations (to the Right)</figcaption></figure>

<table><caption>**Table 1.** Values Listing of the 5x5 Tables Reconstruction based on both Direct and Indirect Forward Paths</caption><thead><tr><th rowspan="2">From</th><th rowspan="2">To</th><th colspan="6">Paths Interdependence Value</th></tr><tr><th>2Hr</th><th>6Hrs</th><th>12Hrs</th><th>&lt;24Hrs</th><th>&gt;24Hrs</th><th>&gt;1Wk</th></tr></thead><tbody><tr><td>Energy CI</td><td>Energy CI</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>Energy CI</td><td>ICT CI</td><td>0.40</td><td>0.72</td><td>1.19</td><td>1.64</td><td>2.68</td><td>4.90</td></tr><tr><td>Energy CI</td><td>Water CI</td><td>0.34</td><td>0.57</td><td>1.09</td><td>1.60</td><td>3.21</td><td>6.22</td></tr><tr><td>Energy CI</td><td>Financial CI</td><td>0.79</td><td>1.35</td><td>2.03</td><td>2.53</td><td>3.93</td><td>6.44</td></tr><tr><td>Energy CI</td><td>Transport CI</td><td>0.70</td><td>1.00</td><td>1.57</td><td>2.16</td><td>3.39</td><td>5.58</td></tr><tr><td>ICT CI</td><td>Energy CI</td><td>0.71</td><td>0.91</td><td>1.35</td><td>2.08</td><td>3.32</td><td>5.40</td></tr><tr><td>ICT CI</td><td>ICT CI</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>ICT CI</td><td>Water CI</td><td>0.38</td><td>0.61</td><td>1.19</td><td>1.89</td><td>3.83</td><td>7.13</td></tr><tr><td>ICT CI</td><td>Financial CI</td><td>0.98</td><td>1.61</td><td>2.19</td><td>2.76</td><td>4.11</td><td>6.54</td></tr><tr><td>ICT CI</td><td>Transport CI</td><td>0.87</td><td>1.11</td><td>1.63</td><td>2.33</td><td>3.68</td><td>5.53</td></tr><tr><td>Water CI</td><td>Energy CI</td><td>0.26</td><td>0.44</td><td>0.91</td><td>1.56</td><td>2.49</td><td>4.37</td></tr></tbody></table>
<table><thead><tr><th rowspan="2">From</th><th rowspan="2">To</th><th colspan="6">Paths Interdependence Value</th></tr><tr><th>2Hr</th><th>6Hrs</th><th>12Hrs</th><th>&lt;24Hrs</th><th>&gt;24Hrs</th><th>&gt;1Wk</th></tr></thead><tbody><tr><td>Water CI</td><td>ICT CI</td><td>0.19</td><td>0.38</td><td>0.83</td><td>1.40</td><td>2.29</td><td>4.01</td></tr><tr><td>Water CI</td><td>Water CI</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>Water CI</td><td>Financial CI</td><td>0.26</td><td>0.66</td><td>1.56</td><td>2.49</td><td>4.10</td><td>6.85</td></tr><tr><td>Water CI</td><td>Transport CI</td><td>0.25</td><td>0.51</td><td>1.17</td><td>2.02</td><td>3.11</td><td>5.03</td></tr><tr><td>Financial CI</td><td>Energy CI</td><td>0.17</td><td>0.24</td><td>0.49</td><td>0.98</td><td>1.99</td><td>4.18</td></tr><tr><td>Financial CI</td><td>ICT CI</td><td>0.18</td><td>0.24</td><td>0.45</td><td>0.95</td><td>2.13</td><td>4.31</td></tr><tr><td>Financial CI</td><td>Water CI</td><td>0.08</td><td>0.15</td><td>0.46</td><td>1.07</td><td>2.38</td><td>5.32</td></tr><tr><td>Financial CI</td><td>Financial CI</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr><tr><td>Financial CI</td><td>Transport CI</td><td>0.25</td><td>0.31</td><td>0.62</td><td>1.21</td><td>2.70</td><td>4.89</td></tr><tr><td>Transport CI</td><td>Energy CI</td><td>0.37</td><td>0.54</td><td>0.86</td><td>1.34</td><td>2.59</td><td>4.95</td></tr><tr><td>Transport CI</td><td>ICT CI</td><td>0.29</td><td>0.48</td><td>0.81</td><td>1.26</td><td>2.49</td><td>5.19</td></tr><tr><td>Transport CI</td><td>Water CI</td><td>0.15</td><td>0.35</td><td>0.76</td><td>1.23</td><td>2.92</td><td>6.05</td></tr><tr><td>Transport CI</td><td>Financial CI</td><td>0.50</td><td>0.92</td><td>1.46</td><td>1.96</td><td>3.41</td><td>6.35</td></tr><tr><td>Transport CI</td><td>Transport CI</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td></tr></tbody></table>

### 5x5 Tables Reconstruction based on Loops

Like the case of the forward paths, our MATLAB code has reconstructed the 5x5 tables based on the sum of direct and all indirect forward paths from one CI to another for each of the failure time durations considered in Laugé's survey (2Hr, 6Hrs, 12Hrs, <24Hrs, >24Hrs, and >1Wk). It should be noted that, as mentioned above, the forward paths from CIi to CIj are the feedback paths from CIj to CIi, and vice versa. Therefore, the dependency of parallel loops passing through CIi and CIj in the direction from CIi and CIj, are the same loops that pass through CIj and CIi in the opposite direction. Based on that Table 2 shows a listing of only the upper triangle in addition to the diagonal values of the dependencies matrices from one failed CI to another, the lower triangle values would be a mirror of the upper's. Similar to Table 1, the values in the reconstructed tables exceed the normalized maximum value of one in many cases especially in the longer failure durations. But again, dependency values that exceed one or 100% will not mean more than full failure in the dependent CI.

<table><caption>**Table 2.** Values Listing of 5x5 Tables Reconstruction based on Loops</caption><thead><tr><th rowspan="2">From</th><th rowspan="2">To</th><th colspan="6">Loop Interdependence Value</th></tr><tr><th>2Hr</th><th>6Hrs</th><th>12Hrs</th><th>&lt;24Hrs</th><th>&gt;24Hrs</th><th>&gt;1Wk</th></tr></thead><tbody><tr><td>Energy CI</td><td>Energy CI</td><td>0.46</td><td>0.92</td><td>2.06</td><td>4.07</td><td>8.37</td><td>17.07</td></tr><tr><td>Energy CI</td><td>ICT CI</td><td>0.27</td><td>0.60</td><td>1.36</td><td>2.78</td><td>5.75</td><td>12.47</td></tr><tr><td>Energy CI</td><td>Water CI</td><td>0.08</td><td>0.21</td><td>0.71</td><td>1.68</td><td>4.26</td><td>10.50</td></tr><tr><td>Energy CI</td><td>Financial CI</td><td>0.11</td><td>0.22</td><td>0.69</td><td>1.63</td><td>4.24</td><td>9.85</td></tr><tr><td>Energy CI</td><td>Transport CI</td><td>0.24</td><td>0.46</td><td>1.02</td><td>1.88</td><td>4.81</td><td>11.39</td></tr><tr><td>ICT CI</td><td>ICT CI</td><td>0.48</td><td>0.97</td><td>1.97</td><td>3.65</td><td>7.47</td><td>16.32</td></tr><tr><td>ICT CI</td><td>Water CI</td><td>0.06</td><td>0.17</td><td>0.69</td><td>1.47</td><td>3.77</td><td>10.06</td></tr><tr><td>ICT CI</td><td>Financial CI</td><td>0.17</td><td>0.34</td><td>0.67</td><td>1.44</td><td>3.73</td><td>9.46</td></tr><tr><td>ICT CI</td><td>Transport CI</td><td>0.23</td><td>0.45</td><td>0.94</td><td>1.72</td><td>4.41</td><td>10.94</td></tr></tbody></table>
<table><thead><tr><th rowspan="2">From</th><th rowspan="2">To</th><th colspan="6">Loop Interdependence Value</th></tr><tr><th>2Hr</th><th>6Hrs</th><th>12Hrs</th><th>&lt;24Hrs</th><th>&gt;24Hrs</th><th>&gt;1Wk</th></tr></thead><tbody><tr><td>Water CI</td><td>Water CI</td><td>0.11</td><td>0.28</td><td>0.99</td><td>2.13</td><td>5.38</td><td>13.46</td></tr><tr><td>Water CI</td><td>Financial CI</td><td>0.01</td><td>0.02</td><td>0.17</td><td>0.51</td><td>2.46</td><td>7.28</td></tr><tr><td>Water CI</td><td>Transport CI</td><td>0.01</td><td>0.09</td><td>0.44</td><td>1.02</td><td>3.18</td><td>9.21</td></tr><tr><td>Financial CI</td><td>Financial CI</td><td>0.23</td><td>0.43</td><td>1.00</td><td>2.10</td><td>5.32</td><td>12.58</td></tr><tr><td>Financial CI</td><td>Transport CI</td><td>0.10</td><td>0.19</td><td>0.53</td><td>1.10</td><td>3.12</td><td>8.61</td></tr><tr><td>Transport CI</td><td>Transport CI</td><td>0.39</td><td>0.70</td><td>1.48</td><td>2.55</td><td>6.28</td><td>14.88</td></tr></tbody></table>

## Comparing Results with the Original Expert Estimates

In Figure 5, the chart on the right compiles the original direct expert estimated dependencies of ICT CI failure on other CIs over the durations of Laugé's survey. Based on the results in Table 1 and Table 2, we have redrawn the same Figure 5 (chart on the right) using the reconstructed 5x5 tables based on direct and indirect forward paths (see Figure 6), and the reconstructed 5x5 tables based on loops (see Figure 7).

<figure><img src="image_7.png" /><figcaption>**Fig. 6.** Effect of ICT CI Failure on Other CIs (Direct and Indirect Forward Paths based Dependencies) over the Same Durations</figcaption></figure>

By comparing the dependency values development over failure durations of Laugé's survey (2Hr, 6Hrs, 12Hrs, <24Hrs, >24Hrs, and >1Wk) as shown in **Error! Reference source not found.** and **Error! Reference source not found.** with CIs dependency values development over the same failure durations as shown **Error! Reference source not found.** (the graph to the right), the greater cascading effects due to loops becomes very clear. By the end of one-week failure duration, the highest estimated dependency value, and accordingly the disruption moving from one CI to another hardly exceeds the value of 0.9, while it passes 7 when we consider the forward paths effect (direct and indirect), and 16 when considering the loops effect, irrespective to the above mentioned fact of that the dependency values that exceed one or 100% will not mean more than full failure in the dependent CI.
<figure><img src="image_8.png" /><figcaption>Fig. 7. Effect of ICT CI Failure on Other CIs (Loop based Dependencies) over the Same Durations</figcaption></figure>
<figure><img src="image_9.png" /><figcaption>**Fig. 8.** All Possible Loops Passing Through Both Water CI and Financial CI based on CIs Dependency Table (Based on Laugé's CI Failure for Less Than 2 Hours Table-Simplified Version)</figcaption></figure>

**5 Concluding remarks**

Owing to the interdependencies in CIs, the cascading effects propagate along both direct and indirect forward paths as well as loops that amplify the effects of a primary disruption occurring in a given CI. We developed a MATLAB code to identify forward
paths and loops dependencies, allowing the quantification of the greater cascading effect of the primary disruption. To illustrate the approach, we computed the forward paths and loops dependency values for a reduced set of five interconnected CIs. Beyond having the ability of revealing the weak points in interconnected CIs, our approach also discloses that expert assessment of dependencies between CIs is more challenging than it appears at first sight. Future work on expert assessment requires an improved methodology that considers not only the direct effects between pairs of CIs but also the cascading loop effects.

## References

1. Norwegian Directorate for Civil Protection (DSB): Risikoanalyse av «Cyberangrep mot ekom-infrastruktur». (2015).

2. Ouyang, M.: Review on Modeling and Simulation of Interdependent Critical Infrastructure Systems. Reliab. Eng. Syst. Saf. 121, 43–60 (2014).

3. Linstone, H.A., Turoff, M. eds: The Delphi method: techniques and applications. Addison-Wesley Pub. Co., Advanced Book Program, Reading, MA, USA (1975).

4. Surowiecki, J.: The wisdom of crowds. Anchor Books, New York City, NY, USA (2005).

5. Canzani, E.: Modeling Dynamics of Disruptive Events for Impact Analysis in Networked Critical Infrastructures. In: Tapia, A., Antunes, P., Bañuls, V.A., Moore, K., and Porto, J. (eds.) ISCRAM 2016 Conference Proceedings – 13th International Conference on Information Systems for Crisis Response and Management. Federal University of Rio de Janeiro, Rio de Janeiro, Brasil (2016).

6. Abdelgawad, A.A., Farstad, T.-E., Gonzalez, J.J.: Vulnerability Analysis of Interdependent Critical Infrastructures upon a Cyber-attack. In: Proceedings of the 52nd Hawaii International Conference on System Sciences., Hawaii, USA (2019).

7. Laugé, A.: Crisis Management Toolbox: the Relevant Role of Critical Infrastructures and their Dependencies, http://hdl.handle.net/10171/37071, (2014).

8. Laugé, A., Hernantes, J., Sarriegi, J. M.: Critical Infrastructure Dependencies: A Holistic, Dynamic and Quantitative Approach. Int. J. Crit. Infrastruct. Prot. 8, 16–23 (2015). https://doi.org/10.1016/j.ijcip.2014.12.004.

9. European Commission: Green Paper on a European Programme for Critical Infrastructure Protection, COM (2005) 576 Final, https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:52005DC0576, (2005).

10. Panula-Ontto, J.: EXIT method for cross-impact analysis. Unpublished. (2016). https://doi.org/10.13140/rg.2.2.17159.09121.

11. Diestel, R.: Graph Theory. Springer-Verlag, Berlin Heidelberg (2017).

12. Kreyszig, E.: Advanced Engineering Mathematics. Wiley, Hoboken, NJ, USA (2011).

13. Kuo, B.C.: Automatic Control Systems. John Wiley & Sons, NY, USA (2003).

14. Ogata, K.: Modern Control Engineering. Pearson, Boston, MA, USA (2009).

15. Chao, K.: A New Look at the Cross-Impact Matrix and its Application in Futures Studies. J. Futur. Stud. 12, 45–52 (2008).

16. Bahar, M., Jantzen, J.: DIGRAPH TOOLBOX - A Tutorial. Electric Power Engineering Department - Technical University of Denmark, Kgs. Lyngby, Denmark (1994).

17. Abdelgawad, A.: Automated Eigenvalue analysis of SD models. (2004).