The country’s security depends on its ability to anticipate crises
Crises are rarely sudden. They only seem so because it is only when a service breaks down or a river bursts its banks that they become apparent to everyone. They begin long before that, with subtle warning signs that nobody connects, known vulnerabilities that have never been addressed, and warnings that remain isolated.
by Erminio Polito
Aggiungi Il Sole 24 Oreai preferiti su Google
Crises are rarely sudden. They only seem so because it is only when a service is disrupted or a river bursts its banks that they become apparent to everyone. They begin much earlier, with faint warning signs that nobody connects, known vulnerabilities that are never addressed, and alerts that remain isolated. Such as an abnormal sensor reading, a weather report, an entry in maintenance logs, or a security alert dismissed as a false positive. Critical infrastructure today generates an unprecedented volume of data, but that data remains locked away within the systems of individual departments or different operators, and no one has an overall view of what is happening. So, when an emergency strikes, all attention is focused on the response. We count the resources deployed and the recovery times, we estimate the damage, and there is far less discussion of how the crisis came about.
For Italia, this issue is anything but abstract. Last year, Legambiente recorded 376 extreme weather events – the second-highest figure in the last eleven years. According to the Higher Institute for Environmental Protection and Research (ISPRA), 94.5 per cent of local authorities are at risk of landslides, floods, coastal erosion or avalanches, whilst the Emilia-Romagna Region has estimated the damage caused by the 2023 floods alone at 8.5 billion euros. On the digital front, the picture is no better. According to the latest Clusit report, 9.6 per cent of serious cyber-attacks recorded worldwide targeted our country, representing a 42 per cent increase in one year.
Then there is the hybrid threat, which the latest Annual Report on Security Information Policy identifies as one of the main challenges to national security. These are actions coordinated by states or by actors acting on their behalf, deliberately kept below the threshold of armed conflict in order to exploit the country’s vulnerabilities.
But let’s get back to the signals. Let’s imagine that, in the same week, there is a slowdown on a communications network, a minor disruption to the electricity supply and a case of overheating at a plant. Taken individually, these become separate tickets for the technical support team. Taken together, however, they may indicate an imminent component failure, a service disruption or even an attack disguised as a fault – precisely the sort of threat that intelligence agencies are concerned with.
Context also affects the meaning of a piece of data. A spike in traffic to a plant’s control systems is no cause for concern during a scheduled update. The same spike at three o’clock in the morning, with no maintenance work scheduled, is a different matter altogether.
