Quantifying Decision Making in the Critical Infrastructure via the Analytic Hierarchy Process (AHP)

In this paper, we examine the benefits of a more quantifiable way to make decisions that enable senior leaders to better manage disruption of and attacks on the critical infrastructure. Most of the decisions have been made using intuition and in some cases unrelated experiences and have not particularly worked to the benefit of the sectors' performance and stability. Much of this is due to the history of the logic control systems and networks that were fairly isolated and much better protected. Attempts to reduce costs and secure many of the benefits of IP-based environments have unfortunately now also introduced some of the vulnerabilities indicative of IP-based systems into the logic environments. Senior leaders have not been used to these new ‘hybrid' information technology/operational technology (IT/OT) environments which though creating new opportunities also introduce new challenges. The unique nature of the critical infrastructure in which it is over 80%-owned by the private sector, often regulated by the federal government, and serves the interests and demands of the public, creates a non-trivial challenge at many different levels. More trust and cooperation between the three elements of society is surely a desired interest by the key stakeholders, but there are many concerns in terms of over-regulation, costs, and loss of intellectual property that have consistently sustained a level of discomfort between the three communities in terms of the priorities and self-serving interests of each other. The challenges of the low asymmetry entry and attribution within the cyber domain have raised the profile of many actors who would not even have previously registered in the ‘noise' on a trouble or problem scale. Now, the ability to determine those responsible, as well as, almost any actor having the ability to present a challenge to the environment have changed many of the dynamics in terms of how senior leaders must now operate and manage the appropriate systems and networks. Hence, for obvious reasons, senior leaders are much more cautious in their approach to decision making because of the potential consequences. This is especially true because cyber assets, though so valuable can be also so vulnerable. In this study, we will discuss a method that moves decision from a less arbitrary to a more data-centric, quantifiable approach that drives leadership to better and quicker decisions.