---

WHAT YOUR COLLEAGUES ARE SAYING ABOUT CRITICAL INFRASTRUCTURE RISK ASSESSMENT

“Critical Infrastructure Risk Assessment is an invaluable reference for assessors, business managers, operators, and planners. And given a rapidly evolving geopolitical situation with nations and other actors motivated to compete and fight across multiple domains, the book could not come at a better time.” – Chuck Benson, Director of IoT Risk Mitigation Strategy, University of Washington

“What I particularly like about this book is how self-contained it is in its knowledge of statutes, approaches, resources, and recommendations. You need not look elsewhere for guidance in conducting infrastructure risk assessments. This book is a practitioner’s guide that anyone involved in managing, securing, or operating critical infrastructure would find invaluable. The book’s subtitle, “Critical Infrastructure Risk Assessment: The Definitive Threat Identification and Threat Reduction Handbook” is no boast as this book lives up to its title.” – Tari Schreider, C|CISO, CRISC, MCRP, Cybersecurity Program Strategist, Author & Instructor

“Ernie Hayden has been in the industry for many years and offers a lot of practical advice in this book. The book is laid out in an easy-to-consume manner; it starts with foundational information and proceeds to detail the assessment process from start to finish. This book is a great reference for the facility manager, plant manager or consultant.” – Matt B., CISSP

“Ernie Hayden has provided an extraordinary work that goes beyond its title, addressing Risk Assessment for Critical Infrastructure, with all its elements: threat identification, vulnerability identification, and impact. But more than an academic exercise, Mr. Hayden has taken years of experience as a risk assessor, and provides a handbook that will be invaluable to both the novice assessor, the executive who has been charged with an assignment to have a risk assessment completed, and the seasoned assessor.” – Matt Lampe, Partner, Fortium Partners

“This handbook was written for anyone involved in critical infrastructure risk assessment. Ernie Hayden guides you through the quagmire of complex terms and essential concepts to gain a clear understanding of critical infrastructure and risk assessment. The responsible executive or risk assessor will want to keep this reference by their side while planning, conducting, or using any risk assessment.” – Gil Oakley, Retired, Institute of Nuclear Power Operations

---

As a manager or engineer have you ever been assigned a task to perform a risk assessment of one of your facilities or plant systems?What if you are an insurance inspector or corporate auditor? Do you know how to prepare yourself for the inspection, decided what to look for, and how to write your report?

This is a handbook for junior and senior personnel alike on what constitutes critical infrastructure and risk and offers guides to the risk assessor on preparation, performance, and documentation of a risk assessment of a complex facility. This is a definite “must read” for consultants, plant managers, corporate risk managers, junior and senior engineers, and university students before they jump into their first technical assignment.

---

At over 400 pages, this book is robust in its content of conducting a physical risk assessment on critical infrastructure.  The author, Ernie Hayden has extensive experience in protecting critical infrastructure and has generously shared his years’ of experience gained from his Chief Information Security Officer (CISO) roles for the Port of Seattle, Seattle City Light, and as the Managing Principal of Critical Infrastructure Protection for Verizon. With widely reported eroding infrastructure within the US, this book is not only timely, but critically needed. But Ernie does not stop at US borders, he also provides insight in assessing risk to critical infrastructure located in Canada, the UK as well as many other countries.

The book’s nine chapters are divided into two parts. Part I covers the background of critical infrastructure, risk management and the process of assessing risk. Part II walks the reader through conducting an effective risk assessment on critical infrastructure. The crown jewel in Ernie’s book is the sample risk assessment report provided as an Appendix. Here you can see the application of the lessons, guidance, and examples seeded throughout the book.

The book provides several great diagrams on the four dimensions of interdependent infrastructure cautioning the reader to not only assess risk on their specific infrastructure but consider the risk introduced by infrastructures they may be dependent. The level of detail provided even includes the types of tools one would need to perform a physical risk assessment of critical infrastructure. One could easily build a toolkit from the examples provided.

What I particularly like about this book is how self-contained it is in its knowledge of statutes, approaches, resources, and recommendations. You need not look elsewhere for guidance in conducting infrastructure risk assessments. Readers will have no ambiguity about what critical infrastructure is as Ernie provides ample definitions and examples of critical infrastructure. Ernie grounds us in the evolution of critical infrastructure directives, regulations, and laws, walking us through the evolution of the regulatory landscape. When it comes time to perform an assessment, the book walks you through the pre-assessment, on-site observations, writing a final report, and remediation strategies.

Each chapter provides questions for further thought and discussion for the stimulation of critical thinking. Readers will find the book well cited and easy to read. It becomes clear to the reader that the author has performed extensive critical infrastructure risk assessments by the level of detail provided that only an outlier would have. This book is a practitioner’s guide that anyone involved in managing, securing, or operating critical infrastructure would find invaluable. The book’s title “The Definitive Threat Identification and Threat Reduction Handbook” is no boast as this book lives up to its title.

Review by Tari Schreider, C|CISO, CRISC, MCRP

Cybersecurity Program Strategist, Author & Instructor

 

September, 2020.

382 pages including comprehensive index and real-world example risk assessment report.

Print – ISBN: 978-1-944480-71-4

EPUB ISBN – 978-1-944480-72-1

WEB PDF ISBN – 978-1-944480-73-8