Protecting value: ensuring continued use

As you will by now have surmised, infrastructure protection is about protecting the purpose of the infrastructure. We seek to protect the operation, and we plan our infrastructure to enable that. Protection is not the same as resilience. Protection is about preventing harm, while resilience is about adapting to failures and changes and recovering as rapidly as possible. There is a joint stem to both resilience and protection, and indeed sustainability as well. If we know what causes us to fail, we are in a position to allocate resources as efficiently as possible in our risk treatment strategy.

Often, the two terms are used to imply each other, potentially confusing the message. One might argue that in identifying the inherent vulnerabilities of a system and treating the attendant risks, the purpose is protected, and the system behaviour is capable of adapting to the associated changes. For example, putting the transformer on the third floor means that it is protected from floodwaters, and the associated service can continue through the flood event. This is a protection measure. Putting the standby generator on the third floor, above the floodwaters, will ensure that the electricity supply can be restored following an outage caused by the flood. This is a resilience measure. The difference can be as simple as the equipment's function in the system. So while it is true that one can imply the other in terms of output, the outcome of a protection strategy will be different from a resilience one. In practice, we recognise today that we need a balance between the two, but distinguishing the measures can be challenging. Arguably, this is as much about our mindset or perception of threats and goals as it is about risk treatment models.