GOVERNING CROSS-DOMAIN RISK IN AI-DRIVEN CRITICAL INFRASTRUCTURE

Abstract

Modern critical infrastructures (CI) have become a socio technical system, in their modern attributes, but with a distance that is becoming ever decreasing. We have entered a new era of socio technical systems in which "formation of the digital, physical, industrial and human domains" has come together in a new way to make our CI in the modern day. AI, digital twins, Internet of Things (IoT) ecosystems and autonomous operational technology (OT) are now actively involved in decisions, leading to new instances of cross domain risk. Incidents that begin in one domain may expand to involve other domains and have system impacts outside of the traditional security perimeter. This paper seeks to analyse and describe the converged risk phenomenon by conducting a structured multi scenario analysis and showcase a single Governance framework for a Security Operations Centre (SOC) and Global Security Operations Centre (GSOC). The methodology uses the qualitative scenario reconstruction approach to capture propagation pathways with telemetry corruption, digital twin drift, autonomy escalation, autonomous error-classification or misclassification by AI, authentication instability and multi sector cascading failures. Results of this show that converged incidents need governance mechanisms that are able to bring together the following four areas: telemetry validation, autonomy monitoring, prediction model alignment and systemic risk monitoring. The findings suggest change in the manner SOC and GSOC leaders should develop: Incident response to Governor of socio technical stability. This is supported by the Converged Security Framework, which provides the structural basis for this evolution for responsible application of AI and critical infrastructure.