Definition of important concepts in integral security

The term risk has different and inconsistent interpretations in many areas; some definitions of risk are based on probability, while others focus on expected value or uncertainty [17]. In project management and management systems, risk is generally defined as “the effect of uncertainty” [18]. The effect of uncertainty, if it materializes, can have both negative and positive characteristics (i.e., opportunities) [18].

Risk in engineering fields such as system risk management, reliability management, and safety risk management expresses the probable magnitude of unacceptable (i.e., undesirable) consequences (losses, damages, and harm) of a disaster of a certain threat level (i.e., the normative potential of the disaster) on protected interests (assets) within a specified time interval in a given location [17].

The sources of these risks are the disasters mentioned in the previous paragraph. These risks are for people, their property, the environment, critical infrastructure, and, last but not least, for the state. Risks can be classified according to the chosen protected assets and whether a single protected asset (i.e., partial risk) or a set of protected assets (integrated risk) or a set of protected assets and the connections and flows between them (complex risk / integral risk) is considered.

Furthermore, risks are divided based on which disasters or sources of disasters are considered (only certain disasters, some of their scenarios, or all relevant disasters, etc.).

In common practice, and particularly in transportation systems, partial and integrated risks are typically considered, which are expressed as the product of the probability of occurrence of a disaster (or incident or failure) or frequency of occurrence and the magnitude of their consequences (losses, damages, harm) on the monitored entity or selected set of entities. There are many possible variables for calculating risk depending on the area being considered, but they usually involve the product of the two mentioned. In more detailed studies, the degree of vulnerability is considered, and sometimes the degree of controllability of harmful events; for example, in the automotive industry [19].

Thus, in the understanding of risk (R), we observe many differences, with the only common factor being that risk arises from concerns about an uncertain future [5,17]:

R = frequency ∙ consequences;

R = severity ∙ probability of occurrence;

R = threat ∙ vulnerability;

R = threat ∙ vulnerability ∙ impacts;

R = threat ∙ vulnerability / capacities;

R = (threat ∙ vulnerability) / countermeasures ∙ impacts;

R = f (threat ∙ vulnerability / capacities);

R = f (assets (protected interest) ∙ threat ∙ vulnerability);

R = frequency ∙ population ∙ vulnerability.

To ensure the safety of an area, or larger technological units or facilities, it is necessary to account for complex risk, i.e., integral risk based on a systemic approach to reality [2]. Integral risk involves multiple protected assets, including life, health, and safety of people, property, public welfare, the environment, technologies, and infrastructure, and also includes the influence of interconnections between these protected assets (in English, interdependences) [4,17].

The integral risk, denoted as R, is for all disasters in the area given by the relation [17]:

                                                                                                  (1)

R_k expresses the risk for the k-th disaster:

                                                                      (2)

P_k denotes the probability of occurrence of the k-th disaster, and D_i,k denotes the impact of the k-th disaster on the i-th protected interest. Similar relationships apply to integrated risk, but with the difference that for integral risk, the impacts D_i,k also include not only direct impacts DD_i,k but also indirect (secondary, tertiary, and more) impacts DI_i,k, whose relationships, according to the source [19], are as follows:

                                                           (3)

V_i is the value of the protected interest, S is the monitored area or object, Z_i,k is the vulnerability of the i-th protected interest during the k-th disaster, I_i,k is the function of mutual dependencies (interdependences). The mutual dependencies depend on the specific structure of protected interests in the area and specific connections between protected interests and the disaster, i.e., according to [17]:

                                                                                      (4)

VD_k is the characteristic of the degree of the k-th disaster, which affects the impacts on protected assets. VP_i,k is the characteristic of the degree of mutual connectivity of protected interests in the given area. The determination of VP_i,k is the subject of detailed research based on Boolean logic or, in the case of more complex dependencies, operational analysis methods [17,19,20].

For technical systems [21] the relation applies:

                    (5)

where H is the threat associated with the given disaster at the object location; A_i  are the values of monitored assets for i = 1,2,…, n; Z_i are the vulnerabilities of the assets for i = 1,2,…, n; F is the loss function; P_i are the probabilities of asset damage occurrence for i = 1,2,…, n – these are conditional probabilities; O is the vulnerability of protective measures; S is the size of the monitored object;  t is the time measured from the occurrence of the harmful event; T is the time during which losses occur; and t is the period of recurrence of the disaster. Since the loss function is typically not known, failure scenarios are created and multicriteria methods are used to assess the risk; typically, decision support systems [22].

From the above knowledge and given the complexity of the systems, it is clear that integral security can only be increased by considering and managing integral risks, which do not only consider the sum of partial risks but also account for dependencies and flows between assets [13].

For safety management purposes, the criticality of an asset (K) is understood as the function of the importance and vulnerability of the monitored asset or even the entire entity, expressed as the product of [13,17]:

K = importance ∙ vulnerability                                                                         (6)

Criticality with regard to a certain disaster can be expressed by the relation

C = S ∙ O ∙ B                                                                                                  (7)

where S is the severity of the largest impact of the disaster (harmful event), O is the probability of the disaster occurrence, and B is the conditional probability that the most severe impact will occur [13,23]].

Risk, as mentioned in the introduction of this section, refers to the effect of uncertainty, i.e., how frequently (or probably) extensive losses will occur. By reducing risk, we reduce the frequency of unfavorable events (if it is within our power) or their impacts. Risk thus relates to safety but is not defined by safety. Criticality refers to the threshold value between two states, in the area of safety it is the undesirable (danger) and desirable (safety). By reducing criticality, i.e., the threshold between danger and safety, we increase the state space of the system in the safe area, i.e., we increase safety. Therefore, criticality is a complementary variable to safety, even though it is a result of risk factors and may have the same input parameters as risk (e.g., vulnerability) [27].