Crises rarely respect the boundary between the physical and the digital. Ransomware in a hospital group, a manipulated setpoint in a water-treatment plant, or the loss of a single satellite backhaul link can each escalate into a full emergency-response operation, and each can also degrade the information systems on which responders depend. Critical infrastructure is therefore both an asset to be protected and the substrate on which crisis response runs. This track invites research on that dual role.
Three developments make the topic pressing for the ISCRAM community. First, the convergence of operational technology with enterprise information technology has exposed energy, water, transport, and healthcare systems to adversaries who previously had no route to them, while the safety and availability constraints of those systems rule out many conventional security controls. Second, hostile activity is increasingly timed to coincide with, or amplify, natural hazards and other ongoing emergencies, meaning that cyber incident response and crisis management can no longer be planned as separate disciplines. Third, jurisdictions have responded with a fast-growing and largely uncoordinated body of critical-infrastructure protection law, leaving operators of cross-border systems facing incompatible designation criteria, reporting deadlines, and information-sharing duties at exactly the moment when coordination matters most.
The track speaks directly to the ISCRAM 2027 theme. Remote and First Nations communities typically depend on infrastructure with little or no redundancy: one fibre or satellite link, one substation, one water-treatment facility, or one telehealth connection to a distant hospital. An incident that is an inconvenience in a metropolitan area can isolate such a community for days, and restoration is slower because specialist personnel are far away. These communities are simultaneously being asked to adopt digital services—including remote clinics, smart microgrids, and connected sensing for bushfire and flood warning—that widen the attack surface faster than local security capacity grows. Work that treats resilience, community data sovereignty, and locally maintainable security as design requirements rather than afterthoughts is urgently needed.
The objectives of this track are to bring cybersecurity and critical-infrastructure protection research into sustained contact with the crisis-informatics community; attract empirical contributions, including incident case studies, exercise reports, and field deployments, alongside design, modelling, and policy work; give visibility to research from and about remote, rural, and Indigenous contexts in the Asia-Pacific and beyond; and close the sessions with a short community research agenda on which future ISCRAM conferences can build.
Topics of Interest
The track welcomes full papers, short papers, case studies, and practitioner reports on topics including, but not limited to:
- Protecting infrastructure serving remote and First Nations communities: Single-path connectivity, off-grid and microgrid power, remote water and health facilities, community data sovereignty, and security designs that can be operated and maintained locally rather than by distant specialist teams.
- Cyber-physical crisis scenarios and cascading interdependency: Modelling, simulation, and empirical study of how compromise in one sector propagates into others and how compound events combine a cyber incident with a natural hazard.
- Security of operational technology and industrial control systems: Monitoring, segmentation, safe patching, and anomaly detection in energy, water, transport, and manufacturing environments where availability and safety constrain the available controls.
- Healthcare and public-health infrastructure under attack: Hospital and clinical-system disruption, medical-device and telehealth exposure, diversion and continuity planning, and the crisis coordination that follows a major healthcare outage.
- Cyber incident response as crisis management: Playbooks, incident-command structures, tabletop and live exercises, cross-agency and civil-military arrangements, and the human and organisational factors of responding under uncertainty.
- Artificial intelligence for detection, triage, and situational awareness: Machine learning and federated approaches to intrusion and anomaly detection, large language models for analyst support and insider-threat analysis, and associated risks including adversarial manipulation and synthetic content in crisis communication.
- Comparative critical-infrastructure protection law, policy, and regulation: How jurisdictions designate essential entities and assets, mandatory incident-reporting regimes and their interaction with emergency-management law, and the practical burden of divergent obligations on cross-border operators.
- Information sharing, trust, and public-private coordination: Sharing platforms and their governance, incentives and disincentives to disclose, liability concerns, and coordination among operators, regulators, national computer emergency response teams, and emergency-management agencies.
- Digital forensics and attribution under crisis time pressure: Evidence preservation when systems must be restored immediately, forensic readiness in operational-technology environments, and the tension between rapid recovery and investigative integrity.
- Resilience engineering, degraded-mode operation, and recovery: Manual fallback procedures, graceful degradation, restoration prioritisation, and measuring resilience rather than compliance.
- Supply-chain and third-party dependency risk: Vendor and integrator compromise, remote-maintenance access, cloud and telecommunications dependency, and concentration risk in small markets and isolated regions.
- Workforce, training, and testbeds: Curriculum and exercise design, simulation and cyber-range environments, capacity building for under-resourced operators, and shared datasets and testbeds for reproducible research.
Track Chairs
| Role | Name | Affiliation | |
|---|---|---|---|
| Track Chair | Stefan Schauer | — | — |
| Co-chair | Raymond Chan | Singapore Institute of Technology, Singapore | raymond.chan@singaporetech.edu.sg |
| Co-chair | Maria Nogal | — | — |
| Co-chair | Stefan Rass | — | — |
| Co-chair | Michiel Rhoen | — | — |