Models of critical information infrastructure protection

This paper advocates the need to conceptualize or model critical information infrastructure protection (CIIP) in order to explain regulatory choices made by governments regarding CIIP. Building on previous attempts, it proposes two models of CIIP: the national security model and the business continuity model. Each of these models is based on a different, sometimes contrasting, set of values, namely, security values and neo-liberal values. As the choice of regulatory mechanism is dependent on the manner in which CIIP is perceived by governments, an analysis is essential to assess and understand national CIIP policies. A comparative analysis of American and Israeli policies is conducted to clarify the major issues regarding CIIP and to provide a basis for proposing CIIP models.