Substation Security Challenges: The Importance of the Critical Decision Making Process

The most commonly used decision-making process is conjecture-based; we use it countless times daily. We go through life making decisions based on assumptions, speculation and whimsy, with little thought to impact or outcomes. However, when it comes to security, especially substation security, our decisions have consequences. For these decisions, we need a better decision-making method. We need a reliable technique that can produce sound decisions and stand up to intense scrutiny.

General Colin Powell once said: “You can’t make good decisions unless you have good information and can separate facts from opinion and speculation. Facts are verified information, which is then presented as objective reality. The rub here is the verified. How do you verify verified?”

In my previous article, I discussed how dangerous unverified assumptions can be when it comes to substation security issues. Now, we will consider the impact of our decision-making process on substation security. Critical decision-making has nothing to do with “criticizing”. In critical decision-making, we’re using the third definition of “critical” in the Merriam-Webster Dictionary: “exercising or involving careful judgment or judicious evaluation”.

At first glance, critical decision-making appears to be a complicated, overly sophisticated, technical process. In reality, it’s a learnable skill that anyone can employ. However, the methodical application of a rigorous problem-solving approach does require focus and discipline, so it isn’t effortless. But, if you want easy, don’t pursue a career as a utility security practitioner; it’s not easy or glamorous. It’s underappreciated hard work that can be extraordinarily satisfying. Okay, back to critical decision-making.

So, why is critical decision-making important? Its importance lies in its impact. Whether you are a member of a large security team with dozens of substations or the team is you and a cup of coffee with a couple of substations to deal with, you’re responsible for protecting the most critical infrastructure assets your organization possesses. (Generation protection is another story). If a security breach shuts down a substation, it shuts down a system. Shut down enough substations; you shut society down. Now add the axiom I’m continually repeating: when it comes to utility security, you have to get it right every time; a threat actor only has to get it right once. With this level of impact and responsibility, your decisions are important, so they need to be fact-based, reasoned, and defendable.

Critical decision-making is involved in every aspect of substation security. It is crucial in conducting security assessments, planning, and resource allocation. It’s an essential skill for investigations and forensic analysis and provides a strong foundation for litigation defense. It is also our mental best defense in a crisis. If you have a solid grasp of critical decision-making, you can make sound, quick, and decisive decisions even under duress.

What is Critical Decision-Making? It’s the process of objectively analyzing and evaluating information to form a qualified and defendable judgment. It involves gathering relevant information, interpreting it, assessing its value, and formulating ideas, theories, and solutions. Critical decision-making is crucial to making informed judgments and reaching rational conclusions. The process that leads the critical decision-making process is known as Critical Thinking.

Critical decision-making is based on a technique known as critical thinking. Trust me, we’re not going in circles. Critical thinking is essential for verifying information and making informed decisions. It helps identify mistakes, flawed conclusions, and misrepresentations. It allows you to sort through the fog of information overload to spot errors arising from unverified assumptions, unsubstantiated conclusions, and less rigorous decision-making processes. It also provides proven and defensible problem-solving methods, incident investigation approaches, and data analysis methods. However, in the critical decision-making process, critical thinking is not a stand-alone technique; it is best used in concert with analytical thinking and reasoning techniques.

Effective decision-making skills require understanding three information-processing techniques: analytical thinking, critical thinking, and reasoning; each is a specific information-gathering and deciphering method. The good news is that it doesn’t take a PhD to use these techniques, and you don’t need to master them in their entirety; you just need to understand the concepts, how they relate to each other, and how to put them into practice.

Is it possible to give you a complete lesson in the art of critical decision-making in one introductory article? Sadly, no; it’ll take a little more effort than that. However, I can introduce the key terms and concepts you need and point you in a direction for acquiring these skills to make informed decisions based on solid criteria, not conjecture.

Analytical Thinking – Fact Based
Analytical thinking involves data harvesting and breaking down complex information into smaller parts. Analytical thinking is the logical and systematic breakdown of information. While the critical thinking process considers external criteria and knowledge, including institutional history, personal experience, and perspective, analytical thinking focuses on linear information processing. It’s the task of dispassionately collecting and sorting data to arrive at a conclusion. For those who have watched the television series, Star Trek, think of Mr. Spock.

Analytical Thinking:

• Breaks down complex information into smaller parts
• Is the systematic, linear, and logical sequencing of information
• Uses facts within the information gathered to support conclusions

The need to employ analytical thinking techniques should be your first consideration in the critical decision-making process. When you have a complex problem to solve or overwhelming amounts of information to process, you should put your analytical skills to work first. The goal will be to ensure that all relevant data or information is collected and evaluated without consideration of the information’s impact on the final analysis. Then, with all relevant data collected, compiled, and sorted, it’s time to shift gears and employ critical thinking skills.

Critical Thinking – Judgment Based
Unlike analytical thinking, critical thinking involves making opinion-based judgments, which are arrived at by evaluating various sources of information, including expertise, knowledge, and experience.

Where analytical thinking is data harvesting, critical thinking is an investigative technique that involves assessing, questioning, verifying, inferring, interpreting, and formulation tasks. It also involves breaking down information into smaller parts and analyzing each part logically and systematically, but not in the dispassionate manner of analytical thinking. In critical thinking, even “gut feelings” count. In the critical thinking process, every form of information, including open-sourced data, subject-matter-expertise, and personal experience, is used to arrive at a well-considered decision or to produce an innovative solution. Think Sherlock Holmes.

Critical Thinking:

• Considers outside knowledge, including your own, when evaluating information
• Assesses, questions, verifies, infers, interprets, and formulates to be more holistic
• Uses other information to make judgments or find solutions
• Evaluates a myriad of sources to form an informed opinion

The critical thinking process verifies evidence, whether it supports or contradicts your initial assumptions and conclusions, before making a final judgment. It includes the consideration and unbiased evaluation of alternative possibilities to form a clear line of reasoning that leads to reasoned conclusions.

To give you an idea of the complexity of the critical thinking discipline, there are 14 commonly used tools or techniques in the critical thinking process. There are many more, but these fourteen will suffice. Personally, there are four I use regularly, and there are several that I’ve never used.

14 Critical Thinking tools:

1. Problem Restatement;
2. Pros, Cons, and Fixes;
3. Divergent/Convergent Thinking;
4. Sorting, Timelines, and Chronologies;
5. Causal Flow Diagramming;
6. Matrixes;
7. Scenarios;
8. Weighted Ranking;
9. Hypothesis Testing;
10. Devil’s Advocacy;
11. Probability Trees;
12. Utility Trees;
13. Utility Matrixes;
14. and Advanced Utility Analysis

In investigative analysis situations, I usually start with hypothesis testing. In contrast, I often begin with weighted ranking for criteria-based decisions. One of the basic principles of Hypothesis Testing is a great example of how a proven critical thinking technique can help guide your decision-making process.

In proving a hypothesis to be true, the number of consistencies isn’t as significant as the number of inconsistencies. In almost every case, when you apply hypothesis testing, you will find several potential outcomes that will have many of the same consistencies. The evidence will point to them. However, it’s the outcome or conclusion with the fewest inconsistencies that will prove to be the correct one. By the way, this is why an innocent person is often accused and sometimes convicted of a crime they didn’t commit. Once the investigators found evidence pointing to a person as the culprit, they stopped looking. They either failed to consider or discounted any evidence that didn’t support their decision (i.e., inconsistent evidence).

As a security professional, it is your responsibility to expend the energy and time resources needed to evaluate all the evidence or data provided until it is absolutely clear that you have reached the correct, defendable conclusion. Critical thinking provides the tools needed to do just that.

Reasoning
Reasoning is the technique used to pull everything together. It takes the data-based results of analytical thinking and the opinion-based results derived from critical thinking, verifies tests, and critiques them to ensure a sound conclusion has been reached. By consciously applying reasoning to your decision-making process, you’ll minimize adverse consequences, ensure the accuracy of your outcomes, and achieve better results.

The reasoning process involves eight essential elements:

1. purpose,
2. problem/question clarification,
3. information,
4. interpretation,
5. concepts,
6. assumptions,
7. point of view,
8. and implications

Applying these elements as a reasoning checklist can be a valuable tool for breaking down complex problems, identifying causes, and finding solutions.

The Role of Intellectual Standards
As a utility security professional, you are responsible for collecting, analyzing, and evaluating security-related data, investigating incidents, and creating reliable reports to aid your leadership’s decision-making. This includes security-related decisions regarding substations and other key infrastructure assets. You are the expert; it’s your responsibility to provide the best information and recommendations possible.

To achieve this, you must apply critical thinking processes and intellectual standards to analyze and report information. Professional rigor demands a systematic approach and comprehensive research from all available sources, identification of trends and patterns, accurate summaries of issues, and qualified recommendations for courses of action.

The role of critical decision-making in substation security cannot be overstated. Whether you’re evaluating security-related expenditures, investigating an incident, judging surveillance evidence, or conducting a threat assessment, your ability to gather, organize, and assess information and produce concrete and actionable decisions and recommendations is an essential but often overlooked skill. In a crisis, your ability to make quick, decisive, and defensible choices and institute effective damaging-mitigating countermeasures will be tied directly to your critical decision-making skills.

By utilizing critical thinking and analytical thinking techniques and adhering to intellectual standards, you can generate informative and accurate reports that keep your team informed of incidents, offer sound advice to leadership, and provide expert support to your utility on potential threats. So, make sure you have a firm grasp of critical decision-making techniques and expend the time and effort needed to apply them. As a utility security practitioner, the only decisions you may come to regret are those you didn’t critique through the critical decision-making process.

About the Author: Jim Willis is president of InDev Tactical, a security training and consulting firm. He is an electrical engineer, an experienced utility professional, and a credentialed homeland security specialist and anti-terrorism expert. If you want to discuss utility-focused security training or consulting assistance, you can reach Jim at 703-623-6819 or jim.willis@indevtactical.net.