Thailand the resilient: managing critical infrastructure

Lessons learned from the September 11 attacks in the US were expensive. The events caused large-scale disruptions to financial markets. While the information-technology infrastructure of the New York Stock Exchange (NYSE) worked well, trading on it was halted for four consecutive days, because of damage to telecommunications connectivity into the exchange.

The incident led to a US presidential directive, involving key government officials and top business leaders and requiring collaboration to make the country a safer place.

The incident underscored the vulnerability of critical infrastructure, described by the presidential directive as those physical and cyber-based systems essential to the minimum operations of the economy and government. They include, but are not limited to, telecommunications, energy, banking and finance, transportation, water systems and emergency services, both government and private.

Best practices suggested by US implementation and the World Economic Forum stress key success factors in making this infrastructure more secure: commitment from the government's leader, a holistic approach and involvement of all relevant parties.

At the national level, policy-makers must create a national agenda, in order to ensure a concerted effort. Management of the key critical infrastructure operators then need to turn policy into implementation. In highly regulated environments like financial markets, rules and regulations play a critical role in ensuring that policies are implemented appropriately and adequately.

There are three key questions to address in implementation. First, have we done enough to secure our own critical infrastructure? Second, have we done enough to ensure the operational capability of the critical infrastructure on which we depend? Finally, has our country done enough to protect its critical infrastructure in the interests of its people?

In order to ensure business continuity, The Stock Exchange of Thailand has spent enormous efforts and resources over the past few years to upgrade backup computing facilities and modernise mission-critical systems. The Stock exchange of Thailand will soon unveil its next-generation trading system, dubbed the Advanced Resilient Matching System. Its goal is to minimise the chances of system unavailability and shorten recovery time.

However, a single organisation alone cannot make the whole industry resilient, and concrete plans and actions are yet to be seen. All parties in the financial industry, including the Finance Ministry, the Bank of Thailand, the Securities and Exchange Commission, commercial banks and securities companies, should come together to make an orchestrated effort.

Often, risk-management measures are associated with overhead or non-revenue-generating expenses. However, there is another side to them.

The introduction of the Secure Financial Transaction Infrastructure (SFTI), a network that connects most major US stock markets and allows their members to gain access to the markets through a single connection, has created an entirely new business.

The SFTI generates revenue and even creates a competitive advantage for its owner, NYSE Euronext. With the SFTI expanding beyond the US, NYSE Euronext is able to make its services and products pervasive globally with minimal marginal cost. It has become a crucial tool for NYSE Euronext in redefining its business in a global context.

The importance of managing critical infrastructure is no longer a question. It is now time for us all to act to help Thailand become more resilient.

Chaiyoot Chamnanlertkit is executive vice president in charge of information-technology infrastructure at the Stock Exchange of Thailand. E-mail: chaiyoot@set.or.th.