Critical Infrastructure Cybersecurity
Research on technical and policy solutions to protect critical infrastructure – energy, finance, telecommunications, transport, healthcare and public services – against cyberattacks. Focus areas: incident detection and recovery in IT/OT environments, legal frameworks for identifying and classifying critical infrastructure, and public–private coordination. I am currently interning at the Cyber Lab, Adelaide University, and participating in the Locked Shields Partners Run 2025 cyber defence exercise.
Critical Infrastructure Cybersecurity
The problem
Critical infrastructure comprises the systems and assets whose disruption directly affects social and economic life and national security. Vietnam has already faced this risk in practice:
- VNDirect (March 2024): all data encrypted; securities trading disrupted for a week.
- PVOIL (April 2024): invoicing system paralysed, halting the fuel supply chain; full recovery took about a week.
- Vietnam Post (June 2024): ransomware disrupted postal services across the national network.
In 2025, information systems in Vietnam recorded around 552,000 cyberattacks. The number of attacks fell by nearly 20%, yet the share of organisations reporting damage rose to 52.3%. Nearly half of surveyed organisations have no cybersecurity staff.
Globally, the threat has shifted from financially motivated attacks to strategic ones: a large-scale blackout in Ukraine (2015, over 230,000 people affected); the six-day shutdown of Colonial Pipeline, which supplies 45% of the US East Coast’s fuel (2021); and Volt Typhoon, a state-sponsored group that remained hidden for at least five years inside US telecommunications, energy and water infrastructure, pre-positioned for disruption (advisory issued 2024).
Legal frameworks: Vietnam and the world
- Vietnam: The 2018 Law on Cybersecurity defines “information systems critical to national security” – Vietnam’s statutory equivalent of critical infrastructure – by the consequences of their compromise, covering national systems in energy, finance, banking, telecommunications, transport and healthcare, as well as automated control systems at critical facilities. In parallel, the 2015 Law on Network Information Security classifies information systems into five security levels. Two frameworks, two regulators.
- Australia: The Security of Critical Infrastructure Act 2018 covers 11 sectors and 22 asset classes, extending to food and grocery, higher education, data centres and space technology.
- United States: 16 critical infrastructure sectors.
- European Union: 18 sectors under the NIS2 Directive.
Common ground: “critical” is defined by consequence, not technology.
The difference: Vietnam’s scope is narrower and its governance more fragmented.
Research directions
Technical
- Network segmentation and access control for converged IT/OT environments.
- Monitoring and anomaly detection in industrial control systems (ICS/SCADA) that cannot be taken offline for patching.
- Data protection and software supply chain security.
- Incident response and recovery under conditions of legacy infrastructure and limited resources.
Policy and governance
- Criteria for identifying and classifying critical infrastructure, and mechanisms for keeping the register current.
- Allocation of responsibility, incident reporting obligations and threat intelligence sharing between government and infrastructure operators.
- Policies to build and retain cybersecurity talent in the public sector.
- Selective comparison with Australian, US and EU models to develop proposals suited to Vietnam’s conditions.
Practical experience
- PCI DSS compliance consulting (2021–2025) for major banks and financial institutions in Vietnam: gap assessments, compliance roadmaps and support in implementing payment card data protection controls to international standards.
- ISO/IEC 27001 assessments (2021–2025) for organisations in Vietnam: evaluating information security management systems and identifying risks and control gaps against the standard.
- Internship at the Cyber Lab, Adelaide University (Australia): working on attack and defence scenarios in simulated critical infrastructure environments.
- Locked Shields Partners Run 2025: the partner edition of Locked Shields, the world’s largest live-fire cyber defence exercise, organised by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). Teams defend the critical infrastructure of a fictional nation – power, telecommunications, finance, command and control – under sustained attack, while handling legal, media and strategic decision-making scenarios.
Objective
To develop feasible technical and policy recommendations for Vietnam: critical infrastructure that is clearly identified, with clear accountability, defensive capability, and the resilience to keep operating under attack.
Data current as of October 2026. Sources: Law on Cybersecurity 2018; National Cyber Security Association of Vietnam (January 2026); ASD Annual Cyber Threat Report 2024–25; CISA; CCDCOE.