# Presentation: 223669

## RISK MANAGEMENT

*A systematic process designed to develop rational and cost effective physical security program strategies to protect critical facility assets.*

## PURPOSE OF RISK MANAGEMENT

*Select countermeasures appropriate to the level of risk that management is willing to accept.*

## PROCEDURES OF RISK MANAGEMENT

*1)  Identify assets to be protected.*
*2)  Assess assets.*
*3)  Assess threats.*
*4)  Assess vulnerabilities.*
*5)  Assess risks.*
*6)  Determine countermeasures options and estimate costs.*
*7)  Make risk management decisions.*

## IDENTIFY ASSETS

*Material**	**	**Intellectual Property*
*Equipment**	**	**Reputation*
*Facilities**	**	**Personnel*
*Processes**	**	**Records*

## ASSESS ASSETS

*What is the impact of loss, damage, compromise, or interruption of operations?*
*What does the facility stand to lose?*
*What does an adversary stand to gain?*
*What is the impact of loss on national security?*
*What is the potential impact on peoples’ lives?*
*What is the cost of replacement or repair?*
- 	*Prioritize according to overall impact.*
*	**Assign weighted scores.*

***And they can be:***
*Insiders*
*Outsiders*
*Both (Collusion)*

*Political Activists*
*Drug/Alcohol Impaired*
*Mentally Unstable*
*Disgruntled*
*Mischief Makers*

## ASSESS THREATS

***Who are the adversaries?***
*Terrorists*
*Anarchists*
*Extremists*
*Fanatics*
*Criminals*

*Revenge*
*Labor unrest*
*Competition*
*Greed*
*Vandalism*
*Ego*
*Curiosity*
*Opportunity*
*No discernible motive*

## ASSESS THREATS (CONT.)

***What are their motives or goals?***
*Assassination*
*Extortion*
*Destruction of military assets*
*Sabotage*
*Espionage*
*Destruction of vital equipment*
*National harm*
*Propaganda*
*Theft*
*Perceived right*

- ASSESS THREATS (CONT.)

***What are their characteristics?***
*Knowledgeable, skilled, and well equipped.*
*Use of sophisticated penetration aids and methods.*
*Highly organized.*
*Dedicated.*
*Alone or in groups.*
*Familiar with security systems and operations.*

*Stay-behind.*
*Plant covert devices.*
*Stealth.*
*Arson.*
*Diversionary tactics.*
*Stand-off surveillance.*

## ASSESS THREATS (CONT.)

***What are their methods?***
*Forcible entry.*
*Covert entry (in collusion with insider).*
*Authorized entry (insider).*
*Extortion of insider.*
*Unescorted walk-in.*
*Bypass entry controls.*
*Technical spoofing or jamming.*

## ASSESS THREATS (CONT.)

***Adversarial Analysis:***
*Technically feasible to defeat.*
*Opportunity.*
*Incentive.*
*Specific to each asset.*
*Assign weighted score to each feasible threat for each asset.*
*Select worst case score for each asset.*

## ASSESS VULNERABILITIES

*What weaknesses could be exploited to result in loss, damage, compromise, or disruption?*
*Determine functional requirements of the physical security system.*
*Assess physical, technical, and operational aspects of the site.*

- ASSESS VULNERABILITIES (CONT.)

***Physical Aspects***
*Perimeter barriers*
*Building construction and layout*
*Facility layout*
*Access roads*
*Response vehicles and equipment*

## ASSESS VULNERABILITIES (CONT.)

***Technical Aspects***
*Existing physical security systems and equipment*
*Communications*
*Power and signal distribution infrastructure*
*Lighting*

## ASSESS VULNERABILITIES (CONT.)

***Operational Aspects***
*Personnel*
*Concept of operations*

## ASSESS VULNERABILITIES (CONT.)

***Concept of Operations:***
*Pre-planned, integrated operation of:*
*Personnel*
*Procedures*
*Equipment*
***First:******	****Delay,**	**	**	****Then:  ****Deter,*
*	**	**Detect, and**	**	**	** Detain, or*
*	**	**Determine**	**	**	** Destroy*

## ASSESS VULNERABILITIES (CONT.)

***Location of Facility:***
*High threat area*
*Nearness of outside human activity*
*Accessibility of facility*
*Proximity of other building*
*Nearness of response forces*
*Vehicle access roads*

## ASSESS VULNERABILITIES (CONT.)

***Measure of Effectiveness of existing security system --- Timely Detection.***
***Timely Detection --- Minimum cumulative probability of detection while enough time remains to respond***
_*Identify adversary paths to target*_
*What deterrents must adversary overcome?*
*How much delay time do they provide?*
*What is the probability of detection?*

## ASSESS VULNERABILITIES (CONT.)

***Adversary is successful if:***
*He (she) is quicker than response forces.*
*(Detection is not a concern.)*
*He (she) escapes detection.*
*(Time is not a concern.)*

## ASSESS VULNERABILITIES (CONT.)

***ASSESS  ****(Analytical System and Software for Evaluating Safeguards and Security)*
***EASI  ****(Estimate of Adversary Sequence Interruption)*
***SAVI  ****(System Analysis of Vulnerability to Intrusion)*

## ASSESS VULNERABILITIES (CONT.)

*Assign weighted score to most feasible threat to each asset and/or that threat presenting the lowest measure of effectiveness (timely detection).*

## ASSESS RISKS

***The level of risk is specific to each asset.***
***Up to this point, we have:***
*Identified assets,*
*Assessed assets,*
*Assessed threats, and*
*Assessed vulnerabilities.*

## ASSESS RISKS

*Now we must consider the probability of occurrence of an adversarial action.*
***PROBABILITY = THREAT  X  VULNERABILITY***
*Worst case threat to each asset.*
*Worst case vulnerability of that asset.*

**SEVERITY OF IMPACT**

**PROBABILITY OF OCCURRENCE**

## ASSESS RISKS (CONT.)

***RISK = IMPACT  X  PROBABILITY***

## ASSESS RISKS (CONT.)

*Prioritize assets according to severity of impact of loss, damage, compromise, or disruption of operations.*
*Select quantified (scored) worst case threat to that asset.*
*Select quantified (scored) worst case vulnerability to that asset.*
*Calculate probability of occurrence.*
*Calculate risk.*

## DETERMINE COUNTERMEASURES OPTIONS

***Consider all of the options.***
*Do nothing*
*Upgrade existing system*
*Augment existing system*
*Replace existing system*
*Modify concept of operation*
*Retrain personnel*
*Re-equip personnel*
*Relocate assets*
*Re-evaluate physical security objectives*

## DETERMINE COUNTERMEASURES OPTIONS

***Consider costs of countermeasure options:***
*Purchase or development*
*Installation and test*
*Training*
*Operation*
*Maintenance and logistics*
*Life expectancy*
***Perform trade-off studies and cost-benefit analyses***

## MAKE RISK MANAGEMENT DECISIONS

*Willing to accept cost of countermeasures*
*or*
*Willing to accept consequences of loss*

**Assess**
**Assets**

**Assess**
**Threats**

**Assess**
**Vulnerabilities**

**Assess**
**Risks**

** ****Determine Countermeasure Options**

**Make Risk**
**Management**
**Decisions**

**Identify**
**Assets**

**Cost Analysis**

** ****Benefit Analysis**

## Slide 29