# Presentation: 116380

## Vulnerability and Risk Assessments

**Presented to “Enhancing the Security of Dangerous Pathogens” Workshop**
**10/18/00**

## How Much Is Enough?

**How Much Is Enough?**

## Dept. Of Energy Consequence Factors

**Normalizes consequences of theft or sabotage**
**Range 0 to 1.0**
**Tables for theft (examples)**
**weapons (1.0)**
**plutonium metal (0.8)**
**plutonium nitrate solutions (0.4)**
**low enriched uranium solutions (0.1)**
**Tables for sabotage**

## Dam Project Fault TreeTop Level

- Dam Cannot Perform One of Its Missions

- Loss of Commercial Navigation on River

- Create a Flood

- Loss of Hydro-electrical Generation

- Cause Environmental/ Ecological Damage

*Station Service:*
- Loss of

*Transmission:*
*(Switchyard Output to Power Grid)*
- Disable

*Transmission:*
*(Turbine to Switchyard Output)*
- Disable

*Generation of Electricity:*
- Disable

- 1

- 2

- 3

## Consequence Definitions

**Consequence Definitions**

## Nuclear Regulatory Commission Defined Threat 

**Nuclear Regulatory Commission Defined Threat **

**Outsider**
**Violent attack**
**Several well-trained personnel**
**Hand-held automatic weapons**
**Incapacitating agents and explosives**
**Theft, diversion, or sabotage goal**
**Insider assistance (passive or active)**
**Land vehicles for transportation**
**Insider**
**Employee in any position**
**Operate alone or in collusion with outsiders**
**Same attributes as above**

## Threat Statement - Example

## Probability of Adversary Attack (PA)

**Very hard to determine**
**May be .0001**** ****or .01**
**Assumed = 1.0 for DOE**
**Conditional risk**

##  Estimating Likelihood of Attack -  PA

**Targeting**

**Intention / History**

**Capability**

**Existence**

- Adversary
- targeted a
- specific
- facility or
- facilities in the area

- Adversary
- history and
- intent to
- attack
- similar
- facilities

**Yes**

**P****o ****=**** ****VERY HIGH **

- Adversary
- has resources
- to execute
- undesired
- event but no
- specific intent

- Adversary
- group exists
- but no clear
- interest in
- facility or
- facilities in
- the area

**Specify**
**Undesired**
**Event**

**Specify**
**Adversary**
**or Group**

## Design and Evaluation Process

- PPS = Physical Protection System

## Risk Analysis

**How do we know if security measures are good enough?**
- Risk (R) = PA * [1 - (PI * PN)] * C
**Probability of Interruption P(I) **
**Probability of Neutralization P(N) **
**Consequence Value (C)**
**Probability of Adversary Attack P****A**

## Reasons to Evaluate PPS Effectiveness

**Identify system deficiencies**
**Help to select system improvements**
**Allow cost vs. system effectiveness comparisons to be made**

## Adversary Path

**Path  1**

**Path  2**

## Measure of Effectiveness

**Delay time**
**Cumulative probability of detection**
**Timely detection**

## Path Analysis

_**#.  Action **__**(Probability of Detection, Delay Time)**_

**1.  Climb fence ****(0.1, 5)**

**2.  Run to building ****(0.1, 15)**

**3.  Open door ****(0.3, 20)**

**4.  Move to asset ****(0.5, 30)**

**5.  Remove asset ****(0.4, 300)**

**6.  Exit building ****(0.1, 5)**

**7.  Run to fence ****(0.3, 15)**

**8.  Climb fence ****(0.3, 5)**

**9.  Leave area ****(0.1, 7)**

## Example Analysis Results

## Adversary Sequence Diagram

## Probability of Interruption and Time Remaining after Interruption

## Joint Tactical Simulations

- JTS
- System Effectiveness Analysis

- Response Force Tactical Training

- Development of Doctrine

## Risk Analysis

**How do we know if security measures are good enough?**
- Risk (R) = PA * [1 - (PI * PN)] * C
**Probability of Interruption P(I) from computer models or table top exercises**
**Probability of Neutralization P(N) from JTS or exercises**
**Consequence Value (C) from customer**
**Probability of Adversary Attack P****A ****from customer or research**

## ?

_***Threat***_

_***Medium***_

**Low Plus:**

**Cut**
**Bridge/Jump**
**Crawl/Dig**
**Some Sensor**
**Knowledge**
**Covert**
** **

_***High***_

**Medium Plus:**

**Diversion**
**Interference**
**Sensor Capture**
**Multiple Alarms**
**Jamming**
**Multiple Intruders**

_***Red***_

**High Plus:**

**?**
** **

**Performance**
**(Cost)**

## Cost Versus Risk

## Business/Risk/Opportunity Process Output Goal

## Risk Assessment Map

**Risk Assessment Map**

## Customers/Experience

**Dept. Of Energy**
**Sites, Transportation, Planning, VA, JTS runs, FSU**
**Dept. Of Defense**
**VA and training**
**Other Federal Agencies**
**Mints, Dams, Prisons, Buildings**
**Commercial**
**Reactors, Semiconductor, Health Care**

## Summary

**Questions and Answers**

**Assessment**

**Detection**

**Analysis**