# Presentation: 223668

## Enhanced Security Through Human Error Awareness

- ESTHER

- PNNL-SA-42136

## Tracking aSecurity Event

*A Security Event Occurs*

## Tracking aSecurity Event

*It Is Identified and Categorized*

## Tracking aSecurity Event

- Identify &
- Categorize

*A Preliminary Report to DOE Is Made*

## Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

*A Full Inquiry Is Begun*

## Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

*Impact Is Assessed, Mitigation Begun*

## Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- TakeMitigativeAction

*Direct Cause and**Contributing Factors Are Identified*

## Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- TakeMitigativeAction

*Internal, and...         External (ITAC) Documentation*

## Tracking aSecurity Event

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- TakeMitigativeAction

*Resulting in Corrective**Actions and...*

*...**Assessment**of Patterns**and Trends*

## Tracking aSecurity Event

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- TakeMitigativeAction

*Corrective Actions to Prevent Recurrence*

## Tracking aSecurity Event

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- TakeMitigativeAction

*Lessons Learned Are Distributed in DOE*

## Tracking aSecurity Event

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- Distribute Lessons Learned

- TakeMitigativeAction

*...**to Prevent the Likelihood of Similar Occurrences Elsewhere*

## Tracking aSecurity Event

- Distribute Lessons Learned

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- TakeMitigativeAction

*Your role in the**incident inquiry **process is a****critical link ****in the****chain**** of incident **reporting, inquiry, documentation and analysis that supports the goal of reducing  the number of security incidents across the DOE complex.*

## Tracking aSecurity Event

**You Are**
**Here**

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- PreventSimilar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

- Reporting

- Distribute Lessons Learned

## Tracking aSecurity Event

**You Are**
**Here**

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- PreventSimilar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

- Reporting

- Inquiry

- Distribute Lessons Learned

## Tracking aSecurity Event

**You Are**
**Here**

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- Prevent Similar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

- Reporting

- Documentation

- Inquiry

- Distribute Lessons Learned

## Tracking aSecurity Event

**You Are**
**Here**

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- PreventSimilar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

- Reporting

- Analysis

- Documentation

- Inquiry

- Distribute Lessons Learned

## Tracking aSecurity Event

- Distribute Lessons Learned

**You Are**
**Here**

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- PreventSimilar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

- Reporting

- Analysis

- Documentation

- Inquiry

- Lessons Learned

## Tracking aSecurity Event

- Distribute Lessons Learned

- Tracking aSecurity Event

- Identify &
- Categorize

- PreliminaryReport to DOE

- FullInquiry

- AssessImpact

- Assess DirectCause &Contributions

- DocumentIMI 1, 2, 3via ITAC

- Document
- Non Incidents
- & IMI 4’s
- Internally

- AssessPatterns &
- Trends

- Develop
- Corrective
- Actions

- Prevent Recurrence

- PreventSimilar Occurrences Elsewhere

- TakeMitigativeAction

**Event**

**ESTHER:****Enhanced Security Through Human Error Reduction**