Chemical Vulnerability

1
Chemical Vulnerability Security

• SOCMASecurity Vulnerability Analysis
• Methodology and Model

2
Traditional Risk Assessment

• Risk is the likelihood that an undesirable event
  will take place
• For chemicals
• Risk ? (H, L) , where
• H Hazard
• L Likelihood

3
Attractiveness Likelihood

• Attractiveness is the feature or features a site
  possesses that would make it a desirable target
• Attractiveness is a major part of the likelihood
  that a given facility would be selected as a
  target
• Potential hazards, consequences, existing
  security measures and attractiveness are all
  interrelated

4
Surrogate for Likelihood

• Attractiveness
• Intent Motivation
• Ease of planning
• Likelihood of adversary success
• Unforeseen Circumstances
• Not necessarily in the intent or motivation
• Unintended consequences
• Factors adversaries do not know or anticipate
• Security systems, intelligence, mitigation, etc.
• Not part of the plan, but still part of likelihood

5
Risk in the Context of Vulnerability

• Risk ? (H, A, Cu) , where
• H Hazard
• A Attractiveness
• Cu Unforeseen Circumstances

6
Security Vulnerability Analysis Approaches

• Scenario-based Approach
• Geared for fixed-risk sites
• Threat level may be fixed or variable
• Use attack and what-if scenarios to determine
  vulnerability
• Asset-based Approach
• Geared for fixed- variable-risk sites
• Threat level is fixed
• Attractiveness is focus

7
Using Professional Judgment

• Models can only go so far
• You must use professional judgment and common
  sense
• Is ethylene oxide really an issue?
• How about anhydrous ammonia?
• Scenarios worst-case vs. probable
• Effectiveness of countermeasures
• Reality vs. vendor infomercials

8
SOCMA Model

• Tiered, asset-based approach
• Qualitative analysis for prioritization
• Does not try to cover every detail
• Computer-based model allows for immediate
  feedback iterative process

9
SOCMA Model

• 3 Tiers
• Prescreen
• Vulnerability Screen
• Comprehensive Assessment
• Factor Areas
• Chemical Hazards
• Site Attractiveness
• Potential Consequences
• Existing Security Practices

10
Model Outputs

• Qualitative numerical system
• 1 4, with 1 being lowest
• Use output to bin into low, medium or high level
  of priority
• Factors are weighted
• Automatic documentation of analysis
• It is OK to have a high priority

11
Site Form
12
Vulnerability Screen Form
13
Hazards Form
14
Attractiveness Form
15
Consequences Form
16
Security Form
17
Conclusion

• Not all facilities are the same
• Cookie-cutter approach doesnt work
• OK to combine several approaches
• OK to use several different tools
• Common sense and professional judgment cannot be
  replaced by a model
• Questions?