Vulnerability Assessment Strategy, Design, and Mitigation VASDM

1
Vulnerability Assessment Strategy, Design, and
Mitigation(VASDM)
2
VASDM Development and Delivery
The Texas AM University System
Texas Engineering Extension Service (TEEX)
3
VASDM

• Discuss crime and terrorism as it affects the
  company operations today and the consequences of
  Chemical, Biological, Radiological, Nuclear and
  Explosive (CBRNE).

4
VASDM

• Course Objective
• Upon completion of this course the participants
  will be able to conduct a threat-based
  vulnerability assessment that will enable them to
  create and implement effective solutions for the
  design of an effective physical security program.

5
VASDM

• Course Overview
• One of four security courses under development
• Determines the basis for determining threats.
• Identifying critical assets.
• Development of a threat matrix.
• Conduct a vulnerability assessment.
• Define and prioritize security needs

6
(No Transcript)
7
Introduction To The Security Assessment Process
8
Terminal Objective

• At the conclusion of this module the participants
  will understand the need for, and processes by
  which the security assessment is conducted.

9
Enabling Objectives

• Discuss the need for a security assessment
  process
• Identify the components of the security
  assessment process
• Explain risk assessment, identify organizational
  assets that require protection, and evaluate
  general threats against those assets
• Explain vulnerability assessment
• Discuss needs assessment and its role in the
  security assessment process
• Describe how the security goals and objectives of
  the organization influence mitigation strategy

10
Need for Security

• Physical security integrates with company
  operations
• Minimizes loss of company assets
• Focuses on protecting specific assets from
  defined threats
• Level of protection provided without interfering
  with company production or services

11
Security Assessment Process
Mitigation Strategy
Continuous Review Process
Continuous Review Process
Needs Assessment
Needs Assessment
Needs Assessment
Needs Assessment
Security Assessment
Security Assessment
Security Assessment
Vulnerability Assessment
Current Security Posture
Security Gaps
12
Risk Assessment

• Goal is to protect assets
• Employees
• Intellectual property
• Facilities/infrastructure
• Manufacturing Hardware
• Software
• Currency
• Inventory
• Corporate Reputation

13
Risk Assessment

• Asset Identification
• Consequence of loss determines security system
  functionality
• List company assets requiring protection
• Impact to company is evaluated

14
Risk Assessment

• Asset Evaluation
• Identifies critical assets by
• Impact to company
• Direct cost
• Replacement cost
• Asset criticality

15
Risk Assessment

• Threat Evaluation
• Process by which the threat environment is
• defined for the locale where assets are located

16
Perspective on Security

• Threat Elements
• Known
• Potential

17
Risk Assessment

• Threat Evaluation
• Name
• Type
• Motivation
• Method of Operations
• Recent activity
• Intent
• Priority

18
Vulnerability Assessment

• Vulnerability Assessment
• Evaluates security strengths and weaknesses
• Checklist provides guidance for the minimum areas
  to assess
• Conducted as the environment, threat or assets
  change

19
Vulnerability Assessment

• Security Posture
• Existing condition of security plan
• Enhanced by conducting the Vulnerability
  Assessment

20
Mitigation Strategy

• Security Strategy
• Connects physical security system to everyday
  operation
• Prioritizes mitigation effort
• Vulnerability Assessment Tool (VAT)

21
Summary

• An effective security assessment provides
• Identification of assets
• Determining threats and motivations
• Vulnerability process framework
• Mitigation strategy

22
(No Transcript)
23
Objectives of the Physical Security
24
Terminal Objective

• At the completion of this module participants
  will be able to discuss the objectives of a
  physical security system.

25
Enabling Objectives

• Participants will be able to
• Define the types of threats
• Discuss threat information resources
• Discuss threat evaluation factors
• Discuss CBRNE Attack Methodologies
• Identify the objectives of a physical security
  system
• Explain Crime Prevention Through Environmental
  Design
• (CPTED)

26
Security Strategy Process
Mitigation Strategy
Continuous Review Process
Continuous Review Process
Needs Assessment
Needs Assessment
Needs Assessment
Needs Assessment
Security Assessment
Security Assessment
Security Assessment
Vulnerability Assessment
Current Security Posture
Security Gaps
27
Physical Security

• Introduction to Threat

28
Physical Security

• Threats Two Categories
• Human Natural
• Criminals
  Tornadoes
• Vandals
  Hurricanes
• Protesters
  Earthquake
• Terrorist
  Snow

29
Risk Assessment

• Threat Evaluation
• Identifies human threat by
• Name
• Type
• Motivation
• Method of Operations
• Recent activity
• Intent
• Priority

30
Physical Security

• Threat Types
• Criminals
• Vandals
• Extremist
• Protestors
• Terrorist

31
Physical Security

• Threat Motivation Categories
• Ideological
• Economic
• Personal

32
Physical Security

• Objectives of the Physical Security System

33
Physical Security

• What is Physical Security?
• Measures designed to safeguard personnel, prevent
  unauthorized access to equipment, material,
  information, and to prevent sabotage, espionage,
  damage and theft.

34
Physical Security

• Three Components of Physical Security
• Security Plan
• Security Equipment
• Personnel

35
Physical Security Objectives
Detect
Delay
Response
Assess
Deter
Communication To response Force Deploy
response force
Intrusion Alarms Alarm Assessment Security Force
Barriers Response Force
36
Physical Security

• Crime Prevention Through Environmental
• Design

37
Physical Security

• CPTED
• Shifts focus from target hardening to crime
  prevention

38
Summary

• Physical Security Planning involves
• Understanding the objectives of physical security
• Identification of the threat, motivations and
  tactics
• Incorporating CPTED in security planning

39
(No Transcript)
40
Protection of Building Systems
41
Terminal Objective

• At the completion of this module, participants
  will
• be able to describe the vulnerabilities of
  building
• systems and apply appropriate mitigation
  applications

42
Enabling Objectives

• Describe the design, vulnerabilities, and
  mitigation of
• Power
• Water
• Information technology (IT)
• Heating, ventilation, and air conditioning (HVAC)

43
Power

• Operations rely on power to operate systems
  within a facility. Some of these systems are
• HVAC
• Security
• Internal conveyance
• Communications systems
• Computers

44
Power

• Criticality
• Manufacturing
• Medical Facilities
• Governmental Facilities
• Educational Venues

45

• Water Systems

46
Water

• Water considerations
• Human consumption
• Fire suppression
• Waste and sewage disposal
• Manufacturing processes
• Decontamination

47
Water Supply Attack Points

• Reservoirs
• Building Supply lines
• Water/waste water treatment plants
• Water tanks
• Vendor water

48
Information Technology Systems(IT)
49
Sensitive IT Data

• Financial data
• Employee information
• Work schedules
• Security codes
• Access codes
• Remote monitor feeds
• Building controls

50
IT Protection

• Firewalls
• Bot nets and phishing
• Sniffer software
• Encryption
• Virus protection
• Passwords
• Backup files
• Wireless Access

51

• Heating, Ventilation and Air Conditioning (HVAC)
  Systems

52
HVAC Unit
53
HVAC Vulnerabilities
54
(No Transcript)
55
Uses of Positive Air Pressure

• Shelter-in-place with positive pressure
• Emergency exit routes with positive pressure

56
Dedicated AHU Areas

• Do not share return-air plenums
• Should be kept at negative pressure to the rest
  of the building, but positive to the outside air
• Should be a relationship between AHU areas,
  facility layout, and layers of security control

57
Filters

• Clean or new filters are more efficient and cause
  less reduction of air pressure
• Particles accumulating on a filter augment the
  filtering process but reduce plant efficiency
• Maintenance of filters is important to WMD
  mitigation
• Chemical agents typically 1 to 5 microns
• Biological agents typically 1 to 7 microns

58
HVAC in a WMD Scenario

• Control plan should be incorporated into an
  emergency response plan
• Controls, intakes, exhausts, and mechanical rooms
  should be isolated from the public

59
HVAC System Assessment

• When assessing HVAC systems, the following
• should be considered
• Are heavy traffic areas single zoned?
• Are airflow and pressure controlled?
• Damper and louver response times
• Is there an HVAC control plan w/emergency
  operations included?
• Is the emergency response plan tested?

60
HVAC Mitigation Strategies

• Some mitigation steps for lessening the effects
  of Chem/Bio exposure are
• Relocating intake vents
• Use of physical barriers
• Vertically extending intakes
• Provide buffer zone for intakes/controls

61
Chemical Detection

• Two main methods of delivery
• Aerosol
• Liquid

62
Chemical Detection

• Placement at intakes
• Efficiency of detection devices will be based on
  the expected need

63
Chemical Detection

• Detection Instruments
• Advanced Chemical Detector Alarm (ACADA)
• Joint Chemical Agent Detector (JCAD)
• Must be retrofitted to current HVAC
• Installed at intakes to detect
• Nerve agents
• Blister agents
• Blood agents

64
Biological Detection

• Biological Detection
• Require real time analysis
• Must have significant stand-off distance
• Must exhibit high degree of sensitivity
• Require large volumes of air

65
Radiation Detection

• Ionization Chambers/Geiger counters
• Sealed cylinder w/electrode configurations
• Gases introduced to cylinder
• Allows electrodes to attach allowing radiation
  reading

66
Summary

• Building systems should be an important part of
  any assessment and should include
• Power
• Water
• Information Technology (IT)
• Heating, Ventilation and Air Conditioning (HVAC)
• Chemical, Biological and Radiological detection

67
(No Transcript)
68
Security Barriers and Support Systems
69
Terminal Objective

• At the completion of this module, participants
  will be able to describe security barriers and
  their supporting elements

70
Enabling Objectives

• Explain types of barriers
• Describe lighting systems and lamps and how
  they support security barriers
• Identify locking devices and describe an
• Effective key control system

71
Physical Security System

• Aimed at preventing undesirable events and
  consists of
• Human element
• Physical safeguards
• Procedures
• Efforts must complement each other

72
Physical Security System

• Physical Security System Elements
• Combination of devices
• Bollards
• Barriers
• Lighting
• Sensors
• Locks, safes, vaults

73
Physical Security System

• Procedural Element
• Policies
• Security Management
• Incident Reports
• Plans
• Normal operations
• Emergency response operations
• Procedures
• Standard operations
• Access control
• Vehicle searches

74
Physical Security System

• Plans must be comprehensive
• Access Control
• Intrusion Detection Systems (IDS)
• Workplace Violence
• Bomb Threats

75
Physical Security System

• Procedures
• Standard Operational Procedures
• Mobile Patrol Duties
• Key Control
• Pass and Badge Issuance

76
Physical Security System

• Physical Security Element
• System considerations
• Site Planning
• Standoff Distance
• Access Control
• Signage
• Parking
• Docks/Services
• Lighting/Utilities

77
Protective Barriers

• Barrier
• Natural or constructed obstacle to effect the
  movement of persons, animals, vehicles or
  materials
• It defines physical perimeter and delays or
  prevents ingress or egress

78
Protective Barriers

• Barrier Considerations
• Cost
• Size- kept to minimum
• Compartmentalization
• Others

79
Protective Barriers

• Controlling vehicular and pedestrian traffic
  flow
• Providing entry-control points
• Defining a buffer zone for more highly classified
  areas
• Precluding visual compromise by unauthorized
  individuals
• Delaying forced entry
• Protecting individual assets

80
Protective Barriers

• Security Concepts
• Security In Depth
• Designed use of a series of barriers in a
  protective plan to lessen penetrations and
  provide reaction time
• Interrupt planning and targeting
• Defeat surveillance and eavesdropping

81
Protective Barriers

• Vehicle Barriers General Concept
• Approach Zone
• Identify Vehicle
• Inspection/Interception Zone
• Vehicle Inspection
• Personnel ID/Verification
• Blast Zone
• Protects against effects of explosion
• Safety Zone
• Protect assets from attacks

82
Protective Barriers

• Vehicle Barriers
• Metal guard rails
• New Jersey Barriers
• Bollards
• Commercial Impact barriers

83
Protective Barriers

• Building Components
• Roofs
• Exterior Walls
• Interior Walls
• Floors
• Ceilings

84
Protective Barriers

• Building Evaluation
• Building assessment
• Review of as-built drawings

85
Protective Barriers

• Building Evaluation
• Facility use
• Occupancy
• Tenants

86
Security Lighting

• Benefits
• Reduced vandalism, burglary, robbery and assault
• Reduced fear of crime
• Reduces possible liability to owner/operator
• Increased productivity and supervision
• Greater utilization of public area

87
CCTV Problems

• Back lighting
• Light changes during the day
• Distance from the subject and/or action
• Glare or reflection
• Camera angle correct

88
Key and Lock Systems
89
Key and Lock

• Most acceptable safeguard in security
• Only delaying devices
• Degree of protection measured by amount
• of resistance
• Regulations specify type of locks for facility
• or container

90
Key and Lock

• Types of Devices
• Cylindrical
• Dead Bolt
• Mortise
• Drop Dead Bolt

• Rim Cylinder
• Unit Locks
• Mechanical
• Combination
• Padlocks

91
Files, Safes Vaults

• Provides last line of defense
• Designed for protection against fire or burglary
  
• or combination
• Items considered for storage
• Proprietary information
• Precious metals
• Process instructions

92
Summary

• Barriers
• Fencing, Walls, Windows, files, safes and vaults
• Lighting
• Continuous, stand by, emergency, and moveable
• Key Control
• Custodian
• Standardization

93
Security SystemsandAccess Control Planning
94
Security Systems and Access Control

• Terminal Objective
• At the end of this module the participants will
  be able to analyze the relationship between the
  security system, the access control system, the
  intrusion detection system, and the physical
  security system design.

95
Enabling Objectives

• At the end of this module the participants will
  be able to
• Describe a typical Electronic Security System
  (ESS)
• Describe a typical integrated ESS and discuss
  integration issues
• Describe the function of the access control system

96
Enabling Objectives (cont.)

• Compare and contrast intrusion detection systems
• Describe components of a Closed Circuit
  Television system
• Discuss systems of controlling packages and
  consumables

97
Electronic Security Systems

• Integrated security system with
• Access control
• Intrusion detection
• CCTV for assessing alarms

98
Electronic Security Systems

• ESS Functions
• Provides early warning of attempted or
  successful intrusion
• One or more layers of detection
• Isolate the asset
• Control entry, exit and material and personnel
• Public address systems
• Life Safety

99
System Integration
100
Access Control

101
Access Control

• Access Control
• Protect all assets against loss by permitting or
  denying entrance into, within and from a
  protected area.
• Denies or grants access rights as to place and
  time or a combination of both

102
Access Control

• Degree of security and control depends on the
  nature, sensitivity and importance of the
  interest
• Controlled
• Limited
• Exclusion

103
Access Control

• Exclusion area
• Restricted area containing main security
• interest

Controlled Area
Limited Area
Exclusion Area
104
Access Control

• The access control system must be
• Reliable
• Operator-friendly
• Resistive to defeat
• Rugged and long-lived
• Maintainable

105
Access Control

• Access Control System Components
• Hardware
• Software
• Field Processors
• Biometric Devices
• Access Credentials

106
Biometric

• Advantages
• Difficult to fool the reader
• Provides higher level of assurance
• Disadvantages
• Natural human resistance
• Cost

107
Visitor Control

• Gates and Checkpoints
• Inspections at Entrances and Exits
• Traffic Management
• Signage
• Roving Patrols
• Decals
• Controlled parking
• Stanchions

108
Intrusion Detection

109
Intrusion Detection

• Integrated with access control and CCTV,
  intrusion detection systems basic function is to
• Notify of intrusion or penetration
• Exception based monitoring

110
Intrusion Detection

• IDS Advantage
• Automatic 24 hour protection
• Reduced Security manpower
• Increased reaction time
• Minimized security personnel risk
• Reduced likelihood of site damage
• Potentially significant deterrent

111
Intrusion Detection

• Intrusion Detection Sensor
• Active- transmit and receive signals
• - Acoustic
• - Infrared
• - Microwave
• Passive- receives signals
• - Vibration
• - Heat
• - Capacitors

112
Intrusion Detection

• Environmental Factors
• Weather
• Wind
• Rain
• Fog
• Snow

113
Intrusion Detection

• Internal Boundary Sensors

Structural Vibration
Glass Breakage
114
Closed Circuit Television (CCTV)

• CCTV Interface
• Supports alarm with visual
• Provides video/recording when IDS alarm is
  activated
• Access control

115
(No Transcript)
116
Security Assessment Process and Strategy
Development
117
Terminal Objective

• At the completion of this module, participants
  will be able to describe the process of
  conducting the vulnerability assessment,
  developing the needs assessment and developing
  the mitigation strategy.

118
Enabling Objectives

• Complete the Asset Identification
• Complete the Threat Evaluation
• Complete the Asset Threat Summary Matrix
• Complete the Vulnerability Assessment
• Perform Needs Assessment
• Develop the Mitigation Strategy

119
Security Assessment

• Process
• Identify critical assets
• Determine threats
• Summarize asset and threat evaluations
• Determine probability of occurrence
• Vulnerability checklist

120
Risk Assessment

• Probability Scale
• High
• Certain
• Highly probable
• Medium
• Moderately probable
• Low
• Improbable
• Probability unknown

121
Risk Assessment

• Probability of Occurrence
• Used to evaluate anticipated threat
• Focuses on critical/high valued assets
• Prioritizes mitigation strategy

122
(No Transcript)
123
Vulnerability Assessment

• Vulnerability Assessment Checklist
• Used to review physical security systems
• Power/Water
• IT
• HVAC
• Perimeter systems
• Access control
• Serves as a guide to ensure a minimum assessment
  is conducted

124
Needs Assessment

• Output of the Vulnerability Assessment
• Vulnerabilities are defined based on the current
  threat
• Identified gaps in physical security system
• Plans, Equipment and Training

125
Mitigation Strategy

• Goals and objective based strategy that focuses
  the mitigation of identified vulnerabilities
• Developed on line with the Vulnerability
  Assessment Tool (VAT)
• VAT provides outputs for status and deficiencies
• VAT provides tracking of mitigation progress
  including funding, task assignment, and
  completion dates

126
Vulnerability Assessment Tool
127
Vulnerability Assessment Tool
128
Vulnerability Assessment Tool
129
Vulnerability Assessment Tool
130
Summary

• Identify assets
• Identify threats
• Complete the Asset Threat Summary Matrix
• Complete the Vulnerability Assessment
• Develop the Mitigation Strategy
• Incorporating the VAT achieves standard reporting

131
(No Transcript)
132
Preparation and Conducting the Vulnerability
Assessment
133
Terminal Objective

• At the end of this module, participants will be
  able to accomplish the required preparatory
  activities and conduct a vulnerability assessment

134
Enabling Objective

• Describe the information and documents required
  to facilitate the assessment
• Conduct on-site assessment

135
Site Management

• Prior to conducting the assessment
  familiarization with the site must take place
  through acquiring the following
• Site Plans
• Current security measures in place
• Security Force Information
• Hazardous Materials On Site
• Description of Environment

136
Pre Site Visit

• Organize Documents
• Analyze collected documents
• Schedule/prepare interview questions
• Senior Management
• Operations Manager
• Building or Property Manager
• Security Manager
• Safety Manager
• Risk Manager

137
Initial Interview

• Insure POC and company staff understand
• Goals and objectives
• Determine areas to be assessed
• Obtain list of interviewees
• Supportive interviewee documents
• Agree on schedule.

138
Summary

• Preparation of the site assessment should include
  but not limited to
• Review of site plans
• Overview of management
• Security force information
• On site hazards
• Environmental
• Interview
• External support

139
(No Transcript)