Strategies for Protecting National Critical Infrastructure Assets: A Focus on Problem-Solving

Strategies for Protecting National Critical Infrastructure Assets: A Focus on Problem-Solving......Page 3
CONTENTS......Page 11
PART 1—UNDERSTANDING THE ENVIRONMENT......Page 39
What This Book is About......Page 41
Why This Book is Important......Page 42
Who Can Benefit From This Book......Page 44
How To Use This Book......Page 45
2 ENVIRONMENTS THAT INFLUENCE THE SECURITY ASSESSMENT: Threats, Western Values, and the National Critical Infrastructure Sectors......Page 51
2.1–Environments that influence the security assessment......Page 52
The Psychology of Terrorism......Page 53
2.2–Terrorists\' long-term strategic objectives......Page 54
The Changing Face of Terrorism......Page 62
Most Dangerous Terrorist Group in the World......Page 70
Safeguarding American Values......Page 73
2.4–Demography, The American Population......Page 75
The Importance of the National Critical Infrastructure Sectors......Page 76
The Protection Challenge......Page 77
The Importance of Key Assets......Page 79
Conclusion......Page 80
2.3–America\'s values in contrast with tyranny\'s oppression......Page 74
2.5–The protection challenge......Page 78
PART II—UNDERSTANDING SECURITY ASSESSMENTS......Page 83
Security is About Minimizing Risk......Page 85
The Changing Threat Environment......Page 88
Corporate America is Adjusting to the Changing Threat Environment......Page 89
Which Security Assessment Model is Best?......Page 91
Conclusion......Page 92
The Security-Assessment Challenge......Page 93
Analysis of Several Industry Models......Page 95
FEMA Antiterrorism Design Criteria......Page 98
The S3E Security Assessment Model and Methodology......Page 99
Strategic Planning......Page 101
Reporting and Implementation Plan......Page 104
Security Operational Capabilities to Implement Expectations......Page 108
S3E Performance Measurement Criteria......Page 111
4.5–Performance measurement indicators......Page 112
4.7–S3E Levels of security standards......Page 114
S3E Probability Measurement Criteria......Page 118
 Conclusion......Page 122
4.1–Comparison of selected security assessment models......Page 96
4.2–S3E security assessment methodology......Page 102
4.3–Corporate performance strategies......Page 109
4.4–Enterprise security strategies......Page 110
4.6–Peer-wise comparison criteria......Page 113
4.8–S3E Probability of occurrence [PA] criteria......Page 119
4.9–S3E Business criticality consequence factor [C]......Page 120
4.10–S3E Probability of program effectiveness [PE] criteria......Page 121
Strategic Security Planning......Page 123
Subtask 1A—Project Mobilization and Startup Activity......Page 125
Subtask 1C—Plan, Organize, Coordinate Project Kickoff Meeting......Page 126
Subtask 1D—Co-Chair Project Kickoff Meeting......Page 127
Subtask 1E—Review Project-Management Information......Page 130
Subtask 1F—Conduct Workshops, Meetings......Page 132
Software......Page 135
Tailored Worksheets......Page 137
5.1–Worksheet 1: Contacts, Key Stakeholders, Persons Interviewed......Page 139
Documenting the Status of Program Guidance......Page 141
Conclusion......Page 145
5.2–Worksheet 2: Characteristics of Security Strategy......Page 140
5.3–Worksheet 3: Corporate Strategies & Extent Addressed......Page 142
5.4–Worksheet 4: Security Initiatives......Page 143
5.5–Worksheet 5: Review of Program & Technical Data......Page 144
6 TASK 2—CRITICAL ASSESSMENT: UNDERSTANDING THE SERVICE ENVIRONMENT......Page 147
Data Gathering......Page 148
Protecting America\'s Critical Infrastructures......Page 149
Function......Page 150
Asset and Resource Identification and Criticality......Page 151
Criticality of Assets......Page 154
Environmental Attributes and Physical Configuration......Page 155
Documenting Critical Operational Criteria and Business Values......Page 156
6.2–Worksheet 7: Defining Critical Operational Criteria & Business Values......Page 158
6.3–Worksheet 8: Facility Ranking Based on Operational Criteria......Page 159
6.4–Worksheet 9: Time Criteria......Page 160
6.5–Worksheet 10: Rank Ordering Assets......Page 161
6.7–Worksheet 12: Security Characteristics Strengths and Weakness......Page 163
Subtask 2A—Enterprise Characterization......Page 164
Subtask 2C—Security Characterization......Page 165
Conclusion......Page 166
6.1–Worksheet 6: Facility Characterization......Page 157
6.6–Worksheet 11: Asset Identification and Physical Security Characteristics......Page 162
The Design-Basis Threat Profile......Page 169
The National Critical Infrastructure Sector Threat Assessment......Page 173
Adversary Characteristics, Modes of Adversary Attack, Weapons, and Equipment......Page 174
Documenting the Design-Basis Threat......Page 175
Identifying and Documenting Adversary Characteristics by Adversary Profile......Page 176
Defining the Range and Potential Level of Malevolent Acts and Lesser Threats......Page 180
The Analysis Process......Page 183
Identifying Range & Potential Levels of Threat & Consequences of Enterprise Loss......Page 187
Subtask 3A—Review Available Enterprise Threat-Related Information......Page 190
Subtask 3B—Interface with External Key Players and Document Expectations......Page 191
Subtask 3C—Formulate Initial Threat Analyses & Preliminary Design-Basis Threat......Page 192
Conclusion......Page 193
7.1–Composition of Design-Basis Threat Profile......Page 172
7.2–Worksheet 13: Adversary Characteristics by Adversary Profile......Page 177
7.3–Worksheet 14: Modes of Adversary Attack, Weapons, and Equipment......Page 181
7.4–Worksheet 15: Assets by Adversary Attractiveness......Page 182
7.5–Worksheet 16: Range and Potential Level of Malevolent Acts and Lesser Threats......Page 184
7.6–Worksheet 17: Potential Threats by Adversary Attractiveness......Page 186
7.7–Worksheet 18: Malevolent Acts and Undesirable Events by Loss of Consequence [C] and Probability of Occurrence [PA]......Page 188
8 TASK 4—EVALUATE PROGRAM EFFECTIVENESS......Page 195
Evaluating Program Effectiveness and Accountability......Page 196
Identifying Program Shortfalls......Page 197
Profiting from Lessons Learned by Others......Page 198
Vulnerability \"Creep-In\"......Page 200
Detecting Vulnerability is a Challenge......Page 201
Measuring Program Effectiveness......Page 202
Enterprise Institutional Security Operational Capabilities......Page 203
8.1–Enterprise Security Strategies......Page 204
Assessment......Page 205
Recovery......Page 206
Principle of Timely Detection......Page 207
Principle of Timely Recovery......Page 208
Identifying and Documenting Program Effectiveness......Page 209
Measuring & Recording Status of Institutional Drivers and Performance Strategies......Page 211
8.3–Worksheet 19: Status of Institutional Drivers & Performance Strategies......Page 212
8.5–Worksheet 21: Recording Exercise Evaluation by Organizing Sector......Page 214
Subtask 4B—Status of SCADA and Distributed Control Systems......Page 215
Subtask 4D—Status of Facility Security Features......Page 216
Subtask 4E—Status of Electronic Security Systems......Page 217
Subtask 4G—Status of Information Security Program......Page 219
Subtask 4I—Status of Practical Ability to Detect, Assess, Respond to Incidents......Page 220
Subtask 4J—Status of Security Organization Structure and Management......Page 221
Subtask 4K—Status of Emergency Planning and Execution Capability......Page 222
Conclusion......Page 223
8.2–Program Exercise and Test Development Model......Page 210
8.4–Worksheet 20: Recording Status of Current Physical Security Effectiveness......Page 213
Program Analysis Offers Enterprise Decision-Makers Cost-Effective Choices......Page 225
Facility, System, and Function Characterization, Asset Identification, and the Rank Ordering of Assets......Page 228
Refining the Design-Basis Threat Profile......Page 229
Developing Workable Solutions......Page 231
Subtask 5A—Finalize and Refine Design-Basis Threat Profile......Page 234
Subtask 5D—Develop Workable Solutions......Page 235
Conclusion......Page 236
9.1 Program Analysis Model......Page 227
9.2 Risk Shifting and Threat Decision-making Model......Page 230
9.3 Worksheet 22: Recording Effectiveness of Performance Strategies [PE2]......Page 232
9.4 Worksheet 23: Security Effectiveness of Recommended Protective Measures [PE2]......Page 233
10 REPORTING SECURITY ASSESSMENT RESULTS......Page 237
Reporting Security Assessment Observations, Findings, and Recommendations......Page 238
10.2–Rough Order of Magnitude Cost Estimate......Page 244
A Quality Security Assessment Report Model......Page 245
Conducting an Internal Review of the Draft Security Assessment Report......Page 247
Incorporating Enterprise Staff Review Comments into the Final Security Assessment Report......Page 248
Other Essential Reporting......Page 249
Oral Presentations to Governing Bodies......Page 251
Subtask 6A—Develop Enterprise Security Strategies......Page 252
Subtask 6C—Make Presentations of Findings to Governing Authorities......Page 253
Subtask 6D—Project Management Reports and Data Management......Page 254
Conclusion......Page 255
10.1–Security Assessment Report Outline......Page 241
10.3–S3E Documentation Development Model......Page 246
10.4–Progress Report Outline......Page 250
PART III—TAILORING THE S3E SECURITY METHODOLOGY TO SPECIFIC CRITICAL INFRASTRUCTURE SECTORS......Page 257
11 THE WATER SECTOR......Page 261
Critical to National Interests......Page 262
An Attractive Target......Page 264
Tailoring the S3E Security Assessment Methodology for the Water Sector......Page 265
Water Challenges Facing the Security Assessment Team......Page 268
11.4–Identify Water Enterprise Customer Base......Page 269
11.6–Characterize Configuration of Water Enterprise Facilities and Boundaries......Page 271
11.13–Assess Initial Likelihood of Water Enterprise Threat Attractiveness and Likelihood of Malevolent Acts Occurring......Page 275
11.22–Refine Previous Analysis of Water Enterprise Likelihood of Malevolent Acts of Occurrence......Page 279
11.26–Develop Cost Estimate for Short- and Long-Term Water Enterprise Mitigation Solutions......Page 280
11.1–Typical Water Utility Configuration......Page 263
11.2–S3E Security Assessment Methodology for the Water Sector......Page 266
11.5–Identify Water Enterprise Commitments......Page 270
11.8–Prioritize Critical Water Enterprise Assets, in Relative Importance to Business Operations......Page 272
11.9–Determine Types of Malevolent Acts that could Reasonably Cause Water Enterprise Undesirable Events......Page 273
11.11–Identify Category of Water Enterprise Perpetrators......Page 274
11.16–Evaluate Existing Water Enterprise Interface and Relationship with Partner Organizations [PEl]......Page 276
11.20–Analyze Effectiveness of Water Security Strategies and Operations [PEl]......Page 278
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within The Water Sector......Page 281
B United States Government Water Sector Initiatives......Page 286
12 THE ENERGY SECTOR......Page 289
Electricity......Page 290
Oil and Natural Gas......Page 292
Nuclear Power......Page 294
Energy Sector Vulnerabilities......Page 296
Tailoring the S3E Security Assessment Methodology for the Energy Sector......Page 298
Dams......Page 299
Pipelines......Page 302
Task 1—Operational Environment......Page 303
12.4–Identify Energy Enterprise Customer Base......Page 304
12.8–Prioritize Critical Energy Enterprise Assets, in Relative Importance to Business Operations......Page 307
12.26–Develop Cost Estimate for Short- and Long-Term Energy Enterprise Mitigation Solutions......Page 314
12.1–Typical Power Utility Configuration......Page 295
12.2–S3E Security Assessment Methodology for the Energy Sector......Page 300
12.5–Identify Energy Enterprise Commitments......Page 305
12.7–Critical Assessment of Energy Enterprise Facilities, Assets, Operations, Processes, and Logistics......Page 306
12.9–Determine Types of Malevolent Acts that could Reasonably Cause Energy Enterprise Undesirable Events......Page 308
12.11–Identify Category of Energy Enterprise Perpetrators......Page 309
12.15–Evaluate Existing Enterprise Security Organization [PEl]......Page 310
12.16–Evaluate Existing Energy Enterprise Interface and Relationship with Partner Organizations [PE1]......Page 311
12.20–Analyze Effectiveness of Energy Security Strategies and Operations [PE1]......Page 312
12.24–Develop Short- and Long-Term Energy Enterprise Mitigation Solutions......Page 313
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within The Energy Sector......Page 316
B United States Government Energy Sector Initiatives......Page 333
13 THE TRANSPORTATION SECTOR......Page 339
Contributions to Economic Security......Page 340
Maritime Traffic......Page 341
Rail and Public Transportation......Page 342
Truck and Busing......Page 345
Threats to Aviation......Page 346
Threats to Maritime Traffic......Page 347
Threats to Rail and Public Transportation Systems......Page 353
Threats to Trucking and Busing......Page 354
Aviation Challenges......Page 355
Maritime Traffic Challenges......Page 358
Trucking and Busing Challenges......Page 359
13.2–Identify Transportation Enterprise Mission Goals & Objectives......Page 360
13.3–Identify Transportation Enterprise Customer Base......Page 361
Task 4—Evaluate Program Effectiveness......Page 363
13.25–Develop Cost Estimate for Short- and Long-Term Transportation Enterprise Mitigation Solutions......Page 371
13.1–S3E Security Assessment Methodology for the Transportation Sector......Page 356
13.4–Identify Transportation Enterprise Commitments......Page 362
13.6–Critical Assessment of Transportation Enterprise Facilities, Assets, Operations, Processes, and Logistics......Page 364
13.8–Determine Types of Malevolent Acts that could Reasonably Cause Transportation Enterprise Undesirable Events......Page 365
13.10–Identify Category of Transportation Enterprise Perpetrators......Page 366
13.14–Evaluate Existing Enterprise Transportation Security Organization [PE1]......Page 367
13.15–Evaluate Existing Transportation Enterprise Interface and Relationship with Partner Organizations -[PE1]......Page 368
13.19–Analyze Effectiveness of Transportation Security Strategies and Operations [PE1]......Page 369
13.23–Develop Short- and Long-Term Transportation Enterprise Mitigation Solutions......Page 370
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within the Energy Sector......Page 373
B United States Government Energy Sector Initiatives......Page 409
14 THE CHEMICAL AND HAZARDOUS-MATERIALS SECTOR......Page 417
Chemical and Hazardous-Materials Criticality to National Interest......Page 418
14.1–Number and Percent or Risk-Management-Plan-Covered Processes by Industry Sector......Page 419
Vulnerabilities......Page 420
Tailoring the S3E Security Assessment Methodology for the Chemical and Hazardous-Materials Facilities......Page 421
Task 1—Operational Environment......Page 423
14.4–Identify Chemical and Hazardous-Materials Enterprise Customer Base......Page 426
Task 5—Program Analyses......Page 429
14.26–Develop Cost Estimate for Short- and Long-Term Chemical and Hazardous-Materials Enterprise Mitigation Solutions......Page 437
14.2–S3E Security Assessment Methodology for the Chemical and Hazardous-Materials Sector......Page 424
14.5–Identify Chemical and Hazardous-Materials Enterprise Commitments......Page 427
14.8–Prioritize Critical Chemical and Hazardous-Materials Enterprise Assets, in Relative Importance to Business Operations......Page 428
14.9–Determine Types of Malevolent Acts that could Reasonably Cause Chemical and Hazardous-Materials Enterprise Undesirable Events......Page 430
14.11–Identify Category of Chemical and Hazardous-Materials Enterprise Perpetrators......Page 431
14.15–Evaluate Existing Enterprise Chemical and Hazardous-Materials Security Organization [PE1]......Page 432
14.16–Evaluate Existing Chemical and Hazardous-Materials Enterprise Interface and Relationship with Partner Organizations [PE1]......Page 433
14.17–Evaluate Existing Chemical and Hazardous-Materials SCADA and Security System Performance Levels [PE1]......Page 434
14.20–Analyze Effectiveness of Chemical and Hazardous-Materials Security Strategies and Operations [PE1]......Page 435
14.23–Analyze Selection of Specific Risk-Reduction Actions Against Current Risk, and Develop Prioritized Plan for Chemical and Hazardous-Materials Enterprise Mitigation Solutions [PE1]......Page 436
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within the Chemical and Hazardous-Materials Sector......Page 439
B United States Government Chemical and Hazardous-Materials Sector Initiatives......Page 458
15 THE AGRICULTURE AND FOOD SECTOR......Page 459
An Attractive Target for Terrorists......Page 460
Agriculture and Good Vulnerabilities......Page 461
Tailoring the S3E Security Assessment Methodology for the Agriculture and Food Sector......Page 463
Task 1—Operational Environment......Page 466
Task 2—Critical Assessment......Page 468
15.8–Determine Types of Malevolent Acts that could Reasonably Cause Agriculture and Food Enterprise Undesirable Events......Page 470
15.12–Assess Initial Likelihood of Chemical and Hazardous-Materials Enterprise Threat Attractiveness and Likelihood of Malevolent Acts Occurring......Page 473
Agriculture and Food Sector Initiatives......Page 479
15.1–S3E Security Assessment Methodology for the Agriculture and Food Sector......Page 464
15.4–Identify Agriculture and Food Enterprise Commitments......Page 467
15.6–Critical Assessment of Agriculture and Food Enterprise Facilities, Assets, Operations, Processes, and Logistics......Page 469
15.10–Identify Category of Agriculture and Food Enterprise Perpetrators......Page 472
15.15–Evaluate Existing Agriculture and Food Enterprise Interface and Relationship with Partner Organizations [PE1]......Page 474
15.18–Assess Agriculture and Food Enterprise Effectiveness of Response and Recovery [PE1]......Page 476
15.20–Refine Previous Analysis of Agriculture and Food Enterprise Undesirable Consequences that can Affect Functions......Page 477
15.25–Develop Cost Estimate for Short- and Long-Term Agriculture and Food Enterprise Mitigation Solutions......Page 478
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within the Agriculture and Food Sector......Page 480
B United States Government Agriculture and Food Sector Initiatives......Page 486
16 THE BANKING AND FINANCE SECTOR......Page 489
An Attractive Target for Terrorists......Page 490
Tailoring the S3E Security Assessment Methodology for the Banking and Finance Sector......Page 491
Challenges Facing the Security Assessment Team......Page 494
16.4–Identify Banking and Finance Enterprise Commitments......Page 496
16.7–Prioritize Critical Banking and Finance Enterprise Assets, in Relative Importance to Business Operations......Page 499
16.8–Determine Types of Malevolent Acts that could Reasonably Cause Banking and Finance Enterprise Undesirable Events......Page 500
16.18–Assess Banking and Finance Enterprise Effectiveness of Response and Recovery [PE1]......Page 506
16.1–S3E Security Assessment Methodology for the Banking and Finance Sector......Page 492
16.6–Critical Assessment of Banking and Finance Enterprise Facilities, Assets, Operations, Processes, and Logistics......Page 498
16.9–Assess Other Disruptions Impact Banking and Finance Operations......Page 501
16.12–Assess Initial Likelihood of Banking and Finance Enterprise Threat Attractiveness and Likelihood of Malevolent Acts Occurring......Page 502
16.14–Evaluate Existing Enterprise Banking and Finance Security Organization [PE1]......Page 503
16.15–Evaluate Existing Banking and Finance Enterprise Interface and Relationship with Partner Organizations [PE1]......Page 504
16.16–Evaluate Existing Banking and Finance SCADA and Security System Performance Levels [PE1]......Page 505
16.21–Refine Previous Analysis of Banking and Finance Enterprise Likelihood of Malevolent Acts of Occurrence......Page 507
16.25–Develop Cost Estimate for Short- and Long-Term Banking and Finance Enterprise Mitigation Solutions......Page 508
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within the Banking and Finance Sector......Page 509
B United States Government Banking and Finance Sector Initiatives......Page 531
17 THE TELECOMUNICATIONS SECTOR......Page 537
A Link to All Other Sectors Is Vital To Our National Security......Page 538
An Attractive Target......Page 539
Telecommunications Vulnerabilities......Page 540
Tailoring the S3E Security Assessment Methodology for the Telecommunications Sector......Page 541
Telecommunications Challenges Facing the Security Assessment Team......Page 544
Task 2—Critical Assessment......Page 546
17.5–Characterize Configuration of Telecommunications Enterprise Facilities and Boundaries......Page 547
17.12–Assess Initial Likelihood of Telecommunications Enterprise Threat Attractiveness and Likelihood of Malevolent Acts Occurring......Page 551
17.20–Refine Previous Analysis of Telecommunications Enterprise Undesirable Consequences that can Affect Functions......Page 555
Telecommunications Initiatives......Page 557
17.1–S3E Security Assessment Methodology for the Telecommunications Sector......Page 542
17.4–Identify Telecommunications Enterprise Commitments......Page 545
17.7–Prioritize Critical Telecommunications Enterprise Assets, in Relative Importance to Business Operations......Page 548
17.8–Determine Types of Malevolent Acts that could Reasonably Cause Telecommunications Enterprise Undesirable Events......Page 549
17.10–Identify Category of Telecommunications Enterprise Perpetrators......Page 550
17.15–Evaluate Existing Telecommunications Enterprise Interface and Relationship with Partner Organizations [PEI]......Page 552
17.18–Assess Telecommunications Enterprise Effectiveness of Response and Recovery [PEl]......Page 554
17.25–Develop Cost Estimate for Short- and Long-Term Telecommunications Enterprise Mitigation Solutions......Page 556
A A Historical Overview of Selected Terrorist Attacks, Criminal Incidents, and Industry Mishaps, Within the Telecommunications Sector......Page 558
B United States Government Telecommunications Sector Initiatives......Page 560
GENERAL GLOSSARY......Page 563
INDEX......Page 627