Security Vulnerability Assessments Small- and Medium-Sized Industries and

Security Vulnerability Assessments Small- and Medium-Sized Industries and

Security Vulnerability Assessments Small- and Medium-Sized Industries and Laboratories SAND No. 2010-4653C Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energys National Nuclear Security Administration under contract DE-AC04-94AL85000. Presentation Objectives Discuss the purpose and objectives of security vulnerability assessments (SVA) Detail the methodology for conducting a SVA at smalland medium-sized industries and laboratories

Provide discussion and exercises to help practice the SVA methodology Key acronyms ASD Adversary Sequence Diagram CCTV Closed Circuit Television CSC Central Security Control DBT Design Basis Threat DEPO Design and Evaluation Process Outline DOL Department of Labor EPA Environmental Protection Agency FAR Failure Alarm Rate HVAC Heating, Ventilation, and Air Conditioning IR - Infrared NAR Nuisance Alarm Rate OSHA Occupational Safety and Health Administration PE Path Element PIDAS Perimeter Intrusion Detection and Assessment System PPS Physical Protection System RF Radio Frequency SVA Security Vulnerability Assessment Key Definitions

Collusion Threat adversaries comprised of insiders and outsiders Insider Threat adversary with authorized access Outsider Threat adversary with no authorized access Security Vulnerability Assessment systematic evaluation process in which qualitative and/or quantitative techniques are applied to detect vulnerabilities and to arrive at an effectiveness level for a security system to protect specific targets from specific adversaries and their acts. (Garcia, 2008) Presentation Overview 1. SVA objectives and overview 2. Describe methodology and practice exercises for SVA a) b) c) d)

Physical Protection System (PPS) objectives Facility characterization Threat definition Target Identification Design a PPS Detection Delay

Response Analyze PPS design Evaluate effectiveness of safeguards Determine adequacy of safeguards Identify and implement improvements Primary SVA Objectives Detect vulnerabilities (weaknesses) in a facilitys ability to protect critical assets Theft

Sabotage Design security systems to achieve a desired level of effectiveness Physical protection systems Cyber security protection systems SVA Overview Understand what is being protected and from what threat it is being protected against Facility characterization such as size and intended use Small- and medium-sized industrial facilities Academic chemistry laboratory Relevant threats Outsider Insider Collusion Chemical identification, characterization, and equipment Quantities Physical state

SVA Overview Design a Physical Protection System (PPS) to prevent theft and sabotage Four Ds Deter implementation of a PPS which adversaries perceive as too difficult to defeat; difficult to quantify Detect discovery of unauthorized action against facility and target Delay use of obstacles to increase the time it takes for an adversary to succeed at given task Defeat cause to flee; in other cases capture or kill Must consider facility and target being protected SVA Methodology

Design and Evaluation Process Outline (DEPO) SVA methodology developed at Sandia to analyze security at facilities with high risk, high value targets Capacity for reasonably addressing the four Ds will be different depending on facility, threat, budget, and target SVA-DEPO Methodology is a systematic process Determine Physical Protection Systems (PPS) objectives Design PPS Analyze PPS Finalize PPS design

Review and redesign PPS 9 Visual Overview of SVA-DEPO Methodology Final PPS Design Physical Protection Systems Facility Characterization Threat Definition Target Identification Analyze PPS Design Design PPS Determine PPS Objectives

Analysis/Evaluation Detection Delay Response EASI Model Exterior Sensors Access Delay Response Force Adversary Sequence Diagrams Response Force

Communications Computer Models Interior Sensors Alarm Assessment Alarm Communication & Display Entry Control Risk Analysis Redesign PPS Detailing the SVA-DEPO Methodology Gather as much information as possible about facility

Requires a mix of tours, document review, interviews, research, and luck Identify issues, constraints, and enablers Understand the environment Leads to understanding of critical assets, their locations, and operational constraints that must be incorporated into final design Determine PPS Objectives Facility

Characterization Threat Definition Target Identification Facility Characterization Physical conditions, site boundary, and access points Facility operations, policies, and procedures Regulatory requirements (in US: OSHA, EPA, NFPA) Legal/liability issues (e.g., excessive use of force) Safety considerations Agency/enterprise goals and objectives Buildings (construction, HVAC, communications) Room locations, critical equipment/offices Existing security technology, procedures, training Facility Operations

Product of facility Operating conditions (working hours, off-hours, potential emergencies, shift changes) Facility processes and supporting functions Shipping and receiving, payroll, benefits, HR, engineering, marketing Types and numbers of employees Overlap of physical and cyber systems Facility Characterization Policies and Procedures Written and unwritten; it is not uncommon to find that procedures in use are not as documented Documentation of work areas (lockers, desk,

computer, etc) Training on policies and procedures including a schedule of required training, provision of training, and records Should include responsibilities for security Wearing a badge Question/report strangers or suspicious activity Facility Characterization Safety Considerations Safety is not security Security is protection of assets against malevolent human threats Safety deals with abnormal operations such as accidents, bad weather, fires, etc.

These are overlapping though occasionally conflicting needs; protect assets without injury or death Adversary may use a safety event as a diversion Facility Characterization Discussion Small-/Medium Facilities Access Points Facility Operations Number of Personnel Chemicals/Equipment Security Procedures Training Policy University Laboratories

Detailing the SVA-DEPO Methodology Determine PPS Objectives Facility Characterization Threat Definition Target Identification List information required Collect information Organize information

Use all information sources to determine the classes of adversaries Three Types of Adversaries Outsiders those with no authorized access Terrorists Criminals Extremists/Activists Insiders those with authorized access; may be passive or active Disgruntled employees Blackmailed or coerced employees Criminals

Collusion combination of insiders and outsiders Adversary Information Required to Define Threat Motivations (ideological, economic, personal) Goals based on targets (theft, sabotage, drug use) Tactics (stealth, force, deceit) Numbers and capabilities (knowledge, motivation, skills, equipment) Organize Threat Information Compile and summarize collected threat information Rank adversaries in order of threat potential Likelihood of occurrence

Consequence of event Result is design basis threat (DBT) Outsider Adversary Type of Adversary Terrorist Potential Action Likelihood *(H, M, L) Criminal Extremist Theft Sabotage Other _________ Motivations

*(H, M, L) Ideological Economic Personal Capabilities Number Weapons Equipment and tools Transportation Technical experience Insider assistance * H = High M = Medium L = Low Insider Adversary Access to Asset Insider

(Often, Occasionally, Never) Access to PPS (Often, Occasionally, Never) Access to Vital Equipment (Often, Occasionally, Never) Theft Sabotage Opportunity Opportunity *(H, M, L) *(H, M, L)

Collusion Opportunity *(H, M, L) * H = High M = Medium L = Low Defined Threat Example Outsider

Non-violent attack Two well-trained personnel Hand-held tools No weapons Theft goal Insider assistance (passive or active) Land vehicles for transportation Insider Employee in any position Operate alone or in collusion with outsiders Same attributes as above Features of Good Threat Policy Established by appropriate entity with relevant information

Periodic review and revision Local assessment supplements national policy Addresses insider and outsider potential Identifies numbers, motivation, goals, equipment, weapons, and transportation Detailing the SVA-DEPO Methodology Identify vital areas to protect Determine PPS Objectives Facility Characterization Threat Definition Target Identification Prevention of sabotage

Prevention of material theft or information loss Identify location of material to protect Steps in Target Identification 1 Specify Undesirable Consequences 2 Select Technique for Target Identification 3 Identify Targets Undesirable Consequences

Theft of critical assets Sabotage which would endanger public health and safety Industrial sabotage which would result in loss of production or information Techniques for Target Identification Manual listing used for: Theft of localized items Theft of material-in-process Sabotage of critical components or material Logical identification used for: Theft of material in process

Sabotage of critical components or material Targets Theft Localized items (e.g., tools, computers) Materials-in-process (e.g., chemicals, drugs) Process equipment Release of hazardous material Results in substantial release of hazardous agents - chemical, biological, radiological Industrial sabotage Items which could result in loss of production - like stepper motors, conveyor belt, robots Vital Area Identification

Establish: What you are trying to prevent Sources that cause the event you are trying to prevent Facility operating states What are the ways those sources occur (people, equipment, procedures) Detailing the SVA-DEPO Methodology Design PPS Detection

Intrusion sensing Alarm assessment Alarm communication Physical Protection Systems Detection Exterior Sensors Interior Sensors Alarm Assessment Alarm Communication & Display Entry Control Delay

Access Delay Response Response Force Response Force Communications Detection Sensor Activated Alarm Signal Initiated Alarm Reported Alarm

Assessed Performance measures: o Probability of detection o Time for communication and assessment o Frequency of nuisance alarms o Alarm without assessment is not detection Sensor Classification

Passive or Active Covert or Visible Volumetric or Line-Detection Line-of-Sight or Terrain-Following (for external sensors) Mode of Application for external sensors Buried line Fence-associated Freestanding Mode of Application for internal sensors Boundary penetration Interior motion Proximity Sensor Selection Considerations Application

Operating Principle Detection Capabilities Conditions for Unreliable Detection Typical Defeat Methods Major Causes of Nuisance Alarms Detailing the SVA-DEPO Methodology Design PPS

Delay Barriers Dispensable barriers Physical Protection Systems Detection Exterior Sensors Interior Sensors Alarm Assessment Alarm Communication & Display

Entry Control Delay Access Delay Response Response Force Response Force Communications Delay Performance measure is the time to defeat obstacle Delay Provide Obstacles to Increase Adversary Task Time Physical Barriers

Protective Force (Guards) Passive Delay Conventional construction provides minimal delay against formidable threat Include walls, doors, windows and utility ports, and roofs and floors Delay time depends on tools and type of attack Barriers can detain an adversary at predictable locations Multiple and different barriers are effective Barriers close to assets are usually most cost effective Vehicle barriers are important to limit adversary tools

Access delay features should be present 100% of the time or take compensatory measures Passive Delay Examples Small- and medium-sized industries University laboratories Locked doors Thick walls Identification access control Vehicle barriers Locked cabinets Hardened doors

Tie-downs & Cages Multiple layer barriers Fences Hardened roof Attributes of Active Barriers Exert minimum impact on operations Provide maximum delay at target Afford volume protection Must provide adequate safety to personnel

Offer multiple activation options Have long storage life Can be very expensive Require command and control Insider issues May become the initial target

Active Delay Examples Small- and medium-sized industries Electronic locks with 2person control Command and control system Pyrotechnic smoke Immobilization Lethal options University laboratories Laboratory monitoring system Locks with 2-person control Detailing the SVA-DEPO Methodology Design PPS

Response Interruption Physical Protection Systems Detection Exterior Sensors Interior Sensors Alarm Assessment Alarm Communication & Display Entry Control Delay Access Delay

Response Response Force Response Force Communications o Identify vital areas to protect o Deployment of response force Neutralization Response Communicate to Response Force

Deploy Response Force Neutralize Adversary Attempt Performance measures o Probability of communication to response force o Time to communicate o Probability of deployment to adversary location o

Time to deploy o Response force effectiveness Response Functions Deterrence Interruption Alarm Communications Correct Assessment Communication to guards

Deployment to correct location Neutralization/Capture Location Use of force Neutralization not always realistic Deterrence Dependent on facility; different sites will have different security needs Guards may or may not be necessary Control campus access Private security company Random guard patrols may be used Possibility to use multiple guards

Interruption Reliable, fast, communication of alarms to Central Security Control (CSC) Correct assessment of problem Reliable communication of CSC to security responders At least two timely means of communication Security responders must deploy to correct locations Planning, training, exercises Coordination with other responders Clear chain of command

Interaction with Outside Agencies Probably the intervention method for small- and mediumsized industry Written agreement Key issues for consideration Role of support agencies Off-site operations Communication with other agencies Joint training exercises Characteristics of an Effective PPS

Protection-in-depth Minimum consequence of component failure Balanced protection Provides adequate protection against all threats along all possible paths Maintains a balance with other considerations Cost Safety Structural integrity Physical Protection System Discussion Small-/Medium Facilities Detection Sensor Systems Alarm Interpretation Passive Access Delay Active Access Delay Response Defense-In-Depth

University Laboratories Overview of SVA-DEPO Methodology Analyze PPS Design Analysis/Evaluation EASI Model Adversary Sequence Diagrams Computer Models Risk Analysis Identify system deficiencies Help to select system improvements Allow cost vs. system effectiveness comparisons to

be made Analysis Security Elements Signal Lines Security Systems Computers Personnel Annunciators or Display Another Nuisance! Video Lines Switching Equipment TV

Monitors Measures of Effectiveness Deterrence of would be adversaries Cumulative probability of timely detection Delay time Response time and efficacy Cost and system effectiveness Redesign or Upgrade of PPS As a result of the analysis: Identify vulnerabilities in the PPS Redesign system to correct noted vulnerabilities Reevaluate to verify vulnerability is corrected

Presentation Review Discuss the purpose and objectives of security vulnerability assessments (SVA) Detail the methodology for conducting a SVA at smalland medium-sized industries and laboratories Determining SVA objectives Designing physical protective systems (PPS) Analyzing PPS design Provide discussion and exercises to help identify differences in SVA methodology for industry and laboratory Questions?

Recently Viewed Presentations

  • Grades From Mid Term - Georgia Institute of Technology

    Grades From Mid Term - Georgia Institute of Technology

    Grades From Mid Term Mean: 47 a record low! Std: 16 Distribution If I had to assign grades… ~60 or above A (> ~ mean +1 std dev) ~30 - 60 B (> ~ mean -1 std dev) ~15 or...
  • Easements in oil and gas law - wsmtlaw.com

    Easements in oil and gas law - wsmtlaw.com

    Types of Surface Access. Easement. Non-possessory interest in real property. Non-possessory: Use of the land belonging to another. Real Property. If you have an easement, you do not own the land, but have a right to use it for a...
  • Apresentação do PowerPoint

    Apresentação do PowerPoint

    academia de inovaÇÃo e propriedade intelectual
  • Central & South American Civilizations

    Central & South American Civilizations

    Mexican Flag Today the Eagle, Cactus & Snake appear on the Mexican flag Elaborate Class System Aztec Temple Causeway = raised roads Inca Largest of the three great empires 3,000 miles along the Pacific coast of South America Expansive road...
  • Biodiversity, Species Interactions, and Population Control

    Biodiversity, Species Interactions, and Population Control

    Specialist species of honeycreepers: Through natural selection, different species of honeycreepers developed specialized ecological niches that reduced competition between these species. Each species has evolved a specialized beak to take advantage of certain types of food resources.
  • Theory of Constraints Scheduling - tanzco.net

    Theory of Constraints Scheduling - tanzco.net

    Theory of Constraints. The Theory of Constraints Goal is to maximize flow through the entire system. Emphasizes balancing flow. Improve performance of bottleneck: Determine what is constraining the operation. Exploit the constraint. Subordinate everything to the constraint. Determine how to...
  • Slide 1

    Slide 1

    Actual Texture:Actual Texture is texture that you can see with your eyes and you could actually feel it with your fingers.Actual texture has a surface quality that may be described as rough, smooth, bumpy, squishy, or spiky etc. In the...
  • Diapositive 1 - ENIS

    Diapositive 1 - ENIS

    2 - Elaboration et caractérisation de biocéramiques à base de phosphates 3 - Développement de lampes économiques à base d'ultraphosphates dopés par des terres rares (en collaboration avec le LMI - Clermont Ferrand) 4 - Elaboration et caractérisation de couches...