1. Apples-to-Apples: LIRA vs. RAMCAP
Critical Infrastructure Protection
Risk Analysis
DHS S&T
Drinking Water
Resilience Project
Rick White, Ph.D.
University of Colorado, Colorado Springs
Esc

2. Apples-to-Apples: LIRA vs. RAMCAP
National Problem
Drinking Water infrastructure rated ‘D’ in 2013 ASCE Report Card
>100 years old
240,000 main breaks/year
$384.2 billion capital shortfall
Esc

3. Apples-to-Apples: LIRA vs. RAMCAP
DHS S&T DWRP
Prioritize national investments in drinking water infrastructure
Develop risk analysis methodology to uniformly compare risks across assets
Account for emerging threats from climate change, aging infrastructure, & cyber attack.
Extend methodology to include “lifeline” infrastructure sectors of Water, Energy, Transportation, & Communications.
“Apples to Apples”
Esc

4. Apples-to-Apples: LIRA vs. RAMCAP
Critical Infrastructure Protection
Homeland security is about safeguarding the US from domestic catastrophic destruction.
Domestic catastrophic destruction comes in two forms: natural & manmade.
Manmade catastrophic destruction can be inflicted by non-state actors employing WMD or subverting critical infrastructure.
1995 Tokyo Subway Attacks
2001 NYC & DC Attacks (9/11)
Esc

5. Apples-to-Apples: LIRA vs. RAMCAP
Developed by ASME at request of White House shortly after 9/11
Advocated risk method in 2006 National Infrastructure Protection Plan (NIPP); dropped from 2009 & 2013 NIPPs
Made into AWWA J ANSI standard for Risk and Resilience of Water and Wastewater Systems
Developed into EPA Vulnerability Self-Assessment Tool (VSAT)
Esc

6. Apples-to-Apples: LIRA vs. RAMCAP
UCCS DWRP Y1 Tasks (FY15)
DHS
Drinking Water Resilience Project
Year 1
Evaluate RAMCAP WRT to emerging threats from climate change, aging infrastructure, & cyber attack
Evaluate RAMCAP WRT to lifeline infrastructure including Water, Energy, Transportation, & Communications
Recommend requirements to make RAMCAP compliant with DWRP objectives
Esc

7. Apples-to-Apples: LIRA vs. RAMCAP
UCCS DWRP Y1 Findings
RAMCAP does not account for emerging threats from climate change, aging infrastructure, or cyber attack
RAMCAP results are not uniform across different assets, let alone different sectors
RAMCAP requires significant structural changes to meet DWRP objectives; developed LIRA prototype to demonstrate potential capability
Esc

8. Apples-to-Apples: LIRA vs. RAMCAP
Top-down risk analysis
Default system failure modes
Default threat & vulnerability data
Fixed & Mobile asset analysis
Assesses risk at the local, regional, and national levels
Accommodates mitigation and resilience analysis
Can be completed in 1-3 hours
Accounts for emerging threats, and results comparable across lifeline sectors
RAMCAP
Bottom-up risk analysis
No default failure modes
No default data
Fixed asset analysis only
Assesses risk locally
Accommodates mitigation analysis
Can be completed in 1-3 days
Does not account for emerging threats, and results not comparable across lifeline sectors
Esc

9. Apples-to-Apples: LIRA vs. RAMCAP
R = C X V X T
System Asset Identification
System Failure Mode Definition
First Order Consequences
Second Order Consequences
Third Order Consequences
Consequence Assessment
Vulnerability Analysis
Probability Analysis
Risk Assessment
Mitigation Optimization
Resilience Optimization
Risk Management
Input Data Analysis
VSAT
R = C X V X T
Asset Characterization
Threat Characterization
Consequence Analysis
Vulnerability Analysis
Threat Analysis
Risk Calculation
Resilience Calculation
Applied Countermeasures
Net Benefit Calculation
Countermeasure Comparison
Risk Management
Esc

10. Apples-to-Apples: LIRA vs. RAMCAP
UCCS DWRP Y2 Tasks (FY16)
Draft LIRA ANSI specification
Conduct stakeholder survey to validate LIRA design
Incorporate stakeholder feedback into revised ANSI specification
“Apples to Apples”
Esc

11. Apples-to-Apples: LIRA vs. RAMCAP
Stakeholder Survey Design
Ten questions related to LIRA and RAMCAP differences in speed, detail, & cost:
LIRA can quickly and cheaply assess system-level risk
RAMCAP takes much longer time and effort to assess component-level risk
“Would you rather...” questions framed to pick between competing features
Two-month survey conducted from 27 Feb to 27 Apr 2016.
“Pick Two”
Esc

12. Apples-to-Apples: LIRA vs. RAMCAP
Stakeholder Survey Results
Received 26 responses to 684 requests for participation.
Responses overwhelmingly supported LIRA over RAMCAP.
Because of low participation, very large variation in confidence of results.
Results were “convincing” but not “conclusive”.
Esc

13. Apples-to-Apples: LIRA vs. RAMCAP
UCCS DWRP Y3 Tasks (FY17)
Validate previous survey results and revise LIRA specification accordingly
Build stakeholder awareness
Develop database tool
“Apples to Apples”
Esc

14. Apples-to-Apples: LIRA vs. RAMCAP
LIRA Database Tool
Objective: Release “beta” model with mix of real and estimated data;
Update databases with real data collected from users.
Esc

15. Apples-to-Apples: LIRA vs. RAMCAP
UCCS DWRP Summary
Received $501K research funding over three years
Deliver ANSI specification and working prototype by end of DWRP Y3
Contingent upon DHS funding, DWRP Y4 will take LIRA through ANSI process
Project
Start
End
Amount
DWRP Y1
Oct 2014
Sep 2015
$90K
DWRP Y2
Oct 2015
Sep 2016
$225K
DWRP Y3
Oct 2016
Sep 2017
$186K
DWRP Y4
May 2017
Oct 2018
$250K
Esc

16. Apples-to-Apples: LIRA vs. RAMCAP
DWRP Research Publications
Richard White, Aaron Burkhart, Terrance Boult, and Edward Chow. “Towards a Comparable Cross-Sector Risk Analysis: RAMCAP Revisited“. International Conference on Apples-to-Apples: LIRA vs. RAMCAP X, IFIP AICT 485, pp. 221–237 (2016), DOI / _13, November 2016.
Richard White, Randy George, Terrance Boult, and C. Edward Chow. “Apples to Apples: RAMCAP and Emerging Threats to Lifeline Infrastructure”. Homeland Security Affairs 12, Article 2 (September 2016).
Richard White, Aaron Burkhart, Terrance Boult, and Edward Chow. “Towards a Comparable Cross-Sector Risk Analysis: A re-examination of the Risk Analysis and Management for Critical Asset Protection (RAMCAP) methodology”. International Journal of Apples-to-Apples: LIRA vs. RAMCAP 14 (2016): 28-40, August 2016.
Esc

17. Apples-to-Apples: LIRA vs. RAMCAP
Conclusion
Questions?
Esc