1. Security Vulnerability Assessments Small- and Medium-Sized Industries and Laboratories

2. Presentation Objectives
Discuss the purpose and objectives of security vulnerability assessments (SVA)
Detail the methodology for conducting a SVA at small- and medium-sized industries and laboratories
Provide discussion and exercises to help practice the SVA methodology

3. Key acronyms ASD – Adversary Sequence Diagram
CCTV – Closed Circuit Television
CSC – Central Security Control
DBT – Design Basis Threat
DEPO – Design and Evaluation Process Outline
DOL – Department of Labor
EPA – Environmental Protection Agency
FAR – Failure Alarm Rate
HVAC – Heating, Ventilation, and Air Conditioning
IR - Infrared
NAR – Nuisance Alarm Rate
OSHA – Occupational Safety and Health Administration
PE – Path Element
PIDAS – Perimeter Intrusion Detection and Assessment System
PPS – Physical Protection System
RF – Radio Frequency
SVA – Security Vulnerability Assessment

4. Key Definitions
Collusion Threat – adversaries comprised of insiders and outsiders
Insider Threat – adversary with authorized access
Outsider Threat – adversary with no authorized access
Security Vulnerability Assessment – systematic evaluation process in which qualitative and/or quantitative techniques are applied to detect vulnerabilities and to arrive at an effectiveness level for a security system to protect specific targets from specific adversaries and their acts. (Garcia, 2008)

5. Presentation Overview
SVA objectives and overview
Describe methodology and practice exercises for SVA
Physical Protection System (PPS) objectives
Facility characterization
Threat definition
Target Identification
Design a PPS
Detection
Delay
Response
Analyze PPS design
Evaluate effectiveness of safeguards
Determine adequacy of safeguards
Identify and implement improvements

6. Primary SVA Objectives
Detect vulnerabilities (weaknesses) in a facility’s ability to protect critical assets
Theft
Sabotage
Design security systems to achieve a desired level of effectiveness
Physical protection systems
Cyber security protection systems

7. SVA Overview
Understand what is being protected and from what threat it is being protected against
Facility characterization such as size and intended use
Small- and medium-sized industrial facilities
Academic chemistry laboratory
Relevant threats
Outsider
Insider
Collusion
Chemical identification, characterization, and equipment
Quantities
Physical state
PPS objectives include facility characterization, threat definition, and target (or asset) identification. The key is to understand the facility we are protecting, what targets in that facility we are protecting, and from whom we are protecting them.
These are the three blocks in the Design and Evaluation Process diagram beneath the “Determine PPS Objectives.” Clearly what we are protecting and from whom is our objective. The rest of this day’s sessions will go into how to protect those targets and how to measure the risk associated with that protection.

8. SVA Overview
Design a Physical Protection System (PPS) to prevent theft and sabotage
Four D’s
Deter – implementation of a PPS which adversaries perceive as too difficult to defeat; difficult to quantify
Detect – discovery of unauthorized action against facility and target
Delay – use of obstacles to increase the time it takes for an adversary to succeed at given task
Defeat – cause to flee; in other cases capture or kill
Must consider facility and target being protected

9. SVA Methodology Design and Evaluation Process Outline (DEPO)
SVA methodology developed at Sandia to analyze security at facilities with high risk, high value targets
Capacity for reasonably addressing the four D’s will be different depending on facility, threat, budget, and target
SVA-DEPO Methodology is a systematic process
Determine Physical Protection Systems (PPS) objectives
Design PPS
Analyze PPS
Finalize PPS design
Review and redesign PPS

10. Visual Overview of SVA-DEPO Methodology
Final PPS
Design
Determine PPS Objectives
Facility Characterization
Threat Definition
Target Identification
Design PPS
Physical Protection Systems
Detection
Exterior
Sensors
Interior
Alarm Assessment
Alarm
Communication & Display
Delay
Access
Response
Force
Response Force
Communications
Entry Control
Analyze PPS Design
Analysis/Evaluation
EASI Model
Adversary Sequence
Diagrams
Risk Analysis
Computer Models
Redesign PPS
This is a picture of the overall process. PPS stands for Physical Protection System.
It is broken down into 3 phases—Determine Objectives, Design System, then Analyze Design. Once the designed system meets protection and other objectives, it can be implemented and this is shown by the final branching of this diagram.
Determining Objectives includes understanding the mission of the facility and what the facility looks like physically and operationally, identifying the assets that are to be protected, and defining the human threats to the assets.
Once the objectives are clear, the appropriate system must be designed. This system mixes detection, delay and response functions using people, procedures and equipment. The functions each contribute to overall system effectiveness and must occur in this order.
Once the system has been designed, we can use analysis and evaluation techniques to predict system performance against the threat and determine residual risk. If the results are acceptable, the system is implemented; if the results are still not acceptable, a new system design must be created. Occasionally, it is necessary to lower the initial threat and then at a later time, implement a system that is effective against the expected threat.

11. Detailing the SVA-DEPO Methodology
Gather as much information as possible about facility
Requires a mix of tours, document review, interviews, research, and luck
Identify issues, constraints, and enablers
Understand the environment
Leads to understanding of critical assets, their locations, and operational constraints that must be incorporated into final design
Determine PPS Objectives
Facility Characterization
Threat Definition
Target Identification

12. Facility Characterization
Physical conditions, site boundary, and access points
Facility operations, policies, and procedures
Regulatory requirements (in US: OSHA, EPA, NFPA)
Legal/liability issues (e.g., excessive use of force)
Safety considerations
Agency/enterprise goals and objectives
Buildings (construction, HVAC, communications)
Room locations, critical equipment/offices
Existing security technology, procedures, training
© Sandia National Laboratories

13. Facility Operations Product of facility
Operating conditions (working hours, off-hours, potential emergencies, shift changes)
Facility processes and supporting functions
Shipping and receiving, payroll, benefits, HR, engineering, marketing
Types and numbers of employees
Overlap of physical and cyber systems
© Sandia National Laboratories

14. Facility Characterization – Policies and Procedures
Written and unwritten; it is not uncommon to find that procedures in use are not as documented
Documentation of work areas (lockers, desk, computer, etc)
Training on policies and procedures including a schedule of required training, provision of training, and records
Should include responsibilities for security
Wearing a badge
Question/report strangers or suspicious activity
© Sandia National Laboratories

15. Facility Characterization – Safety Considerations
Safety is not security
Security is protection of assets against malevolent human threats
Safety deals with abnormal operations such as accidents, bad weather, fires, etc.
These are overlapping though occasionally conflicting needs; protect assets without injury or death
Adversary may use a safety event as a diversion
© Sandia National Laboratories

16. Facility Characterization Discussion
Small-/Medium Facilities
University Laboratories
Access Points
Facility Operations
Number of Personnel
Chemicals/Equipment
Security Procedures
Training Policy
© Sandia National Laboratories

17. Detailing the SVA-DEPO Methodology
List information required
Collect information
Organize information
Use all information sources to determine the classes of adversaries
Determine PPS Objectives
Facility Characterization
Threat Definition
Target Identification

18. Three Types of Adversaries
Threat Definition
Three Types of Adversaries
Outsiders – those with no authorized access
Terrorists
Criminals
Extremists/Activists
Insiders – those with authorized access; may be passive or active
Disgruntled employees
Blackmailed or coerced employees
Collusion – combination of insiders and outsiders
© Sandia National Laboratories 4

19. Adversary Information Required to Define Threat
Threat Definition
Adversary Information Required to Define Threat
Motivations (ideological, economic, personal)
Goals based on targets (theft, sabotage, drug use)
Tactics (stealth, force, deceit)
Numbers and capabilities (knowledge, motivation, skills, equipment)
© Sandia National Laboratories 3

20. Organize Threat Information
Threat Definition
Organize Threat Information
Compile and summarize collected threat information
Rank adversaries in order of threat potential
Likelihood of occurrence
Consequence of event
Result is design basis threat (DBT)
© Sandia National Laboratories 19

21. Outsider Adversary * H = High M = Medium L = Low Threat Definition
Type of Adversary
Terrorist
Criminal
Extremist
Potential
Theft
Action
Likelihood
*(H, M, L)
Sabotage
Other _________
Motivations
*(H, M, L)
Ideological
Economic
Personal
Capabilities
Number
Weapons
Equipment and tools
* H = High
M = Medium
L = Low
Transportation
Technical experience
Insider assistance
© Sandia National Laboratories 20

22. Insider Adversary * H = High M = Medium L = Low Threat Definition
Access to
Asset
PPS
Vital
Equipment
(Often,
Occasionally,
Never)
Collusion
Opportunity
*(H, M, L)
* H = High
M = Medium
L = Low
Sabotage
Theft
© Sandia National Laboratories 21

23. Defined Threat Example
Threat Definition
Defined Threat Example
Outsider
Non-violent attack
Two well-trained personnel
Hand-held tools
No weapons
Theft goal
Insider assistance (passive or active)
Land vehicles for transportation
Insider
Employee in any position
Operate alone or in collusion with outsiders
Same attributes as above
© Sandia National Laboratories 22

24. Features of Good Threat Policy
Threat Definition
Features of Good Threat Policy
Established by appropriate entity with relevant information
Periodic review and revision
Local assessment supplements national policy
Addresses insider and outsider potential
Identifies numbers, motivation, goals, equipment, weapons, and transportation
© Sandia National Laboratories 14

25. Detailing the SVA-DEPO Methodology
Prevention of sabotage
Identify vital areas to protect
Prevention of material theft or information loss
Identify location of material to protect
Determine PPS Objectives
Facility Characterization
Threat Definition
Target Identification
Next, we need to understand something about the assets that are being protected. Targets are usually identified based on the consequence of their loss and on the adversary goal. Certain assets may be sabotage targets, while others may be theft targets. Occasionally, a target will seem to be both (perhaps a chemical agent is stolen from a research facility and then released at a shopping mall). In this course, a theft event is considered removing the asset from the controlled area, and sabotage is doing something with the asset at the facility or somewhere else.
If looking at sabotage targets then you must identify the vital areas where sabotage may be caused by an adversary. If theft is the goal, you must identify the location of material or information. It is also important to note that once a piece of information has been identified as critical, it must be protected in all forms—paper, electronic, in the brain, etc. If all forms are not protected equally, the target is vulnerable.

26. Steps in Target Identification
Specify 1
Undesirable Consequences
Select Technique 2
for Target Identification 3
Identify Targets

27. Undesirable Consequences
Theft of critical assets
Sabotage which would endanger public health and safety
Industrial sabotage which would result in loss of production or information

28. Techniques for Target Identification
Manual listing used for:
Theft of localized items
Theft of material-in-process
Sabotage of critical components or material
Logical identification used for:
Theft of material in process

29. Targets Theft Release of hazardous material Industrial sabotage
Localized items (e.g., tools, computers)
Materials-in-process (e.g., chemicals, drugs)
Process equipment
Release of hazardous material
Results in substantial release of hazardous agents - chemical, biological, radiological
Industrial sabotage
Items which could result in loss of production - like stepper motors, conveyor belt, robots

30. Vital Area Identification
Establish:
What you are trying to prevent
Sources that cause the event you are trying to prevent
Facility operating states
What are the ways those sources occur (people, equipment, procedures)

31. Detailing the SVA-DEPO Methodology
Design PPS
Physical Protection Systems
Detection
Exterior
Sensors
Interior
Alarm Assessment
Alarm
Communication & Display
Delay
Access
Response
Force
Response Force
Communications
Entry Control
Detection
Intrusion sensing
Alarm assessment
Alarm communication

32. Detection Performance measures: Probability of detection
Sensor
Activated
Alarm
Signal
Initiated
Alarm
Reported
Alarm
Assessed
Performance measures:
Probability of detection
Time for communication and assessment
Frequency of nuisance alarms
Alarm without assessment is not detection

33. Sensor Classification
Passive or Active
Covert or Visible
Volumetric or Line-Detection
Line-of-Sight or Terrain-Following (for external sensors)
Mode of Application for external sensors
Buried line
Fence-associated
Freestanding
Mode of Application for internal sensors
Boundary penetration
Interior motion
Proximity 14

34. Sensor Selection Considerations
Application
Operating Principle
Detection Capabilities
Conditions for Unreliable Detection
Typical Defeat Methods
Major Causes of Nuisance Alarms

35. Detailing the SVA-DEPO Methodology
Design PPS
Physical Protection Systems
Detection
Exterior
Sensors
Interior
Alarm Assessment
Alarm
Communication & Display
Delay
Access
Response
Force
Response Force
Communications
Entry Control
Delay
Barriers
Dispensable barriers

36. Delay Performance measure is the time to defeat obstacle Delay
Provide Obstacles to Increase
Adversary Task Time
Physical Barriers
Protective Force (Guards)

37. Passive Delay
Conventional construction provides minimal delay against formidable threat
Include walls, doors, windows and utility ports, and roofs and floors
Delay time depends on tools and type of attack
Barriers can detain an adversary at predictable locations
Multiple and different barriers are effective
Barriers close to assets are usually most cost effective
Vehicle barriers are important to limit adversary tools
Access delay features should be present 100% of the time or take compensatory measures

38. Passive Delay Examples
Small- and medium-sized industries
Thick walls
Vehicle barriers
Hardened doors
Tie-downs & Cages
Multiple layer barriers
Fences
Hardened roof
University laboratories
Locked doors
Identification access control
Locked cabinets

39. Attributes of Active Barriers
Exert minimum impact on operations
Provide maximum delay at target
Afford volume protection
Must provide adequate safety to personnel
Offer multiple activation options
Have long storage life
Can be very expensive
Require command and control
Insider issues
May become the initial target

40. Active Delay Examples Small- and medium-sized industries
Electronic locks with 2- person control
Command and control system
Pyrotechnic smoke
Immobilization
Lethal options
University laboratories
Laboratory monitoring system
Locks with 2-person control

41. Detailing the SVA-DEPO Methodology
Design PPS
Physical Protection Systems
Detection
Exterior
Sensors
Interior
Alarm Assessment
Alarm
Communication & Display
Delay
Access
Response
Force
Response Force
Communications
Entry Control
Response
Interruption
Identify vital areas to protect
Deployment of response force
Neutralization

42. Response Performance measures
Communicate
to Response
Force
Deploy
Response
Force
Neutralize
Adversary
Attempt
Performance measures
Probability of communication to response force
Time to communicate
Probability of deployment to adversary location
Time to deploy
Response force effectiveness

43. Response Functions Deterrence Interruption Neutralization/Capture
Alarm Communications
Correct Assessment
Communication to guards
Deployment to correct location
Neutralization/Capture
Location
Use of force
Neutralization not always realistic

44. Deterrence
Dependent on facility; different sites will have different security needs
Guards may or may not be necessary
Control campus access
Private security company
Random guard patrols may be used
Possibility to use multiple guards

45. Interruption
Reliable, fast, communication of alarms to Central Security Control (CSC)
Correct assessment of problem
Reliable communication of CSC to security responders
At least two timely means of communication
Security responders must deploy to correct locations
Planning, training, exercises
Coordination with other responders
Clear chain of command
CSC: Central Security Control

46. Interaction with Outside Agencies
Probably the intervention method for small- and medium-sized industry
Written agreement
Key issues for consideration
Role of support agencies
Off-site operations
Communication with other agencies
Joint training exercises 8

47. Characteristics of an Effective PPS
Protection-in-depth
Minimum consequence of component failure
Balanced protection
Provides adequate protection against all threats along all possible paths
Maintains a balance with other considerations
Cost
Safety
Structural integrity

48. Physical Protection System Discussion
Small-/Medium Facilities
University Laboratories
Detection Sensor Systems
Alarm Interpretation
Passive Access Delay
Active Access Delay
Response
Defense-In-Depth
© Sandia National Laboratories

49. Overview of SVA-DEPO Methodology
Identify system deficiencies
Help to select system improvements
Allow cost vs. system effectiveness comparisons to be made
Analyze PPS Design
Analysis/Evaluation
EASI Model
Adversary Sequence
Diagrams
Risk Analysis
Computer Models
These are three reasons for conducting this third part of the Design and Evaluation Process of a PPS.
The evaluation process actually is the analysis of the effectiveness of the PPS along paths to the asset against the design basis threat. By nature of this process then, the worst paths are identified. This will show the analyst just where improvements need to be made, because the elements along this worst path are the weakest in your protection system.
The analysis process will quantify the effectiveness of the PPS system, and this will help in the decision of what improvements could be made to improve the system.
Probably the most use that the analyst will make of the evaluation is to decide which PPS improvements will give the most improvement for the least cost or inconvenience to operations. As has already been discussed, the PPS is made up of Detection, Delay, and Response elements, and an improvement in ANY of those areas can improve the PPS performance. But the real question is which improvement will result in an acceptable performance for the least amount of money. These evaluation tools will help in that answer.

50. Analysis Security Elements Security Systems PersonnelTV
Monitors
Switching
Equipment
Video Lines
Annunciators
or Display
Computers
Signal Lines
Another
Nuisance!
The third major division in the Design and Evaluation Process (we have talked about Determine PPS Objectives and Design PPS) is Analyze PPS Design.
There are established techniques to do this analysis, and in this one-day course we will just be able to tell you about some of them. To become proficient at the analysis techniques and the analysis models, requires weeks of training and longer periods of practice.
We have techniques that are used to model a proposed design of security elements, security systems, and personnel response, and give a measure of effectiveness before actually building a system. In this way, when the system is actually built, there is confidence in the design. We have models that provide the analysis and incorporate test data to predict system performance.

51. Measures of Effectiveness
Deterrence of would be adversaries
Cumulative probability of timely detection
Delay time
Response time and efficacy
Cost and system effectiveness
We have been talking all along about designing an effective system. Let’s digress from the adversary path for a moment, and discuss ways to measure system effectiveness.
As we have discussed all week, we measure delay in time. So, one measure of system effectiveness is total delay time. Another measure of system effectiveness could be just the accumulation of the detection elements along the path.
The real measure of effectiveness that we use is the combination of Detection, Delay and Response Elements and these are combined using the principle of Timely Detection. Most analysis models (either computer or on paper) use this principle, and so it is fundamental.
Alert the students that this principle of timely detection is the most important principle to be understood in this module.
We will discuss each of these methods in more detail in the next slides.

52. Redesign or Upgrade of PPS
As a result of the analysis:
Identify vulnerabilities in the PPS
Redesign system to correct noted vulnerabilities
Reevaluate to verify vulnerability is corrected
With the Design Basis Threat determined; the facility well understood; the targets identified; the detection, delay, and response elements designed; the vulnerabilities identified; and the risk calculated for that threat, the risk is presented which will tell you if the system needs to be redesigned or if it is sufficient as it is.
If the system must be redesigned, then the deficiencies that were noted in detection, delay, or response can be specifically addressed. As was done in the path analysis a few slides earlier when we added a sensor on the outer fence).
Different improvements can be suggested and analyzed in the models to find the most effective system for the least amount of money and least intrusion to operations. Once this new system is designed, then it is reanalyzed and if it is now sufficient for operations, then it is built, installed and operations can commence.

53. Presentation Review
Discuss the purpose and objectives of security vulnerability assessments (SVA)
Detail the methodology for conducting a SVA at small- and medium-sized industries and laboratories
Determining SVA objectives
Designing physical protective systems (PPS)
Analyzing PPS design
Provide discussion and exercises to help identify differences in SVA methodology for industry and laboratory

54. Questions?