Step 1: Identify

Capture stakeholder’s concerns regarding the performance requirements and or the critical elements that must be protected. (Note: the following section on CARVER + Shock may have some very good suggestions about ranking and setting priorities.) Each element must have an associated risk, and the probability of the success or failure is dictated by one or more scenarios. It is the consequences of the risk scenario that determines the outcome.

As an example, if we say that the gas reformer maximum scenario is the complete destruction of the reformer and the resulting shut down of the plant, then anything less is a partial success, and we can attach numbers to that in terms of percentages of shutdown and/or production lost of the other operations as well.

Other scenarios and multiple event scenarios are equally likely. There are lots of things that can take place, and some of them are routine, internal, or external and are often considered during the design stage. Examples might include power interruptions, an electrical voltage spike, simple corrosion, advanced corrosion due to electrolysis, and wear and tear on the system. These are technically “attacks,” but their nature and response are more in the realm of design deficiencies and maintenance and repair activities.

Sabotage, in large or small scale, is just one type of attack. Technically, there is little difference between sabotage and “mischief” except in the damage done. Mischief may be as simple as disabling equipment so that an employee gets additional overtime pay to plugging a vent just before the plant union goes out on strike to make it difficult to clean out a chamber. Sabotage can create actual and willful harm to major elements of the operating portion of the plant. The difficulty is that mischief is difficult to detect and is more of an inconvenience.

Other types of scenarios may include physical or other electronic interference with remote locations or communications. A remote pumping station is a vulnerable area easy to attack. The scenario might be just someone breaking in and stealing components or simply cutting the power or massive vandalism.

Any teenager with some talent and a modem and a wire wrapped around an orange juice container can make a transmitter, which could send signals to the unsecured transmitters and receivers, which open and close valves or control chemical or thermal reactions.

While some of these scenarios are very simple, the threats posed can be quite complex. The point is that they need to be considered in the planning and posed as potential occurrences.

In the overall preparation of scenarios, it is important to consider the effects of any environmental or other effects from unplanned releases of chemicals within the plant. If incidents within the plant result in the release of volatile chemicals the community notifications and environmental regulatory notifications may be required. There are several good programs that can assist in the planning for various types of environmental releases.⁶

NASA, because it is focused on specific missions, recommends that the scenario development be decomposed into a set of steps of consulting with the stakeholders to gain their concurrence that the scenario is realistic. Quoting from their RIDM document:

Stakeholder expectations result when they i) specify what is desired as a final outcome or as a thing to be produced and ii) establish bounds on the achievements of goals (these bounds may for example include costs, time to delivery, performance objectives, organizational needs). In other words, the stakeholder, expectations that are the outputs of this step consist of i) top-level objectives and ii) imposed constraints. Top-level objectives state what the stakeholders want to achieve from the activity: these are frequently qualitative and multifaceted, reflecting competing sub-objectives (e.g., increase reliability vs. decrease cost). Imposed constraints represent the top-level success criteria outside of which the top-level objectives are not achieved.

So, develop your scenarios as completely as you can, and involve various departments on the scope of the scenario. Get consensus where possible, especially if it involves outside notifications and support from others.

Step 2: Analyze

The analysis step requires the estimation of the magnitude and consequences of individual risk elements and working through scenarios to completion. These are the consequences of the scenarios in step 1 and should include recovery steps and related costs until the plant is fully restored and operating.

One of the chief problems in the analysis is related to the timing of the attack or the probability of success. If there are n people in the scenario committee, anticipate that the number of attack and timing scenarios to be evaluated will be between 120 and 250% of the number of people you have on your committee. These opinions are just that, and the essential difficulty in production of a coherent report is that you do not know what you do not know, and you may not ever know that you do not know it until after the attack has occurred. Without good intelligence from the community, you will never know whose scenario and timeline about an attack is more accurate until after it occurs.

The second area of possible disagreement is the assessment of the damage. One persons’ minor damage is another persons’ total destruction. Here is where you must involve the process engineering group with designations of the key elements of the plant, which are vulnerable to explosions, fire, weather, control failures, etc.

The third area will be the cost of reconstruction. If the plant has been built in the past 5 years or so, it might be possible to utilize a Construction Cost Index for estimation of the cost of replacement. Otherwise, you could be looking at a much more comprehensive engineering study to estimate the costs. Vendors can and will provide quotations for their good clients. It is also possible to get some indication of the cost of replacement by comparison of published data on comparably sized new equipment. Chemical engineering handbooks have some guidance on scaling up capital costs for process equipment.

The preparation of a detailed cost estimate for a facility can be several hundred to several thousand hours of estimator’s time just to get within 25% of the actual cost, depending upon the level of detail required, the complexity of the plant or process, and the accuracy of the estimate required.

We never have sufficient data to predict when an attack might occur, and a continuous vigilance is required, with the possibility of extreme rapid response when and if an event occurs. There are scenarios and then there are extreme scenarios, and the response must be proportionate to the type and kind of attack.

The analysis of the effects of an attack depends upon the scenario. Some attacks will occur quickly, and others will provide warning. Adverse weather, flood, storms, and weather-related events provide warning of their occurrence and severity. Other attacks will not provide warnings and their severity can be much greater. A fire in the pump house may have minor consequences, or it may lead to a plant-wide conflagration. It is sometimes difficult to ascertain the difference between plant safety issues and plant security issues. However, for the purposes of our discussion and planning, an attack will be an external event, caused by outside forces or outside persons.

Confining ourselves to events attributed to outside forces still leaves us with a problem related to the estimation of the timing and the duration. A blizzard or bad ice storm may cause major disruption, or it may be a minor event that will disrupt the power. A physical assault by a terrorist organization or a cyber attack designed to disrupt processes or steal information or divert shipments or conceal other misdeeds can be difficult to analyze because one does not know the scale of the event. In the case of the theft or diversion, the detection is often after the fact.

Sabotage as opposed to mischief is also an attack. Someone deliberately leaving a door or gate unlocked to allow an intruder into the facility could be classified as an attack or it could be simple theft or sabotage. It is hard to tell beforehand what can happen unless one gets down to the area-specific planning of intrusion attacks. Someone in the tank farm area may be harmful or not, whereas an unauthorized someone in the computer center probably will be a potentially serious event because of the harm that can be done.

The analysis process will have multiple outcomes based on each scenario. The timing and nature of an attack is a best guess. Where there is information available from police, military, or reliable intelligence sources, the timing of an attack may be known or estimated. Otherwise, the system must be ready for eternal vigilance.

The overall process of analysis includes several important elements:

• What can go wrong—or how can an attack occur?
• How big would the attack be?
• What are the security systems to prevent, deter, or defeat an attack?
• What is the margin or reserve to prevent an incident or follow-up attack?⁷

Obviously, the attack scenarios must be limited to those that have a realistic chance of occurring. Otherwise, a plant on the equator would be evaluating the possibility of being hit with a blizzard.

In planning the scenarios, you want to include the ultimate scenario even if it does seem remote. Unless you are confident that the likelihood of an occurrence of the ultimate destruction scenario is less than about 1 in 10 million or less, you would probably want to include the ultimate disaster scenario in your planning. That should, of course, include the ultimate destruction of the facility by explosion or fire or both, and community evacuations and cleanups.

Step 3: Planning

This is the step where the response to the attack scenario is plotted out. Logistics should include the manpower required for the type of response and should be specific to the scenario. Options tend to be the enemy of detailed planning but are necessary. It is an exercise in visualization in that one has to (i) put themselves in the place of the attacker, and (ii) if the attacker is detected, estimate how much force is required, or (iii) if the attacker is not detected, estimate what could or would be damaged by the attacker.

One of the easiest considerations in this type of exercise is to estimate how long the attacker can operate before the attack is detected. If, for example, an attacker manages to penetrate the outer perimeter of the plant, how far can he get before detection occurs and the plant is alerted? Think of the attacker’s presence as a wave spreading out from a pebble tossed into a pond. Gates, locked doors, fences, etc. are not necessarily deterrents, but they will slow an attacker down, making the area of probable access and search radius smaller.

Other questions in the response planning scenario include:

• What resources are required?
• How will outside resources be used, including fire, police, and emergency services?
• How fast can these resources, both internal and external, be tapped, and what should their response be?
• Are the equipment or personnel prepositioned so that they can respond rapidly to the event?

One of the other critical elements in the response planning scenario should include the availability of emergency services such as a hospital and its response time. A part of that series of questions should include analysis of the directions and transit times, and the ability of the hospital to handle or decontaminate injured personnel without damage to their emergency room or other facilities?

Sample planning exercise

Another way of looking at the planning exercise is to consider the types of elements outlined below:

The company’s tolerance for risk should be addressed, as it may be a determining factor in the overall security planning. In most cases, the risk statistics will be low, and the risks are probabilistic rather than actual.⁸ Risk levels, based upon experience, are generally of little use, because the history will likely suggest that the “attack” did not happen. “Did not happen during previous history” does not suggest that the “attack” cannot or will not happen. The probability maybe very low, and one will be trying to decide between the likelihood of an event with a time based probability of 0.001 and 0.0001% or less. One has to determine the tolerance for risk, even for small catastrophic events, as it will affect the resources available.

The risk management decisions should be elevated to the sponsoring organization at the next higher level of hierarchy when the risk cannot be managed by the present organizational unit. If the risk is plant-wide and may have major consequences on the corporation, the decision about levels of risk should be sent to the appropriate corporate management level for their sign-off or commitment. Risk can be no longer considered when the associated risk drivers are no longer considered potentially significant.

Step 4: Track

All risk decisions must develop a paper trail so that they can be examined and evaluated after an exercise, after an event or even after a failure. The purpose is not to see who failed, but to find out how the system worked and how well it worked in preventing the event. The meetings and documents should be captured and recorded so that the thought process of the risk managers can be evaluated and captured for later consideration.

Unfortunately, this can result in huge paper and electronic files. The most effective “paper trail” will be a time-stamped set of electronic communications files followed up with written reports every time there is an incident, no matter how small. This documentation should include copies of video files and radio communications both internally and external to the plant. Especially where there is an injury or an arrest, it will be vital to the defense of the plant and employee to insure that actions are defensible and the appropriate level of force has been employed.

Step 5: Control

Periodic review and editing of the risk management plans are required. Optimally, this will result in a book of procedures that is used in training the security force and key managers. Optimally, there should be a set of training requirements that relate to the procedures. This training document should specify the levels of education, positions, qualifications, and examinations for each level of security personnel. The procedure manual does not need to be highly detailed, but it should be specific enough so that the security force personnel know what actions to take and what appropriate levels of force, response, and reserve are required. The procedure manual should also specify the qualifications, responsibilities, duties, and authority for each level of the security force.

Much of the language in the procedure manual will be repetitive, and it may be helpful to have some prewritten descriptions of standard actions available to plug into the documents. CAUTION: This type of standard language can lead to unimaginative and preprogrammed actions where the plan is not taken seriously or is put on the shelf as an unused reference work, only to be used as a justification of actions taken whether they were appropriate or not.

If an armed guard force is used, the plan must specify the levels of force and specify the training requirements and the qualifications for the security officers before they are allowed to be armed. If the guards are not armed, the plan should specify the procedures for contact of the local police and/or fire department and the levels of supervisory control who can make that contact.

Ideally, the review process should be a continuous or semicontinuous basis. The security manager and/or the security team should review the existing plans on a regular basis. Depending on the size of the plans and the complexity of the facility, that may require almost continuous review and updating. But the plan needs to be reviewed at least yearly, or more frequently wherever possible.

Every incident needs to be reviewed to insure that the response was appropriate to the incident and that the plan is revised to insure appropriate force/response levels are employed. If a portion of the response or risk management plan becomes untenable or nonviable, it should be stricken from the master planning book.

The universal limitation of all the planning techniques we have discussed so far is their inability to tell us when an incident could occur. What we do not know, we do not know. The solution is planning and eternal vigilance against the unplanned, accidents, and incidents.

Defining the terms for Carver+Shock

Criticality is the measure of the public health or economic impacts of the attack. It should be a scaled evaluation of the cost of the attack in terms of budgets, corporation value, facility value, or any other thing.

Accessibility is the ease of ingress and egress to the facility or the site. A site with a fence will have a lower accessibility than one without. Similarly, natural barriers such as rivers, lakes, and natural terrain would give a site a lower score.

Recuperability or recoverability is a measure of the ease with which the facility can be repaired or recovered from an attack on a specific part of the facility or the entire facility.

Vulnerability is the ease of accomplishing the attack. The challenge to assigning a priority or rank to this item is that it also depends upon the type of attack. If a facility is relatively wide open and an intruder can penetrate the perimeter and walk around the facility unchallenged, then the vulnerability would be very high. Even if a facility had a relatively secure perimeter, it might be vulnerable to an attack by a standoff weapon such as a military-grade or homemade mortar.

Effect is the effect that the attack would have, in terms of direct loss, such as direct loss of production capacity or inventory. It might be important to separate inventory from production in this category for separate parts of the facility.

Recognizability is the ease of identifying the target. Much of that may depend upon the attacker’s familiarity with the plant and his ability to distinguish high-value targets from those having little or no value. A good example of a high-value target might be the gas reformer in an ammonia plant versus the bulk gas or liquid storage tanks. Often, the tanks will be also protected by a dike or other containment. The loss of the tank integrity if there is no fire, and if the tank containment is intact, may be of minimal consequence.

Shock is an attempt to evaluate the combined health, economic, and psychological impacts of an attack. While it is primarily for the food industry due to the impacts of an attack on an individual, the facility may be insignificant unless that facility is making something of national importance.

CARVER + Shock definitions need to be scaled to suit the plant size and other impacts. The top-end scale should be whatever is agreed upon by plant management, and it is suggested that the upper end of the scale might be, for example, the loss of the entire plant, a large corporation’s projected profits for a year, the net worth of the facility, or other appropriate measures. It is important not to set the upper levels of impact too high, and each category should have some 1s and 10s in it. It is important to recognize that there might be a tendency to set values artificially high to stimulate plant investment or to set them too low to avoid inspection and accountability. It is also important to consider that the various categories of attack may produce some casualties that are unavoidable.

Know yourself

This includes the entire infrastructure or facility to be assessed. Many other VA systems attempt to identify only critical systems to evaluate in the hopes of saving time and resources. This shortcut can overlook crucial vulnerabilities as proven time and again by users of this tool. Results show that significant vulnerability lies in areas that most experts never considered critical and may have overlooked.

Know the threat

• Actual, localize threat for a specific target system.
• Design basis threat for a higher-level assessment.
• We must understand who the threat is, why they want to attack, how they will attack you, and what is the desired effect.

Know your environment

This is information about the physical, political, and legal environment that affects the target system and the threat.

Know what your enemy knows about you

This is an additional component to this preassessment. Information is sometimes called red teaming. It is not required to identify the actual vulnerabilities; it is used more to predict probability of attack.

CARVER + Shock produces a bar graph that indicates the levels of vulnerability of the facility, and it has a 108-question section interview that discusses recall and processing safety and is primarily designed for the food industry, but with some imagination, it can be used on other platforms and industries (Tables 2.7, 2.8, 2.9, 2.10, and 2.11).

Steps for a good analysis

The steps for a good analysis include upper management participation and a thorough investigation of lots of cases. It is a team effort. Briefly, the steps for analysis are outlined below:

1. List assets. Take an inventory of the assets.
2. Select the type of analysis you are going to use and determine the best and most applicable type of analysis suited to your plant or corporation. Be sure to include an ultimate disaster scenario for each type of plant present at a site.
3. Perform network analysis. Determine hubs and links to find out if there are critical elements that you may have missed.
4. Build a model using fault tree, CARVER, RIDM, MBRA, or other software package.
5. Analyze the model and prepare a fault tree or an event tree to verify the paths.
6. From the event tree, you can calculate the optimum events and impacts to guide you in allocation of resources to reduce the hazards.
7. Circulate the information and get consensus on the inputs, formalize the plan, make upgrades, and use the plan and the scenarios to train the plant personnel.
8. Review the exercises, and then revise the plan as may be required.