riskmanagementapproachpresentation.pdfVIP专享VIP免费原创优质

OPPMPhysicalSecurityOfficeRiskBasedMethodologyForPhysicalSecurityAssessments12RiskBasedMethodologyforPhysicalSecurityAssessmentsRiskBasedMethodologyforPhysicalSecurityAssessmentsWhyconductAssessments?HomelandSecurityPresidentialDirective7requiresFederalDepartmentsandAgenciesidentifyandprioritizecriticalinfrastructureandkeyresourcesandprotectthemfromterroristattacks.HomelandSecurityPresidentialDirective9requiresUSDAexpandandcontinuevulnerabilityassessmentsoftheagricultureandfoodsectorsandupdateassessmentseverytwo(2)years.Notallassetsatalllocationsrequirethesamedegreeofprotection.Protectionofassetsmustbebasedonarealisticassessmentoftherisksassociatedwiththecriminalandterroristthreatslikelytobedirectedattheassetsintheiractuallocations.TheRiskBasedMethodologyforPhysicalSecurityAssessmentsallowsleadershiptoestablishassetprotectionappropriatefortheasset(s)valueandthelikelihoodofanattempttocompromisetheasset(s).Leadershipcanthenprioritizeassetsandapplyphysicalsecurityresourcesinthemostefficientandcosteffectivemannerpossible.3RiskBasedMethodologyforPhysicalSecurityAssessmentsRiskBasedMethodologyforPhysicalSecurityAssessmentsTheModelTheModel--ExampleExampleThereisafacilitythatinvolvesGMOresearch(Asset).HistoryshowsthereisagroupofExtremists–(Threat)thatdonotlikethistypeofresearch.HistoryalsoindicatestheirModusOperandiistodestroy(burn/slash)theunprotectedasset(Vulnerability)thatwouldsetbackresearchandcostthousandsofdollarsandhundredsofman‐hourstorecapturetheresearch(RiskAnalysis).Welookatthemissioncriticalityoftheassetandthemostcriticaltimeofrisk(CriticalityAssessment)whichisduringgrowingseason.Nowwelookatpresentprotectivemeasuresandwhatisneeded(GapAnalysis)toprotecttheasset.Wesetupourconcentricringsofsecurity(Countermeasures)startingfromtheassetworkingouttowardtheperimeter.OncetheCMsareimplemented,aTrainingsessiononeachCMtakesplace.NowTesttheCMs,andwriteanAfterActionreportidentifyinganyVulnerabilitiesintheCMs.Correctthevulnerabilitiesandtestagain,untilyouaresatisfiedtheCMsareadequatetoprotectagainstthethreat.4RiskBasedMethodologyforPhysicalSecurityAssessmentsRiskBasedMethodologyforPhysicalSecurityAssessmentsINTRODUCTIONINTRODUCTIONRiskmanagementisatechnicalprocedureforidentifyingandevaluatingsecuritythreatsandvulnerabilitiesandforprovidingmanagementwithoptionsandresourcerequirementsformitigatingtherisk(s).TheUSDAriskmanagementmethodologyconsistsoftwodistinctphases:•AssessmentphaseIdentifiesassetsandtheircriticalityIdentifiesspecificthreatsandtheprobabilityofoccurrenceIdentifiesvulnerabilitiesIdentifiessecuritycountermeasurestomitigatevulnerabilitiesandprotectassets•Riskevaluationphase–Basedontheseverityandlikelihoodofcriminalandterroristattacksandconsiderationofcountermeasurescurrentlyinplace,thisphaseestimatestheimpactofthelossofacriticalasset.Thesephasesareanalyzedbyateamofmulti-disciplined(subjectmatter)expertswhoutilizeastructuredbrain-stormingtechnique-knownasriskscenarioanalysis-todevelopscenariosandestimateseverityofconsequencesandprobabilityofoccurrence.Onceestimated,theteamusesmatrixestocalculateprobabilitiesandvulnerabilitylevels.Dependingonprojectscope,anassessmentmayrequire2-3daysfordatareviews,structuredinterviews,riskevaluation,andanoutbriefing.5RiskBasedMethodologyforPhysicalSecurityAssessmentsRiskBasedMethodologyforPhysicalSecurityAssessmentsTEAMCOMPOSITIONTE...