Search results

Quantifying vulnerability to critical infrastructure has not been adequately addressed in the literature. Thus, the purpose of this article is to present a model that quantifies vulnerability. Vulnerability is defined as a measure of system susceptibility to threat scenarios. This article asserts that vulnerability is a condition of the system and it can be quantified using the Infrastructure Vulnerability Assessment Model (I‐VAM). The model is presented and then applied to a medium‐sized clean water system. The model requires subject matter experts (SMEs) to establish value functions and weights, and to assess protection measures of the system. Simulation is used to account for uncertainty in measurement, aggregate expert assessment, and to yield a vulnerability (Ω) density function. Results demonstrate that I‐VAM is useful to decisionmakers who prefer quantification to qualitative treatment of vulnerability. I‐VAM can be used to quantify vulnerability to other infrastructures, supervisory control and data acquisition systems (SCADA), and distributed control systems (DCS).

Military and civilian leaders have the responsibility to protect our Nation's critical infrastructure, communities, and symbols of American power from terrorists, home and abroad, as well as from natural disasters. To this end, assessments are conducted to reduce vulnerability. The literature offers multiple definitions of vulnerability and measurement has not been adequately addressed. Thus, the purpose of this research has been to develop and deploy a systems-based model that quantifies vulnerability to critical infrastructure. This research defines critical infrastructure vulnerability as a measure of the susceptibility of critical infrastructure to threat scenarios. Vulnerability is a function of (1) threat scenario, (2) protection and (3) importance. Critical infrastructure vulnerability is measured by a system's (1) deterrence, (2) detection, (3) delay and (4) response capabilities. Importance implies that some subsystems are more critical to overall system performance than other subsystems. A value model was used as the logic construct for quantifying vulnerability. Subject-matter experts were queried to establish the shapes of value functions and importance (weights) in the model. Another set of subject-matter experts are queried to assess a notional clean water system with respect to each protection measure within the vulnerability value model. To accomplish this, two simulations are executed in the model. The first simulation aggregates expert assessments into one assessment. The results are then used as inputs into the vulnerability value portion of the model for use in the second simulation where vulnerability is quantified. Results of this research demonstrate that vulnerability can be quantified and that quantifying vulnerability is useful to decision-makers who prefer quantification to qualitative treatment of vulnerability. This research is a novel contribution to the body of scholarly work by: (1) providing a rigorous method to quantify vulnerability to critical infrastructure, (2) introducing the theory of vulnerability, and (3) specifying the theoretical relationship between risk and vulnerability. Subject matter experts conclude that there is value in the approach put forward in this body of research as it is applied to clean water systems, so it may be useful in other critical infrastructures. The research closes with directions for further research.

Since the terrorist attacks of September 11, 2001, and the subsequent establishment of the U.S. Department of Homeland Security (DHS), considerable efforts have been made to estimate the risks of terrorism and the cost effectiveness of security policies to reduce these risks. DHS, industry, and the academic risk analysis communities have all invested heavily in the development of tools and approaches that can assist decisionmakers in effectively allocating limited resources across the vast array of potential investments that could mitigate risks from terrorism and other threats to the homeland. Decisionmakers demand models, analyses, and decision support that are useful for this task and based on the state of the art. Since terrorism risk analysis is new, no single method is likely to meet this challenge. In this article we explore a number of existing and potential approaches for terrorism risk analysis, focusing particularly on recent discussions regarding the applicability of probabilistic and decision analytic approaches to bioterrorism risks and the Bioterrorism Risk Assessment methodology used by the DHS and criticized by the National Academies and others.