Transcript Vulnerability: How to Audit Your Facility

Pollution Prevention and Homeland
Security
Michael J. Ellenbecker
Kwangseog Ahn
Homeland Security & Preventing
Pollution from Attack on Critical
Waterside Infrastructure
Presented by
Ed Badolato, Executive VP, Homeland Security
The Shaw Group
New Hampshire Pollution Prevention Conference
University of New Hampshire
September 21, 2004
Vulnerability: How to Audit
Your Facility
Presented by
Ed Badolato
Executive Vice President for Homeland Security
The Shaw Group
University of New Hampshire
September 21, 2004
The New Environmental Paradigm

Certain parts of the infrastructure are attractive
targets for terrorists
Mass casualties
 Property damage
 Economic losses
 Environmental impact


We must reduce risk from indirect releases into
the environment
Osama bin Laden’s Targeting
Philosophy
“Inflict maximum damage to
human, economic and
physical infrastructures”
“Attack symbolic, high prestige,
economic, and strategic targets”
Pollution as a Terrorist Weapon--Kuwait, 1991
Staten Island Fuel Storage Fire
Four Bad Things That Can Happen from a
Terrorist Attack on Your Facility
1.
2.
3.
4.
Loss of containment
Theft or misuse with intent to cause harm
Worker internal or public harm offsite
Degradation of assets, business functions, or
company value
CRITICAL INFRASTRUCTURES











Chemicals and Hazardous Materials
Energy
Transportation
Water
Telecommunications
Agriculture & Food
Banking and Finance
Public Health
Emergency Services
Defense Industrial Base
Postal and Express Shipping
Vulnerability of Petro-Chem Facilities


This book was co-authored by Ed
Badolato
It covers:
 Industrial disasters
 Process related incidents
 The terrorist threat to
populated areas
 Sabotage of chem facilities and
RR tank cars
 The cost factor
Terrorism and the Chemical
Transportation Industry
1.
2.
3.
4.
Plug the security gaps noted
in industry “Lessons
Learned” & “Best Practices”
Work across the full
spectrum of Homeland
Security incidents—
preparation, response,
recovery
Adopt and adapt technology
fixes
Organize a layered, integrated
security system
What We Can Expect in the Future



More mass casualty attacks-“few attacks in the US, but they will be closer to the
Madrid rail scenario than the WTC 9/11”
Terrorist conventional bombings along with
WMD attempts-“bombs will be the most predominant form of attack”
More terrorist cells and operatives will be
uncovered in the US
Laws & Regulations that Impact
Facility Preparedness






Clean Air Act
Bioterrorism Preparedness and Response Act of 2002
Maritime Transportation Security Act of 2002
Resource Conservation and Recovery Act of 1976
Occupational Safety and Health Act
Emergency Planning and Community Right-to-Know
Act
Chemical/Environmental Security Players

Key Agencies & Organizations








Department of Homeland Security (DHS)
Environmental Protection Agency (EPA)
Department of Justice
Department of Defense
State & Local Emergency Response
Industry Associations—ACC, SOCMA, and state industry
organizations
American Institute of Chemical Engineers
Secondary Agencies & Organizations



DOT
OSHA
DOE
DHS and the National HS Strategy
The three objectives of the national strategy:
1. Prevent terrorist attacks within the US
2. Reduce Americas vulnerability to terrorists
3. Minimize the damage and recover from
attacks that do occur
DHS Infrastructure Protective Measures Plan



Technical Applications
WMD Prevention
Protection Measures

Buffer Zone Protection Plan (BZPP)






1700 sites this year
Target selection
Surveillance Ops
Planning Ops
Rehearsals
Training
Industry Safety Management Capabilities






Process Safety Management Systems
Hazard Evaluation Procedures
Chemical Process Quantitative Risk Analysis
Release Mitigation
Safe Storage & Handling of High Toxic Hazard
Materials
Layer of Protection Analysis
We Must Work Across the Full Spectrum
of Homeland Security Situations
Preparation
Threat
Vulnerability
Risk
Countermeasures
Training
Alert/Warning
Response
Police
EMS
Fire
Emergency
Coordination
Evacuation
Recovery
Emergency
Response
Incident Mgt
Public Safety
Clean up
Resumption of
Operations
Suggestions for Industry

The new industry security strategy should:




Identify and prioritize critical infrastructure facilities.
Specify security roles and responsibilities.
Describe appropriate threat/alert information flows.
Set the standards for actionable security plans
Suggestions for Your Facility






Assume you are a target
Extend your perimeter—”mutual support”
Barriers
Surveillance
Planning
Inform & engage employees
The Security Vulnerability Assessment
Process
1.
2.
3.
4.
5.
6.
7.
8.
Project Planning Meeting--Setting the right course with the company/client
Facility Characterization and Critical Asset Identification--A thorough
characterization of site asset characteristics and hazards
Identify and Prioritize the Threat--Complete evaluation of threats; internal,
external, internally-assisted
Vulnerability Analysis--Prioritized evaluation of threats against assets
Risk Assessment —defining the potential for damage to or loss of an asset
Countermeasures Identification and Effectiveness Measurement-Prioritized validation and justification of costs for improved security,
highlighting process/operations benefits
Preparing the Report
Implementation
Step 3. Identify and Prioritize the
Threat-
Threat Methodology


Understand how terrorists target facilities
Build a detailed, focused assessment
 Initial screening of sources of threat info
 Contact with local, state, & federal law
enforcement and intelligence agencies
 Interviews with facility security managers
Step 4. Vulnerability Assessment
Vulnerability Assessment
“Identification of the extent of susceptibility to
exploitation, relative to the existence of any
countermeasures.”
Two Approaches to Vulnerability Analysis
1.
Asset-based analysis: assess potential targets
(any attack scenarios)
2.
Scenario-based analysis: assess attack scenarios
(any asset)
VA Asset-Based Approach
Where
−
used:
“Basic” sites, i.e. no complex security
challenges
Key
Elements
−
Assess and categorize consequences
−
Assess target attractiveness
−
Identify and assess key assets
•
Based on consequence and attractiveness
•
Identify areas needing further protection
VA Scenario-Based Approach
Where
Used:
−
Complex security challenges
−
High inherent threat
Key
Elements
−
Identify key assets/targets
−
Identify applicable threats
−
Identify potential scenarios
−
Drives countermeasures for selected scenarios
Step 5. Risk Assessment
RISK

Risk assessment—”a qualitative and/or
quantitative determination of the
probability of occurrence of an adverse
event and the impact of its consequences.”
Step 6. Countermeasures Identification and
Effectiveness Measurement-
Physical Security Systems









Perimeter Protection
Fences
Lights
Gates & Access Controls
Entrance/equipment locks
Protection Force
Electronic security systems--motion detectors
Video surveillance systems,
Building alarm systems
Other Countermeasures







Loss prevention & material control
Control room security
Distributed Control Systems
Crisis management and emergency response
Policies & procedures
IT/Cyber security
Intelligence
SUMMARY

SVAs Perform Important Functions
Defines roles & relationships
 Identifies necessary resources
 Ensures comprehensive security effort
 Sets plan for implementation

MODULE 2:
Introduction to the
Toxics Use Reduction Act
[email protected]
Toxics Use Reduction Institute
978.934.3391
The TUR Planning Cycle
Responsibilities of
a TUR Planner
Pre-Plan
Measure
Success
Process
Characterization
Implement
Plan
Identify TUR
Options
Certify Plan
Screen &
Evaluate TUR
Options
Develop or
Update Plan
Similarities in the Security and
TUR Assessment Processes
The TUR Planning Cycle
The Security Vulnerability
Assessment Process
1.
2.
3.
4.
5.
6.
7.
8.
Project Planning Meeting
Facility Characterization and
Critical Asset Identification
Identify and Prioritize the Threat
Vulnerability Analysis
Risk Assessment
Countermeasures Identification
and Effectiveness Measurement
Preparing the Report
Implementation
Pre-Plan
Measure
Success
Implement
Process
Characterization
Plan
Identify TUR
Options
Certify Plan
Screen &
Develop or
Evaluate TUR
Update Plan
Options
Importance of TUR in HS
CRITICAL INFRASTRUCTURES
 Chemicals and Hazardous Materials
 Energy
 Transportation…
Pollution Prevention and Homeland
Security



Can use similar assessment methods
PP personnel may be qualified to perform HS
assessment, particularly in industry using
hazardous chemicals
PP itself reduces risks in HS
–
–
–
Lower toxicity
Lower volatility/explosion potential
Lower volumes store on site
Opportunities for TURI


Appears there is lack of interaction between
TUR/PP and HS
TURI already has the expertise and
resources for TUR/PP that can be applied
directly to HS
What TURI Can Do?



Advocate TUR to reduce HS risks
Extend TURP program to TUR-HSP program
Identify and prioritize the HS risks from hazardous
chemicals
–
–
–
–

Use TURA data and TRI data including use amounts,
locations of plants, etc.
Use chemical info including explosiveness, flammability,
toxicity, etc.
Use other information about presence of symbolic, high
prestige, economic, and strategic targets
Combine all the information to prioritize the HS risks
Use the planning process to reduce HS risks
Funding Sources?





DHS
EPA
OSHA
NSF
MA?