Security Risk Assessment

Genserik Reniers, Nima Khakzad, Pieter Van Gelder

• Publisher: De Gruyter
• Year: 2017
• ISBN:
  9783110497762
• Edition: 1
• Topic: Physical Sciences
• Subtopic: Industrial & Technical Chemistry

This book deals with the state-of-the-art of physical security knowledge and research in the chemical and process industries. Legislation differences between Europe and the USA are investigated, followed by an overview of the how, what and why of contemporary security risk assessment in this particular industrial sector. Innovative solutions such as attractiveness calculations and the use of game theory, advancing the present science of adversarial risk analysis, are discussed. The book further stands up for developing and employing dynamic security risk assessments, for instance based on Bayesian networks, and using OR methods to truly move security forward in the chemical and process industries.

1Introduction

Safety and security both concern the avoidance and mitigation of losses of different origins (safety looks at possibly unintentionally caused losses, while security is about tackling deliberately caused losses). Our society today is ever more focused on security. However, in the past decades, mainly safety issues were tackled and predominantly safety research was carried out to obtain continuous improvement and higher health and safety figures in organizations of any kind. Questions such as “what is safety?”, “what is risk?”, “how to manage safety adequately?”, “who is responsible for safety? ”, “how safe is safe enough?”, and other complex topics arose and were investigated by practitioners around the world. They were also studied by researchers from insurance companies as well as by academics and research institutes. Moreover, politicians and regulators came into the discussion with ever more interest in the safety subject. This conglomerate of stakeholders has led to the huge progress that has been made with respect to safety in the past century.

In fact, according to Reniers and Khakzad [2] two safety revolutions took place: (i) the “safety first movement” (1900s until 1950s) represents the first safety revolution, and (ii) the “risk management and loss prevention” approaches (1960s until 2010s) denote the era of the second safety revolution. The third safety revolution to further advance safety, especially in the chemical industry, is summarized by the acronym CHESS (from 2020s onwards). Figure 1.1 shows the three safety revolutions along with the underlying theories, models, concepts and ideas per decade.

Reniers and Khakzad [2] indicate that the third safety revolution can be represented by the acronym CHESS. CHESS, in fact, summarizes five very important fields where revolutionary progress is needed:

‒Cluster-thinking and intensified cooperation

‒High transparency and efficient inspection

‒Education, training and learning

‒Security integration

‒Safety innovation and dynamic risk assessments

At first sight, these fields represent a well-known recipe for improving safety in any industry whereas they are nothing new. However, one should realize that the combination of these domains could indeed lead to a third safety revolution in the chemical industry if they were addressed in radical innovative ways. The required innovation can be exemplified by a number of concrete ideas, which can only be realized if the current mentality of practitioners, academics and people from the authorities changes. For more information, we refer to Reniers and Khakzad [2]. With respect to security, the authors indicate that innovation is to be expected with respect to more effective counter-terrorism security practices in the chemical industry, especially in the era of blind and violent terrorism. At present, security efforts in chemical plants are aimed at addressing low-impact high-frequency security risks such as burglary and sabotage, or, at best, amateur terrorists. However, an adequate upgrade is needed to address high-impact low-frequency security events (anti-terrorist security measures) preferably from an inherent design based viewpoint [1]. However, more generally, security should be treated in an integrated way with safety by company safety management, thereby respecting the specificities accompanying security.

Fig. 1.1: Safety progress and the three safety revolutions (applicable to the chemical industry) (1900–2030 and future) [2].

In fact, when one looks at a safety risk, three components are necessary: hazards, exposures (to the hazards) and losses. A hazard can be seen as a potential, a condition, a circumstance, a characteristic, or the like, that (with a certain likelihood) might cause losses. As such, hazards are characterized by the lack of deliberateness. Safety risks may thus lead to losses that were suffered without any human intention. In the case of safety risks, nature or random failures have caused the losses, or people have done their best to not cause losses, but nevertheless incidents/accidents/losses have occurred, or people have violated rules, but in their mind it was with the best intention, for instance to increase production, or to speed up a working process (and not to deliberately cause losses). Safety risk assessment is nothing more or less than the identification, analysis, evaluation and prioritization of all possible hazards, exposures and unintentional losses. Safety risk management is based on safety risk assessment and deals with treating/decreasing/lowering as many hazards, exposures and unintentional losses as possible, using a variety of management approaches and safety measures (so-called safety barriers or safety functions).

Security risks, if expressed analogously to safety risk, are also composed of three elements: threats, vulnerabilities (to the threats) and losses. Threats (comparable with “hazards” in safety) can be seen as possible individuals or groups of individuals possibly wanting to deliberately cause losses. As such, threats imply intention. Security risks thus result from deliberate human actions to cause losses, be it through physical attack or cyber-attack. Vulnerabilities (comparable with “exposures” in safety) are those weaknesses (in people, infrastructure, reputation, etc.) that make a critical asset susceptible to the threats. Security risk assessment is thus concerned with identifying, analyzing, evaluating and prioritizing possible threats, vulnerabilities and intentional losses. Security risk management is based on security risk assessment and handles the treating/decreasing/lowering as many threats, vulnerabilities and intentional losses as possible, employing security management techniques and security measures (so-called countermeasures).

It is obvious that the relatively new field of security can learn a lot from the past decades of research in the old field of safety. Hundreds of safety risk assessment methods exist, whereas only a very limited number of security risk assessments are known. Moreover, risk assessment in the safety domain has already made great progress with respect to quantification and probabilistic and dynamic thinking. In the security risk assessment domain, much has yet to be developed concerning quantification and probabilistic and dynamic thinking. There are undoubtedly knowledge spillovers from safety towards security that may be exploited. Nevertheless, there are also fundamental differences between the two fields that cannot be denied, for instance the transparency difference. Both the comparisons and the differences between the two fields of science will become much clearer when reading this book. Figure 1.2 illustrates how this book is constituted.

Chapter 1 explains the importance of the topic, especially in our current complex society and this era of ruthless terrorism. In Chapter 2, Pasman tackles a sensitive issue: physical security legislation and regulations for chemical plants, discussing and comparing the pros and cons of such legislation and directives in the United States versus those in Europe. A plea is made for a more centralized methodical security policy in Europe, when it concerns hazardous materials in chemical plants that may cause devastating disasters if they were to be misused by intelligent terrorists. Chapter 3 by Baybutt provides an overview of what security constitutes and how it should be seen within the range of potential disastrous events in a process plant. This chapter also explains what the current insights in applying security risk assessments are, what terminology is used, how to interpret the results, etc. In Chapter 4, Bajpai and Gupta put forward a current approach of security risk assessment. Although there might be some overlap with Chapter 3, it does not pose a problem for the reader. Chapter 4 helps increase the legibility of security terminology and leads to an understanding of security risk assessment techniques currently used in the chemical industry. Chapter 5 by Landucci et al. elaborates on one of the factors of security risk assessment, that is, the “attractiveness” of a chemical plant from a security adversary perspective. This complicated issue is captured by the authors suggesting an innovative approach using the combination of a hazard based attractiveness index (quantitative assessment) and a site-specific so-called induction factor (qualitative estimate). Chapter 6 by Zhang and Reniers introduces game theory as a powerful mathematical tool into security applications in the chemical and process industry. The authors argue that a security risk assessment, as it is used today in chemical facilities, needs an upgrade towards more reliability and optimality, especially in the allocation of security budget and resources. Game theory can help achieve much more rational, less “belly-feeling driven”, decision making about physical security countermeasures. In Chapter 7, Paltrinieri and Haskins further expand on making the security assessment techniques more dynamic. Besides the potential of making static methods more dynamic, some advanced security assessment methods are discussed. In Chapter 8, Khakzad discusses the application of Bayesian network for making security risk assessment approaches more dynamic. Khakzad explains the advantages of using Bayesian networks in combination with utility theory and game theory, in the form of influence diagrams, to further advance probabilistic thinking in the discipline of security assessment. Chapter 9 concludes the list of contributions in this volume, indicating how methods commonly used in the field of operations research, can be employed to enhance security in the chemical and process industries. Talarico and Reniers categorize the models into four different sets of applications: mitigation, preparedness, response and recovery, depending on the lifecycle of an attack. In each of these groups, the decision making process can be supported by operations research models and methods. In Chapter 10, overall conclusions are drawn and recommendations based on the contributions are formulated.

Fig. 1.2: Chapters of the book.

References

[1]Reniers G, Amyotte P. Prevention in the chemical and process industries: future directions. J Loss Prevent Proc. 2012; 25(1):227–231.

[2]Reniers G, Khakzad N. Revolutionizing safety and security in the chemical and process industry: applying the CHESS concept. J Integ Sec Sci. 2017; 1(1):2–15.

Hans Pasman

2American legislation and regulatory measures: a lesson for Europe?

Dr.Ir. Hans J. Pasman has been in various management positions in the Defense Research part of the TNO Applied Research Organization for more than 30 years. He is Emeritus Chemical Risk Management of the Delft University of Technology and currently Research Professor at the Mary Kay O’Connor Process Safety Center (MKOPSC) of the Texas A&M University, College Station, Texas, USA. The views presented in this chapter are his personal ones.

2.1Introduction to critical infrastructure protection and pub...

Table of contents

• Cover
• Title Page
• Copyright
• Preface
• Contents
• List of Contributors
• 1 Introduction
• 2 American legislation and regulatory measures: a lesson for Europe?
• 3 Security vulnerability analysis : protecting process plants from physical and cyber threats
• 4 Security risk assessment: Some techniques
• 5 A methodology for the evaluation of attractiveness with respect to external acts of interference dedicated to the chemical and process industry
• 6 Applying game theory for adversarial risk analysis in chemical plants
• 7 Dynamic security assessment: benefits and limitations
• 8 Security vulnerability assessment: A review of Bayesian network approaches
• 9 OR methods to enhance security in the chemical process industry
• 10 Conclusions
• Index