Functional quantitative security risk analysis (QSRA) to assist in protecting critical process infrastructure. (January 2017)

• Record Type: Journal Article
• Authors: van Staalduinen, Mark Adrian; Khan, Faisal; Gadag, Veeresh; Reniers, Genserik
• Is Part Of: Reliability engineering & system safety. Volume 157(2017)
• Page Start: 23
• Page End: 34
• Publication Date: 2017-01
• Subjects: Quantitative security risk analysis -- Bayesian network -- Bow-Tie risk model; Reliability (Engineering) -- Periodicals; System safety -- Periodicals; Industrial safety -- Periodicals; Fiabilité -- Périodiques; Sécurité des systèmes -- Périodiques; Sécurité du travail -- Périodiques; 620.00452
• DOI: 10.1016/j.ress.2016.08.014
• Languages: English
• ISSNs: 0951-8320

Abstract

Abstract: This article proposes a quantitative security risk assessment methodology that can assist management in the decision-making process where and when to protect critical assets of a chemical facility. An improvement upon previous work is the approach of conducting concurrent Threat and Vulnerability Assessments, as opposed to a sequential approach. Furthermore, this method introduces a Bow Tie risk model mapped into a Bayesian Network model that allows for various logical relaxation assumptions to be applied. Different uncertainty relaxation approaches such as "Noisy-OR" and "Leaky Noisy-OR" and "Noisy-AND" are tested to improve Threat and Vulnerability likelihood. Finally, integrating threat/vulnerability likelihood with potential losses, the security risk is quantified. The potential security countermeasures are characterized into either decreasing vulnerability or decreasing threat likelihood and are reassessed considering a cost analysis. A theoretical case study is conducted to exemplify the execution and application of the proposed method. Highlights: A new methodology for a quantitative security risk assessment and management. Adoption a Bayesian Network model for security risk modeling. Use of "Noisy-OR" and "Leaky Noisy-OR" and "Noisy-AND" to relax logic conditions. Integration of threat/vulnerability likelihood with potential losses to quantify security risk.