the Physical Protection of Critical Infrastructures and Key Assets

Most industry officials have a fairly complete
understanding of their own operations and associated
vulnerabilities. However, many of these enterprises
require assistance to identify their dependencies on
other sectors and the degree of risk to which they are
exposed as a function of those interdependencies. The
potential impact of such interdependencies hit home
for the banking and financial services sector on
September 11, when the collapse of the World Trade
Center towers interrupted telecommunications services
in lower Manhattan. The disruption brought electronic
financial transactions to a halt, with long-term
economic impacts still being felt more than a year later.
In most cases, modeling and simulation capabilities are not
well integrated into existing infrastructure protection planning
activities. Achieving this integration will be critical
to the task of translating modeling and simulation research
data into effective guides for sector-focused protection
planning, decision support, and resource allocation.
Modeling, Simulation, and Analysis Initiatives
Modeling, simulation, and analysis initiatives that we
will pursue across the critical infrastructure sectors
include efforts to:
Integrate modeling, simulation, and analysis into national
infrastructure and asset protection planning and decision
support activities
DHS will establish an advisory panel consisting of
representatives from the public and private sectors,
national laboratories, academia, and commercial
research organizations to explore alternatives to
integrate modeling and simulation activities into
domestic protection planning.
The panel will be charged to review modeling,
simulation, and analysis and advise DHS on ways to
focus on-going and planned research activities on
national priorities. Early in the process, emphasis will
be given to developing and disseminating standards
and methods for modeling sector interdependencies.
Such standards will be based on a clear definition of
assets or services deemed to be critical and will be
tasked for development through nationally coordinated
planning activities overseen by DHS.
Develop economic models of near- and long-term effects of
terrorist attacks
The economic significance of terrorist attacks is not
always clear, with short-term effects often only
partially predictive of longer-term realities. Models
of the temporal and cross-sector scope of economic
damage caused by physical infrastructure attacks
would assist policymakers and emergency management
specialists in understanding and mitigating
worst case effects.
Develop critical node/chokepoint and interdependency
analysis capabilities
Fundamental to the core objective of modeling
interdependencies and mapping the consequences
of particular terrorist events, we will also undertake
research to develop metrics for gauging the
adequacy of infrastructure subsystems and key nodes
compared to level of threat and effect. This includes
comparing the robustness of different infrastructures
at points where key centers or critical nodes are
in close proximity to one another and can have
cascading effects if attacked. Clearly identifying and
addressing interdependencies among critical infrastructures
in both a national and international
context is high on our list of protection priorities.
Model interdependencies among sectors with respect to
conflicts between sector alert and warning procedures
and actions
Modeling alert responses and possible counterproductive
effects of alert system designs will
enhance flexibility and minimize duplication of
effort. The intent of raising the Homeland Security
Alert status is to trigger actions to protect infrastructures
and make it more difficult for terrorists to
act. These actions, however, may have disruptive
consequences that may themselves interact in ways
that could create additional vulnerabilities.
Conduct integrated risk modeling of cyber and physical
threats, vulnerabilities, and consequences
Risk assessments help to identify and determine ways
to manage risk to best allocate resources. These assessments
include threat analysis to provide a baseline
and frame of reference for risk management and
investment decisions. This analysis, coupled with
vulnerability assessments to determine the effectiveness
of security systems and tools to provide consequence
analysis, will provide information on critical assets and
nodes. Such studies would comprise models of security
incidents involving various types of both cyber and
physical attacks. Analysis will focus on the complex
interactions between physical and cyber systems to
determine the full range of potential consequences and
to ensure the applicability of findings across infrastructures
in both a domestic and international context.
Develop models to improve information integration
The integration of threat and vulnerability information
between sectors needs to be modeled, as does
information sharing between the federal government
and critical infrastructures, to identify points
of inefficiency and information loss.
34 THE NATIONAL STRATEGY FOR THE PHYSICAL PROTECTION OF CRITICAL INFRASTRUCTURES AND KEY ASSETS