Abstracts (PDF file, 1.8MB) - Society for Risk Analysis

SRA 2013 Annual Meeting Abstracts
W4-F.4 Palmer, MJ; UC Berkeley, Stanford;
palmer@berkeley.edu
Globally Networked Risks and the Decentralization of
Biomanufacturing
Advances in bioengineering technologies are catalyzing an
expansion of research and development models. Horizontal
technology platforms are emerging alongside more traditional
vertically integrated activities (e.g. in medicine, industrial
processing, agriculture, etc.). These horizontal technology
platforms – sometimes referred to as bio-manufacturing
capacities – include tools such as lower cost DNA synthesis,
sequencing and assembly. These capacities have also expanded
across a new set of actors, leveraging information sharing tools
and employing novel models to organize communities (e.g. the
internet; social networking; crowd-sourced funding; DIY bio
labs). This potential “decentralization of capacity” presents key
challenges for the governance of biotechnology. These
developments have been heralded as fueling an industrial
revolution in the life sciences with significant economic
potential. Yet biotechnology can both pose and mitigate key
safety and security concerns (e.g. bioweapons development
versus deterrence and preparedness; environmental release).
This presentation will discuss organizational and institutional
challenges in building bio-manufacturing capacities
internationally. It will examine examine strategies in the US
and abroad to foster distributed or centralized technology
deployment and propose key factors essential to building
resilient governance strategies.
P.67 Pang, H*; Buchanan, RL; Schaffner, DW; Pradhan, AK;
Pang, H; Buchanan, RL; Pradhan, AK; University of Maryland,
College Park, MD, 20742; Schaffner, DW; Rutgers University,
New Brunswick, NJ 08901; haopang@mail.umd.edu
Quantitative Risk Assessment for Escherichia coli
O157:H7 in Fresh-cut Lettuce
Leafy green vegetables, including lettuce, are of serious food
safety concern, as those are recognized as vehicles for
foodborne pathogens such as Escherichia coli O157:H7 that
could cause human illnesses. Development and application of
quantitative risk assessment models have been recognized as
strong tools to identify and minimize potential risks associated
with foodborne pathogens. This study was aimed at developing
a quantitative microbial risk assessment model (QMRA) for E.
coli O157:H7 in fresh-cut lettuce and evaluating the effects of
intervention strategies on public health risks. The supply chain
of fresh-cut lettuce was modeled from infield production until
consumption at home. Using @RISK software a simulation
model was developed for exposure and health outcome
assessment. The developed model was simulated using Latin
Hypercube Sampling for 100,000 iterations to estimate the
number of illnesses due to consumption of fresh-cut lettuce in
the U.S. With a prevalence of 1% of lettuce coming to the
processing plant, the baseline model (with no inclusion of
intervention strategies) predicted 8921 number of cases per
year in the U.S. For each of the intervention strategies
evaluated, the public health risks were reduced and the
bacteriophage was the most effective in reducing the public
health risks. Sensitivity analysis results indicated that irrigation
water quality is the most important factor affecting the number
of cases predicted. The developed risk model can be used to
estimate the public health risk of E. coli O157:H7 from
fresh-cut lettuce and to evaluate different potential intervention
strategies to mitigate such risk.
T1-H.3 Panjwani, S; THANE Inc; susmit@gmail.com
Making risk-informed decisions using the next
generation algorithms for cyber-security and
Cyber-Physical Systems (CPS) risk assessment
Cyber-security has become a game that is almost impossible to
win(1). According to the Global State of Security survey,(1)
“The rules have changed, and opponents−old and new−are
armed with expert technology skills, and the risks are greater
than ever.” Despite this, more organizations are investing in
security to achieve due-diligence as opposed to reducing the
risks. Inconsistencies and inability of current expert driven risk
assessment methods to improve the state of security are often
cited as a reason to use a due-diligence driven security
management approach. Cyber-Physical System (CPS) is hybrid
network of physical and engineered systems. CPS will play an
integral role in developing the next generation of critical
infrastructure. CPS faces new types of risk profile including
cyber-security risks. Little research is done to develop scientific
foundation for managing CPS risks. Better risk assessment
methods are needed to improve decisions for managing
complex and dynamic cyber systems. Currently artificial
intelligence algorithms are used to generate system reliability
and cyber-security risk scenarios. These algorithms function by
assuming that there are no unknowns and everything is known
a priori. This assumption is not valid for cyber-security and CPS
risk assessment. Making this assumption produces
counter-intuitive results and provides a false sense of security.
However, eliminating this assumption precludes using majority
of current algorithms for generating risk scenarios. Using
lessons learned by conducting risk assessment for a critical
infrastructure CPS, the author developed a new type of
algorithm for automatically generating risk scenarios for
cyber-security and CPS. This new framework captures dynamic
information, and assumes that there are unknowns and new
knowledge is available frequently. This framework allows
making risk-informed decisions in an unknown world. (1) PWC.
Key findings from The Global State of Information Security®
Survey 2013.
M3-A.2 Panjwani, S; THANE Inc; susmit@gmail.com
Cyber-security Risk Management
Current cyber-security risk management is driven by two
complementary philosophies. The first strategy is called is
called “penetrate-and-patch”, which focuses on identifying and
patching vulnerabilities. Often a team of security experts is
used to identify exploitable vulnerabilities. The second strategy
is called “secure-design,” which suggests preventing
vulnerabilities by designing more secure systems and
developing more secure software. This approach identifies
secure coding practices by studying known vulnerabilities. To
support these risk management strategies, current risk
assessment methods focus on identifying vulnerabilities. The
challenge with current vulnerability centric risk management
strategies is that, in the last decade the overall number of
reported vulnerabilities has increased. More importantly,
despite efforts to make software and cyber-infrastructure more
secure, all types of vulnerabilities that existed at the beginning
of the decade still existed at the end. Current risk management
methods also assume that there are no unknowns in the
cyber-security domain and all information is available a priori.
This assumption produces counter intuitive results. Some
experts have suggested replacing the risk based approach with
a due-diligence based approach citing inconsistencies and
inability of current expert driven risk management methods to
improve the state of security. Current cyber-security risk
management and assessment methods need to be improved.
However, the lack of improved state of cyber-security is not
only because of the limitation of current methods, but is caused
by the failure to understand unique characteristics of the
cyber-security domain. The author developed a new risk
assessment framework by capturing these unique requirements
of cyber-security domain. A new risk management philosophy is
also developed that uses the attacker behavior to lead the
attacker away from the target.
December 8-11, 2013 - Baltimore, MD