Final Program - Society for Risk Analysis

ing the scope and usage of the cyber-security risk assessment has not improved thestate of security either. The lack of improvement in cyber-security can be attributedto 1) the limitations of current cyber-security risk assessment methodology, 2) thefailure to understand the characteristics of the cyber-security domain and 3) assumingthat there are no “known unknowns” or “unknown unknowns” in cyber-security domain.Cyber-security domain is inherently dynamic, in which the system configurationchanges frequently, and new attacks and vulnerabilities are discovered regularly. Cybersecurity’sthreat agent is intelligent and adapts to the situation and countermeasures.Attack actions are driven by attacker’s exploratory nature, thought process, motivation,strategy, and preferences. The authors developed a new framework for automaticallygenerating the cyber-security risk scenarios by, 1) capturing diverse and dynamiccyber-security knowledge, 2) assuming that there are unknowns in the cyber-securitydomain, and new knowledge is available frequently, and 3) emulating the attacker’s exploratorynature, thought process, motivation, strategy and preferences. [1] The Officeof Management and Budget, Circular A130. http://www.whitehouse.gov/omb/circulars/a130/a130trans4.html. [2]Respected-but still restrained, in Global State ofInformation Security Survey2011, PricewaterhouseCoopers.M2-D.3 Pant R, Barker K, Landers TL; rpant@ou.eduUniversity of OklahomaPOST-DISASTER RESILIENCE FOR INTERDEPENDENT SYSTEMS:APPLICATION TO INLAND PORT DISASTERSEconomic resilience is often thought of as an ability exhibited by a systemthat allows it to recover from a disruptive event in a desired time and with an acceptablecost, noting that resilience is planned for in advance of a disruptive eventthrough preparedness investments and activities. Resilience is particularly importantin interdependent systems, as disruptions can propagate, resulting in direct as wellas wider-spread indirect impacts. To estimate resilience in interdependent industryand infrastructure sectors, we build a dynamic data assimilation approach to improvethe predictive behavior of a risk-based interdependency model. In our dynamicdata assimilation approach, the “data” represent the level of recovery of the industryand infrastructure sectors after a disruptive event (e.g., attack, natural disaster) hasoccurred, leading to some or all of them being inoperable. As is often the case inreality, we assume that our estimation for sector recovery has some noise leading toerrors in forecasting recovery. We aim to minimize the error in prediction so that wecan best achieve the desired level of post disaster recovery. We apply our approachto post-disaster recovery planning for the Port of Catoosa, an inland waterway portin Oklahoma. We simulate the daily flow of commodity import-exports through theport and assume that a disruption causes an initial loss of supply leading to inoperabilityin sectors. We suggest metrics of resilience, maximum possible daily outputloss, and total sector loss and/or regional loss as indicators for preferred planningoptions for industry and infrastructure sectors. Such metrics could help in improvedpreparedness decision-making.M2-B.4 Panzl BM, Weir MH, Pope JM, Rose JB; panzlbri@msu.eduMichigan State UniversityUSE OF QUANTITATIVE MICROBIAL RISK ASSESSMENT AND PRO-JECTIVE TRANSPORT MODELS TO INFORM BEACH CLOSURESNatural water recreation locations are a well known source of gastrointestinalinfection outbreaks. Therefore a means of projecting not only potential microbialimpacts to recreational beaches, but risk of gastrointestinal infection associated withthese impacts would be a useful tool. This work is underway in an effort to develop atool for beach managers to quickly identify the risk level associated with recreationalexposure to waterborne pathogens in the environment, such as pathogenic E. coli andadenovirus. The tool uses predictive transport models for two Great Lakes beachesbased on current, local metrological conditions and water quality data allowing for aprojected risk estimate. Transport models were selected from the open literature fortwo test beaches; Silver Beach in Saint Joseph, MI and Washington Park Beach inMichigan City, IN. The first generation of the tool is an Excel macro and spreadsheet;the second generation required a more user friendly environment. Therefore Java wasselected as the software platform for the latest tool generation. The software providesa graphic user interface, generates the pathogen concentrations from the transportmodel and estimates risk to children, adults and the combined population. A built-inaspect of this tool is the capability to automatically update from the internet, whichgreatly reduces the demand on the user to generate the values independently. Theimmediate next step in the evolution of this tool is to transport it onto an androidsmart phone. This would create a dynamic aspect that would provide any potentialuser with the ability to use it on location, without the need of a computer interface.The next step in tool development is to subject the transport models to bootstrapuncertainty analysis. This tool will provide beach managers with increased decisionmaking potential with a portable means of assessing potential risk to beach users andinforming their sampling strategy.W1-B.3 Paoli G, Ryan C, Hartnett E, Golden NJ, Dearfield K, Kause J, LaBarreD, Disney T; gpaoli@risksciencesint.comRisk Sciences InternationalRISK MANAGEMENT METRICS IN DOMESTIC FOOD SAFETY ANDINTERNATIONAL TRADE CONTEXTS: THE CHANGING ROLE OFQUANTIFIED VARIABILITY AND UNCERTAINTY IN DIFFERENTCONTEXTSThe Sanitary and Phytosanitary Agreement contemplates the application ofrisk-informed sanitary measures through the application of a concept referred toas the Appropriate Level of Protection. In the area of microbiological food safety,155