Security Risk Assessment for Transport Operators - Department of ...

Sources of security risk can be looked at both in terms of the potential perpetrator and method(such as the threat from an arson attack [method] by animal rights activists [perpetrator]). To avoidover complicating the assessment and to incorporate the threat from a range of groups, the methodis often however referred to on its own (i.e. the threat from an arson attack).Table 2: Example sources of riskPotential sources of riskarson cyber attack armed assaulthijacking sabotage rioting and civil unrestsurveillance suicide bomber car bombchemical attack biological attack radiological attackpiracy package bomb hostage taking1.3.2 MethodologyWhen identifying sources of risk, it is useful to think both strategically and operationally to ensurethat all potential sources are considered. You may want to refer to the list of critical assets identifiedin Section 1.2 to assist the process.Table 3: Suggested methods for identifying sources of riskMethod Detail ExamplePools ofexpertsPastknowledgeStaffHorizonscanningThreatexpertsA collection of expertsfrom different fieldsA review of past incidentsto identify previouslyrealised threatsReviewing staff reportsof suspicious activityAnticipating future threatsHarnessing theknowledge of subjectmatter expertsFor a rail company, a representative groupmay consist of a driver, manager and engineerReviewing historical attacks against other vesselsglobally, may assist a ferry operator identify potentialthreats that may be enacted domesticallyEncouraging depot managers to report anythreats they encounter, will assist in identifyingpotential trendsA major international event such as a G20 Summit,may bring additional threats not previously presentCyber attack may be identified as a threat, butexperts will be able to drill down to establish furtherdetailed elements such as malware or virusesWorkshop Group discussion At a business unit level, participants may wish toconsider which threats may affect their ability todeliver on the unit’s key objectivesOptional advanced technique:For companies looking to gaina better understanding of theirsources of risk, a more thoroughthreat assessment may be needed.Further detail on conducting athreat assessment can be foundin Appendix A.2 on page 33.Example 1: Identifying sources of riskWhilst undertaking a horizon scan for upcoming events, a bus company notes that asoccer match between teams from countries with historical political tensions is due to takeplace at a location serviced by the operator.As relations between the two countries have recently deteriorated, an extremist group inAustralia associated with one team has threatened violence against fans from the other.The company will be transporting the threatened team’s supporters. As a result, ‘politicalviolence’ is identified as a source of risk which has the potential to affect the bus company’scritical assets.Security Risk Assessment Guide 11