Industrial Security

David L Russell, PE is an Environmental Engineer with a background in consulting and in the Chemical Industry. He has over 40 years of experience including 9 years in the chemical industry for Hooker, IMC Chemical and Allied Chemicals. He was an instructor through the American Institute of Chemical Engineers where he taught courses in Practical Wastewater Treatment and Hazardous Materials and Hazardous Wastes. Russell has lectured on security topics to the NATO Advanced Scientific Institute, and has lectured on the responses to terrorism for the Dubai Water and Power Utility, Dubai, UAE, and  taught  plant security to the Security force for Saudi Aramco,  and  General Industries Petroleum Corporation, in Bahrain, Security Force. Lieutenant Colonel  Pieter Arlow is a Senior  Officer within the South African National Defense Force (SANDF), and has over 30 years of experience.  He is also an instructor and Senior Security Officer, and has organized  and managed many security projects.  As an Officer of the SANDF, Lt.Col. Arlow has expertise in risk analysis management, risk assessment, military operations management, intelligence and counter-intelligence, terrorism and counter insurgency, force employment and operations and security management. Additionally he had been appointed as the Joint Commander for national events such as the Commonwealth Heads of Government Meetings and the World Economic Forums and has organized security for events such as the 2010 FIFA World Cup.

• Chapter 1 Introduction to Security Risk Assessment and Management 1Introduction 1Business Definition 1Security Versus Risk 2Framework for Risk Management 2Value at Risk 5Calculation of Risk 6Risk Assessment Versus Risk Management 6Risk Management Plans 8Threat Scenarios 9Statistics and Mathematics 10Pairing Vulnerability and Threat Data 11Setting Priorities 13Other Definitions of Risk Assessment 14Business Definition for Risk Assessment 14Broad Definition for Risk Assessment 15Quantitative Risk Assessment 15Qualitative Risk Assessment 15Threats 15Vulnerabilities 15Countermeasures for Vulnerabilities 16The D’s of security systems 16Sample Threat Scenario No. 1 18Background 18Sample Threat Scenario No. 2 23Background 23Chapter 2 Risk Assessment Basics 29Street Calculus and Perceived Risk 29Street Calculus 29Security Risk Assessment Structure 32Value at Risk 32Sandia Laboratory’s Risk Assessment Analysis 33Annualized Cost Analysis of Risk 34Scenario‐Driven Cost Risk Analysis 36Real‐world example 37Model‐Based Risk Analysis 37MBRA example case 38Risk Management by Fault Tree Methods and Risk‐Informed Decision Management 39Fault tree analysis 39RIDM 42Chapter 3 Assessing Types of Attacks and Threats with Data Sources 62Weapons 62AK‐47 62M16 62Sniper rifles 63Muzzle Energies for Various Cartridges 63Rifle Grenades 63Rocket‐Propelled Grenades and Mortars 64Explosive Energies 65Impact of explosives 66Other Types of Incidents and Accidents 68Chapter 4 Evaluating a Company’s Protective Systems 70Surveys and Assessments 70Site Security Assessments 71Checklists 71Cyber security checklist 71Lighting 72Perimeter Barriers: Design Notes and Comments 74CCTV 79Windows and Doors 81Chapter 5 Port Security 82Ranking Threats 82Natural threats 82Man‐made/accidental threats 82Intentional acts—delivery vectors 83Weapon threats 83Levels of Port Security 83Security response plans 84Recommended procedures 84Identification Procedures for Personnel Screening 85Employees 85Vendors/contractors/vessel pilots 85Truck drivers/passengers 85Visitors (all personnel not falling into other categories) 86Government employees 86Vessel personnel access through a facility 86Search requirements 86Acceptable identification 87Access control 87Vessel Arrival and Security Procedures While Moored 87Internal Security 88Vehicle control 88Rail security 88Key/ID/access card control 88Computer security 89Security rounds 89Perimeter Security and Restricted Areas 89Barriers 89Fencing 89Lighting 90Security Alarms/Video Surveillance/Communications Systems 90Alarms 90Video surveillance 90Communications systems 91Training and Security Awareness 91Floating Barriers 91Chapter 6 Basics of Cyber security 93Communications Life Cycle 93Some Solutions to the Problem of Cyber crime 94General recommendations 94Communications Security 96Communications as Transactions 96Telephone System Security 96Radio Communications 97Digital Communications 97Cyber security 98Vulnerability assessment 98Unknowns and alternatives 99How to Perform the Vulnerability Assessment 99Critical success factors 99Optimum assessment team size 101Communications Procedure Design: Hints and Helps 101Benefits: Identified 102Example 102Cyber Threat Matrix: Categories of Loss and Frequency 103Setting up Internet Security 104External versus internal testing 105Security focus 105Browser and domain security 105Data encryption 106Cyber security Tools 107Chapter 7 Scenario Planning and Analyses 109Introduction 109Fta, Markov Chains, and Monte Carlo Methods 110Fuzzy fault trees 111Markov chains and Bayesian analysis 111Other Complimentary Techniques 112Fishbone (Ishikawa) diagrams 112Pareto charts 114Sample of Initial Analysis 114Failure Modes and Effects Analysis 119Dhs Analysis and Plans 120Bow‐Tie Analysis 124Example 125Hazops and Process Safety Management 127Process safety information: General 127PHA and HAZOPS 128Aloha, Cameo, and Security Planning Tools 129The Colored Books 133Generic Guideline for the Calculation of Risk Inherent in the Carriage of Dangerous Goods by Rail 133The Orange Book: Management of Risk—Principles and Concepts 133The Green Book: Methods for the Determination of Possible Damage to People and Objects Resulting from Release of Hazardous Materials, CPR‐16E 135The Yellow Book: Methods for the Calculation of Physical Effects due to the Releases of Hazardous Materials (Liquids and Gases), CPR‐14E 137The Red Book: Methods for Determining and Processing Probabilities, CPR‐12 137The Purple Book: Guidelines for Quantitative Risk Assessment, PGS 3 137Sample outline for emergency response 141Chapter 8 Security System Design and Implementation: Practical Notes 148Security Threat‐Level Factors 148Considered Factors 148Vehicle bombs 149Standoff weapons 151Minimum standoff distances 151Security System Design 153Perimeter barriers 154Active vehicle barriers 154Entry roadways 155Entry control stations 156Reinforcement of buildings and infrastructure 156Windows 156Security system lighting 157Lighting system design 157Electronic Security Systems Design 157Alarm configurations and design 158Access control 159Employee screening 160Visitor identification and control 160Packages, personnel, and vehicle control 161Lock and key systems 161Security forces 162Cargo security 162Port security systems 163Review and Assessment of Engineering Design and Implementation 163Auditing and evaluation 163Risk assessment team 164Blank sheet approach to auditing and evaluation 165Business approach to auditing and evaluation 165Benchmarking 166How to evaluate a physical security system? 167Security systems audits 167What to review? 168Implementation of risk assessment 174SQUARE: Prioritizing security requirements 177Security monitoring and enforcement 179Security awareness program 180Proposed future training requirements 180Security management 180The differing roles of the security department 181Stress management techniques 181Security management techniques 184Conclusion 186Appendix I 187Appendix II 196Index 204