Risk, Threat, and Vulnerability Assessment

Transcription

1 Risk, Threat, and Vulnerability Assessment October 23 24, 2014 Earn up to 14 CPEs New Program EXPERIE NCE, DED IC ON AT I D, AN LEA DE RS HIP IN SE R CU ITY E C DU AT IO N

2 REDUCE RISK INCREASE RESILIENCE Be a critical business partner to senior management Create added value for your department and organization by learning the effectiveness of a proper risk, threat, and vulnerability assessment. Start with solid definitions and differentiators between risk, threat, and vulnerability and then see how assessments are absolutely essential for organizational resilience. Certain kinds of people controls can limit damage and must be considered. Review asset-threat/hazard pairs that should receive measures to mitigate vulnerabilities and reduce risk. The common practice of not reporting intrusions to law enforcement could make a difference to your risk assessment team and needs to be considered. Learn about acceptable business risk thresholds and the metrics you can use to describe them. Meeting corporate objectives is an essential part of any discussion as well as what the CSO can do to prepare a solid business case and address cost and operational optimization and sustainability using the risk assessment methodology. LEARNING OUTCOMES Learn how to develop an effective risk assessment program. Create an effective risk assessment process that is increasingly important to the success of your organization. Form the foundation of an effective enterprise risk management program. Understand how to integrate risk assessment into the business process in a way that provides timely and relevant risk information to management. Understand the necessity in identifying necessary people and assets that provide the enterprise tangible and intangible value. Learn about risk criteria when evaluating the significance of risk. PROFESSIONALLY DEVELOPED FOR Risk management personnel Individuals with risk management and homeland security Specialists/managers/directors of critical infrastructure security programs Business continuity planners Facility and infrastructure managers Emergency management professionals Architects, designers, integrators Security directors HR professionals Corporate security professionals University and campus security professionals Security program and project managers Save $100 with early bird pricing. Practitioners responsible for their organization s physical security controls Personnel directly involved in the design, specification implementation, operation, or maintenance of security systems

3 PROGRAM OVERVIEW Communicating, Consulting, Establishing the Context, and Developing the Business Case The key task behind planning and conducting a risk assessment program is developing an understanding of the organization to be assessed. Risk Management Process Learn how and why the risk management context of the organization describes the scope as well as risk control parameters, methods, and plans currently in place for the risk management activities. Before starting the design and implementation of the risk assessment program, it is important to understand the objectives of the risk management program and to evaluate and understand both the extent and efficacy of the current risk control measures and system. Risk Assessment Analyzing the Risk The scope of the risk assessment program should be defined in order to achieve the risk assessment objectives and should consider the context of the organization, its needs, and requirements. The scope should define the processes, functions, activities, physical boundaries (facilities and locations), and stakeholders to include within the boundaries of the risk assessment program. The scope of the risk assessment program will have a direct effect on the resource and time requirements needed for the individual risk assessments. When setting the scope of the risk assessment program, it should be kept in mind that resource and time requirements are directly proportional to the size of the scope. Risk Assessment Treatment of the Risks/Mitigation Risk rating scales are defined in relation to organizations objectives in scope. Risks are typically measured in terms of impact and likelihood of occurrence. Impact scales of risk should mirror the units of measure used for organizational objectives, which may reflect different types of impact such as financial, people, and/or reputation. Similarly, the time perspective used to assess the likelihood of risks should be consistent with the time perspectives related to objectives. Organizational Resilience and Risk Quintessential in completing proper risk assessment is understanding the process of resiliency. Building a resilient organization is a cross-disciplinary and cross-functional endeavor. An organizational resilience approach to managing risks encourages critical infrastructure businesses to develop a more natural capability to deal with unexpected disruptions to business-asusual activity. The resilience approach also helps organizations adapt to changes in their operating environment that occur over longer timeframes thereby demonstrating the importance of risk assessment. Risk Assessment Test, Measure, Review, Document Control, and Assurance Understand the various tools and techniques that can be utilized to determine risk assessment. Identify how the organization can now bring its individual residual risk ratings together into a portfolio view to identify interdependencies and interconnections between risks, as well as the effect of risk responses on multiple risks. Management can then determine any actions necessary to revise its risk responses or address design or effectiveness of controls. Successful implementation should translate into reduced risk exposures on the organization s risk map. Site Visit Practically apply the principles set forth through a site visit (site to be determined). The key to any proper security master plan and the maintenance of organizational resilience is the objective evaluation of risk in which assumptions and uncertainties are clearly considered and presented. Risk assessments, if performed properly, provide that through a comprehensive examination of threats and vulnerabilities to determine that potential for loss. Please Note: Registrants should be aware that this course includes a visit to a third party site and that the host organization may require the use of non-disclosure agreements. Subject to the requirements of the host organization, the agreements offered to nationals and non-nationals of the host country may differ. Program content updates will be posted at

4 FAST FACTS Registration Hours Wednesday 5:00 6:00 pm Thursday 7:00 8:00 am Program Hours Thursday Friday 8:00 am 5:00 pm Registration Fees Fees include daily continental breakfast, refreshment breaks, and a networking reception. Hotel costs are not included. Early bird cutoff: August 30, 2014 Early-bird After Member $ 825 $ 925 Nonmember $1,125 $1,225 Hotel Be sure to mention ASIS when requesting the special room rate of $169 single/ double (plus tax). It will be honored until the room block is full or September 28. Westin Las Vegas, Hotel, Casino and Spa 160 East Flamingo Road Instructor J. Kelly Stewart, CFC, CAS Managing Principal & CSO Newcastle Consulting, LLC Leesburg, Virginia Mr. Stewart brings 25 years of public and private experience as a seasoned senior international security executive in leading multi-national security risk management operations and complex physical security programs, recently with several Fortune 500 and 1000 companies. He is and has been a key leadership advisor and business partner in developing and executing security strategies in support of overall corporate resiliency and is a well-respected security visionary, strong collaborator, and highly effective communicator. Mr. Stewart served a distinguished tenure with the United States Secret Service coordinating advance operations with law enforcement representatives as well as completing multiple advances for presidential and first family trips. He has been a key advisor to the Chief of Defense Nuclear Security and has managed teams within the Department of Energy and the National Nuclear Security Administration (NNSA). Mr. Stewart holds master s degrees in security management, project management, and an MBA in international business. He is board certified as a homeland security professional, an antiterrorism specialist, and as a forensic consultant. He is chair of ASIS Security Architecture and Engineering Council and of the Standards and Guidelines Committee for ASIS Physical Security Council. Mr. Stewart is also chairman of the International Security Management Association s (ISMA) Education Committee and Emerging Issues for Emerging Leaders (EIFEL) Seminar Program. Team Discounts 10% off when three to five attendees register from the same organization; 15% for six or more. For details, [email protected]. Updates will be posted online HOW TO REGISTER Web Phone

5 Upcoming Programs AUGUST SEPTEMBER cont.. 6 SAFETY Act: Legal Liability Protection for Providers or Users of Effective Anti-Terrorism Products and Services Webinar 20 Critical Infrastructure Protection from a Private-Security Perspective Webinar SEPTEMBER CPP, PCI, PSP Classroom Reviews Atlanta, GA School Safety and Security: What We Need is a Plan Critical Thinking Skills for Security Solutions Certificate Program Developing and Implementing an Insider Threat Program Certificate Program 28 A Risk Assessment Approach to Facility Security Design Banking and Financial Services Security Tools and Emerging Trends Securing Healthcare Facilities Future Expectations, New Programs, and Security Officer Implementation Protecting Critical Infrastructure: From Concept to Implentation Successful Physical Security Projects Integrating People, Process, and Technology Becoming a Successful Security Consultant Atlanta, GA 29-Oct 2 60th Annual Seminar & Exhibits Atlanta, GA Join 20,000+ professionals at the world s most influential security event. 30-Oct 2 Education sessions sponsored by ASIS Gaming and Wagering Protection Council for Global Gaming Expo OCTOBER 15 The Art and Science of Selling Security Guard Services Webinar Video Surveillance: Applications and Advances Risk, Threat and Vulnerability Assessment Corporate Investigations How to Conduct Proper and Effective Internal Investigations Denver, CO The Investigative Interviewing Method Denver, CO NOVEMBER View full calendar at Programming, schedule, locations, and pricing are subject to change. 3-4 Executive Protection Certificate Program Philadelphia, PA 3-6 ASIS Assets Protection Course TM : Principles of Security (APC I) Philadelphia, PA About ASIS International ASIS International (ASIS) is the preeminent organization for security professionals, with more than 38,000 members worldwide. Founded in 1955, ASIS is dedicated to increasing the effectiveness and productivity of security professionals by developing educational programs and materials that address broad security interests, such as the ASIS Annual Seminar and Exhibits, as well as specific security topics. ASIS also advocates the role and value of the security management profession to business, the media, government entities, and the public. By providing members and the security community with access to a full range of programs and services, and by publishing the industry s number one magazine Security Management ASIS leads the way for advanced and improved security performance.

6 Risk, Threat, and Vulnerability Assessment October 23 24, 2014 ASIS Delivers Distinctive Security Education Save $100! Register by August 30 Leading security practitioners, who face the same challenges you face, develop and deliver distinctive ASIS programs. They address real-world security issues through personal experiences and by applying theories, proven and tested by leading security professionals. Your colleagues highly rate ASIS programs for providing best practices and the newest strategies for mitigating ever-changing security threats today s implementation for tomorrow s security. For more information, visit Prince Street Alexandria, VA USA Non-Profit US Postage PAID ASIS