Metrics and Methods for Security Risk Management

Transcription

1 Metrics and Methods for Security Risk Management Carl S. Young ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO Syngress is an imprint of Elsevier SYNGRESS.

2 Table of Contents About the Author Foreword Preface Acknowledgments xi xiii xv xix PART I THE STRUCTURE OF SECURITY RISK CHAPTER 1 Security Threats and Risk Introduction to Security Risk or Tales of the Psychotic Squirrel and the Sociable Shark The Fundamental Expression of Security Risk Introduction to Security Risk Models and Security Risk Mitigation Summary 17 CHAPTER 2 The Fundamentals of Security Risk Measurements Introduction : Linearity and Non-linearity Exponents, Logarithms and Sensitivity to Change The Exponential Function e x The Decibel (db) Security Risk and the Concept of Scale Some Common Physical Models in Security Risk Visualizing Security Risk An Example: Guarding Costs Summary, 43 CHAPTER 3 Risk Measurements and Security Programs Introduction The Security Risk Assessment Process Unique Threats Motivating Security Risk Mitigation: The Five Commandments of Corporate Security Security Risk Models Managing Security Risk The Security Risk Mitigation Process Security Risk Standards 58 vii

3 viii Table of Contents PART II 3.4 Security Risk Audits Security Risk Program Frameworks Summary 73 MEASURING AND MITIGATING SECURITY RISK CHAPTER 4 Measuring the Likelihood Component of Security Risk Introduction Likelihood or Potential for Risk? Estimating the Likelihood of Randomly Occurring Security Incidents Estimating The Potential for Biased Security Incidents Averages and Deviations Actuarial Approaches to Security Risk Randomness, Loss, and Expectation Value Financial Risk Summary 107 CHAPTER 5 Measuring the Vulnerability Component of Security Risk Introduction Vulnerability to Information Loss through Unauthorized Signal Detection Energy, Waves and Information Ill Introduction to Acoustic Energy and Audible Information Transmission of Audible Information and Vulnerability to Conversation-Level Overhears Audible Information and the Effects of Intervening Structures ' Introduction to Electromagnetic Energy and Vulnerability to Signal Detection Electromagnetic Energy and the Effects of Intervening Structures Vulnerability to Information Loss through Unauthorized Signal Detection: A Checklist Vulnerability to Explosive Threats Explosive Parameters Confidence Limits and Explosive Vulnerability A Theory of Vulnerability to Computer Network Infections Biological, Chemical and Radiological Weapons Introduction 151

4 Table of Contents ix Vulnerability to Radiological Dispersion Devices Vulnerability to Biological Threats Vulnerability to External Contaminants; Bypassing Building Filtration Vulnerability to Chemical Threats The Visual Compromise of Information Summary 175 CHAPTER 6 Mitigating Security Risk: Reducing Vulnerability Introduction Audible Signals Acoustic Barriers Sound Reflection Sound Absorption Electromagnetic Signals Electromagnetic Shielding Intra-Building Electromagnetic Signal Propagation Inter-Building Electromagnetic Signal Propagation Non-Point Source Electromagnetic Radiation Vehicle-borne Explosive Threats: Barriers and Bollards Explosive Threats Radiological Threats Biological Threats Paniculate Filtering Ultraviolet Germicidal Irradiation (UVGI) Combining UVGI with Particulate Filtering More Risk Mitigation for Biological Threats Relative Effectiveness of Influenza Mitigation Mitigating the Risk of Chemical Threats (briefly noted) Guidelines on Reducing the Vulnerability to Non-Traditional Threats in Commercial Facilities Commercial Technical Surveillance Countermeasures (TSCM) Electromagnetic Pulse (EMP) Weapons Summary 238 Epilogue 243 Appendix A 245 Appendix B 247 Appendix C 249

5 x Table of Contents Appendix D 251 Appendix E 253 Appendix F 255 Appendix G 257 Appendix H 259 Index 261