Security Vulnerability Assessment Methodology For The .
May 2003Security Vulnerability AssessmentMethodology for the Petroleum andPetrochemical Industries
May 2003Security Vulnerability AssessmentMethodology for the Petroleum andPetrochemical IndustriesAmerican Petroleum Institute1220 L Street, NWWashington, DC20005-4070National Petrochemical &Refiners Association1899 L Street, NWSuite 1000Washington, DC20036-3896
PREFACEThe American Petroleum Institute (API) and the National Petrochemical & ReÞners Association (NPRA) are pleased to make this Security Vulnerability Assessment Methodology available to the petroleum industry. The information contained herein has been developed incooperation with government and industry, and is intended to help reÞners, petrochemicalmanufacturers, and other segments of the petroleum industry maintain and strengthen facilitysecurity.API and NPRA wish to express sincere appreciation to their member companies who havemade personnel available to work on this document. We especially thank the Department ofHomeland Security and its Directorate of Information Analysis & Infrastructure Protectionand the Department of EnergyÕs Argonne National Laboratory for their invaluable contributions. The lead consultant in developing this methodology has been David Moore of AcuTechConsulting, whose help and experience was instrumental in developing this document in sucha short time.This methodology constitutes one approach for assessing security vulnerabilities at petroleumand petrochemical industry facilities. However, there are several other vulnerability assessment techniques and methods available to industry, all of which share common risk assessment elements. Many companies, moreover, have already assessed their own security needsand have implemented security measures they deem appropriate. This document is notintended to supplant measures previously implemented or to offer commentary regarding theeffectiveness of any individual company efforts.The focus of this Þrst edition was on the needs of reÞning and petrochemical manufacturingoperations. In particular, this methodology was Þeld tested at two reÞnery complexes, including an interconnected tank farm, marine terminal and lube plant. It is intended that future editions of this document will address other segments of the petroleum industry such as liquidpipelines and marketing terminals.API and NPRA are not undertaking to meet the duties of employers, manufacturers, or suppliers to train and equip their employees, nor to warn any who might potentially be exposed, concerning security risks and precautions. Ultimately, it is the responsibility of the owner oroperator to select and implement the security vulnerability assessment method and depth ofanalysis that best meet the needs of a speciÞc location.American Petroleum InstituteNational Petrochemical & ReÞners AssociationApril 30, 2003iii
CONTENTSPageCHAPTER 1 INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.1 Introduction to Security Vulnerability Assessment . . . . . . . . . . . . . . . . . . . . . . . .1.2 Objectives, Intended Audience and Scope of the Guidance . . . . . . . . . . . . . . . . .1.3 Security Vulnerability Assessment and Security Management Principles . . . . . .1112CHAPTER 2 SECURITY VULNERABILITY ASSESSMENT CONCEPTS. . . . . . . . . .2.1 Introduction to SVA Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.2 Risk DeÞnition for SVA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.3 Consequences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.4 Asset Attractiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.5 Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.6 Vulnerability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.7 SVA Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.8 Characteristics of a Sound SVA Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.9 SVA Strengths and Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.10 Recommended Times for Conducting and Reviewing the SVA. . . . . . . . . . . . . .2.11 Validation and Prioritization of Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.12 Risk Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3334455567888CHAPTER 3 API/NPRA SECURITY VULNERABILITY ASSESSMENTMETHODOLOGY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.1 Overview of the API/NPRA SVA Methodology. . . . . . . . . . . . . . . . . . . . . . . . . . 93.2 SVA Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143.33.43.53.63.73.8Step 1: Assets Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Step 2: Threat Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .SVA Step 3: Vulnerability Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Step 4: Risk Analysis/Ranking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Step 5: Identify Countermeasures: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Follow-up to the SVA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .ATTACHMENT 1172123272728EXAMPLE API/NPRA SVA METHODOLOGY FORMS . . . . . . 29GLOSSARY OF TERMS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40ABBREVIATIONS AND ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43APPENDIX ASVA SUPPORTING DATA REQUIREMENTS . . . . . . . . . . . . . . . . . . 45APPENDIX BSVA COUNTERMEASURES CHECKLIST . . . . . . . . . . . . . . . . . . . . . 49APPENDIX CAPI/NPRA SVA INTERDEPENDENCIES ANDINFRASTRUCTURE CHECKLIST . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152v
PageFigures2.1 API/NPRA SVA Methodology, Risk DeÞnition . . . . . . . . . . . . . . . . . . . . . . . . . . . 32.2 API/NPRA SVA Methodology, SVA Risk Variables . . . . . . . . . . . . . . . . . . . . . . . . 32.3 API/NPRA SVA Methodology, Asset Attractiveness Factors . . . . . . . . . . . . . . . . . 42.4 API/NPRA SVA Process Overall Asset Screening Approach . . . . . . . . . . . . . . . . . 62.5 API/NPRA SVA Methodology, Recommended Times for Conductingand Reviewing the SVA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.1 API/NPRA Security Vulnerability Assessment Methodology . . . . . . . . . . . . . . . 103.1a API/NPRA Security Vulnerability Assessment MethodologyÑStep 1. . . . . . . . . 113.1b API/NPRA Security Vulnerability Assessment MethodologyÑStep 2 . . . . . . . . 123.1c API/NPRA Security Vulnerability Assessment MethodologyÑSteps 3Ð5 . . . . . 133.2 API/NPRA SVA Methodology Timeline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143.3 API/NPRA SVA Team Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153.4 SVA Sample Objectives Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153.5 API/NPRA SVA Methodology, Security Events of Concern . . . . . . . . . . . . . . . . 163.6 API/NPRA SVA Methodology, Description of Step 1 and Substeps . . . . . . . . . . 183.7 API/NPRA SVA Methodology, Example Candidate Critical Assets . . . . . . . . . . 183.8 API/NPRA SVA Methodology, Possible Consequences of API/NPRASVA Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.9 API/NPRA SVA Methodology, Example DeÞnitions of Consequencesof the Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.10 API/NPRA SVA Methodology, Description of Step 2 and Substeps . . . . . . . . . . 213.11 API/NPRA SVA Methodology, Threat Rating Criteria . . . . . . . . . . . . . . . . . . . . . 243.12 API/NPRA SVA Methodology, Target Attractiveness Factors (for Terrorism) . . 243.13 API/NPRA SVA Methodology, Attractiveness Factors Ranking DeÞnitions (A) . 243.14 API/NPRA SVA Methodology, Description of Step 3 and Substeps . . . . . . . . . . 253.15 API/NPRA SVA Methodology, Vulnerability Rating Criteria . . . . . . . . . . . . . . . 263.16 API/NPRA SVA Methodology, Description of Step 4 and Substeps . . . . . . . . . . 273.17 API/NPRA SVA Methodology, Risk Ranking Matrix . . . . . . . . . . . . . . . . . . . . . 273.18 API/NPRA SVA Methodology, Description of Step 5 and Substeps . . . . . . . . . . 28vi
Security Vulnerability Assessment Methodology for the Petroleumand Petrochemical IndustriesChapter 1 Introductionto other operations within the petroleum industry such as liquid pipelines and marketing terminals.This methodology constitutes one approach for assessingsecurity vulnerabilities at petroleum and petrochemicalindustry facilities. However, there are several other vulnerability assessment techniques and methods available to industry, all of which share common risk assessment elements.Many companies, moreover, have already assessed their ownsecurity needs and have implemented security measures theydeem appropriate. This document is not intended to supplantmeasures previously implemented or to offer commentaryregarding the effectiveness of any individual company efforts.Ultimately, it is the responsibility of the owner/operator tochoose the SVA method and depth of analysis that best meetsthe needs of the speciÞc location. Differences in geographiclocation, type of operations, and on-site quantities of hazardous substances all play a role in determining the level of SVAand the approach taken. Independent of the SVA methodused, all techniques include the following activities:1.1 INTRODUCTION TO SECURITYVULNERABILITY ASSESSMENTThe Þrst step in the process of managing security risks is toidentify and analyze the threats and the vulnerabilities facinga facility by conducting a Security Vulnerability Assessment(SVA). The SVA is a systematic process that evaluates thelikelihood that a threat against a facility will be successfuland considers the potential severity of consequences to thefacility itself, to the surrounding community and on theenergy supply chain. The SVA process is a team-basedapproach that combines the multiple skills and knowledge ofthe various employees to provide a complete picture of thefacility and its operations. Depending on the type and size ofthe facility, the SVA team may include individuals withknowledge of physical and cyber security, process safety,facility and process design and operations, emergencyresponse, management and other disciplines as necessary.The objective of conducting a SVA is to identify securityhazards, threats, and vulnerabilities facing a facility, and toevaluate the countermeasures to provide for the protection ofthe public, workers, national interests, the environment, andthe company. With this information security risks can beassessed and strategies can be formed to reduce vulnerabilities as required. SVA is a tool to assist management in making decisions on the need for countermeasures to address thethreats and vulnerabilities. Characterize the facility to understand what criticalassets need to be secured, their importance and theirinterdependencies and supporting infrastructure; Identify and characterize threats against those assetsand evaluate the assets in terms of attractiveness of thetargets to each adversary and the consequences if theyare damaged or stolen; Identify potential security vulnerabilities that threatenthe assetÕs service or integrity; Determine the risk represented by these events or conditions by determining the likelihood of a successfulevent and the consequences of an event if it were tooccur;1.2 OBJECTIVES, INTENDED AUDIENCE ANDSCOPE OF THE GUIDANCEThis document was prepared by the American PetroleumInstitute (API) and the National Petrochemical & ReÞnersAssociation (NPRA) Security Committees to assist the petroleum and petrochemical industries in understanding securityvulnerability assessment and in conducting SVAs. The guidelines describe an approach for assessing security vulnerabilities that is widely applicable to the types of facilities operatedby the industry and the security issues they face. During thedevelopment process it was Þeld tested at two reÞneries, twotank farms, and a lube plant, which included typical processequipment, storage tanks, marine operations, infrastructure,pipelines, and distribution terminals for truck and rail. Basedon these trials and the generic nature of the overall methodology, its use at other types of petroleum and petrochemicalfacilities is expected to be suitable. In future editions of thisguidance, it is intended that speciÞc attention will be devoted Rank the risk of the event occurring and, if high risk,make recommendations for lowering the risk; Identify and evaluate risk mitigation options (both netrisk reduction and beneÞt/cost analyses) and re-assessrisk to ensure adequate countermeasures are beingapplied.This guidance was developed for the industry as an adjunctto other available references which includes: American Petroleum Institute, ÒSecurity Guidelines forthe Petroleum IndustryÓ, May, 2003; API RP-70, ÒSecurity for Offshore Oil and Natural GasOperationsÓ, First Edition, April, 2003;1
2AMERICAN PETROLEUM INSTITUTE AND NATIONAL PETROCHEMICAL & REFINERS ASSOCIATION ÒGuidelines for Managing and Analyzing the SecurityVulnerabilities of Fixed Chemical SitesÓ1, AmericanInstitute of Chemical Engineers (AIChE) Center forChemical Process Safety (CCPS ), August, 2002; ÒVulnerability Analysis Methodology for ChemicalFacilities (VAM-CF)Ó, Sandia National Laboratories,2002.The AIChE CCPS SVA methodology has been used as abasis for the API NPRA SVA methodology, but a more speciÞc approach relevant to the petroleum and petrochemicalindustry is included. The CCPS method is a general chemical industry approach, so it has been tailored for this guidance. The API/NPRA SVA approach is intended to be anequivalent method to the CCPS criteria for SVAs. Owner/Operators may want to use any of the methods above, oranother equivalent and appropriate methodology in conducting their SVAs. These guidelines should also be considered inlight of any applicable federal, state and local laws and regulations.The guidance is intended for site managers, security managers, process safety managers, and others responsible forconducting security vulnerability analyses and managingsecurity at petroleum and petrochemical facilities.The method described in this guidance may be widelyapplicable to a full spectrum of security issues, but the keyhazards of concern are malevolent acts, such as terrorism, thathave the potential for widespread casualties or damage.These guidelines provide additional industry segment speciÞc guidance to the overall security plan and SVA methodpresented in Part I of the API Security Guidelines for thePetroleum Industry.21.3 SECURITY VULNERABILITY ASSESSMENTAND SECURITY MANAGEMENT PRINCIPLESOwner/Operators should ensure the security of facilitiesand the protection of the public, the environment, workers,and the continuity of the business through the management ofsecurity risks. The premise of the guidelines is that securityrisks should be managed in a risk-based, performance-oriented management process.The foundation of the security management approach isthe need to identify and analyze security threats and vulnerabilities, and to evaluate the adequacy of the countermeasuresprovided to mitigate the threats. Security Vulnerability1American Institute of Chemical Engineers (AIChE) Center forChemical Process Safety (CCPS) ÒGuidelines for Managing andAnalyzing the Security Vulnerabilities of Fixed Chemical SitesÓ,August, 20022 American Petroleum Institute, ÒSecurity Guidelines for the Petroleum IndustryÓ, May, 2003Assessment is a management tool that can be used to assist inaccomplishing this task, and to help the owner/operator inmaking decisions on the need for and value of enhancements.The need for security enhancements will be determinedpartly by factors such as the degree of the threat, the degree ofvulnerability, the possible consequences of an incident, andthe attractiveness of the asset to adversaries. In the case of terrorist threats, higher risk sites are those that have criticalimportance, are attractive targets to the adversary, have a highlevel of consequences, and where the level of vulnerabilityand threat is high.SVAs are not a quantitative risk assessment, but are performed qualitatively using the best judgment of the SVATeam. The expected outcome is a qualitative determination ofrisk to provide a sound basis for rank ordering of the securityrelated risks and thus establishing priorities for the application of countermeasures.3A basic premise is that all security risks cannot be completely prevented. The security objectives are to employ fourbasic strategies to help minimize the risk:1. Deter2. Detect3. Delay4. RespondAppropriate strategies for managing security can varywidely depending on the individual circumstances of thefacility, including the type of facility and the threats facingthe facility. As a result, this guideline does not prescribe security measures but instead suggests means of identifying, analyzing, and reducing vulnerabilities. The speciÞc situationsmust be evaluated individually by local management usingbest judgment of applicable practices. Appropriate securityrisk management decisions must be made commensuratewith the risks. This ßexible approach recognizes that thereisnÕt a uniform approach to security in the petroleum industry,and that resources are best applied to mitigate high risk situations primarily.All Owner/Operators are encouraged to seek out assistanceand coordinate efforts with federal, state, and local lawenforcement agencies, and with the local emergency servicesand Local Emergency Planning Committee. Owner/Operators can also obtain and share intelligence, coordinate training, and tap other resources to help deter attacks and tomanage emergencies.3Guidelines for Managing and Analyzing the Security Vulnerabilities of Fixed Chemical Sites, American Institute of ChemicalEngineers, August 2002.
SECURITY VULNERABILITY ASSESSMENT METHODOLOGY FOR THE PETROLEUM AND PETROCHEMICAL INDUSTRIESChapter 2 Security VulnerabilityAssessment Concepts2.1 INTRODUCTION TO SVA TERMSA Security Vulnerability Assessment is the process thatincludes determining the likelihood of an adversary successfully exploiting vulnerability, and the resulting degree ofdamage or impact. Based on this assessment, judgments canbe made on the need for additional countermeasures. To conduct a SVA, key terms and concepts must be understood asexplained in this chapter.2.2 RISK DEFINITION FOR SVAFor the purposes of a SVA, the deÞnition of risk is shownin Figure 2.1. The risk that is being analyzed for the SVA isdeÞned as an expression of the likelihood that a deÞned threatwill target and successfully attack a speciÞc security vulnerability of a particular target or combination of targets to causea given set of consequences. The risk variables are deÞned asshown in Figure 2.2.A high risk event, for example, is one which is representedby a high likelihood of a successful attack against a given criti
The focus of this Þrst edition was on the needs of reÞning and petrochemical manufacturing operations. In particular, this methodology was Þeld tested at two reÞnery complexes, includ- . 1.3 Security Vulnerability Assessment and Security Management Principles. . . . . . 2 . facility and process design and operations, emergency response .
Bruksanvisning för bilstereo . Bruksanvisning for bilstereo . Instrukcja obsługi samochodowego odtwarzacza stereo . Operating Instructions for Car Stereo . 610-104 . SV . Bruksanvisning i original
10 tips och tricks för att lyckas med ert sap-projekt 20 SAPSANYTT 2/2015 De flesta projektledare känner säkert till Cobb’s paradox. Martin Cobb verkade som CIO för sekretariatet för Treasury Board of Canada 1995 då han ställde frågan
service i Norge och Finland drivs inom ramen för ett enskilt företag (NRK. 1 och Yleisradio), fin ns det i Sverige tre: Ett för tv (Sveriges Television , SVT ), ett för radio (Sveriges Radio , SR ) och ett för utbildnings program (Sveriges Utbildningsradio, UR, vilket till följd av sin begränsade storlek inte återfinns bland de 25 största
Hotell För hotell anges de tre klasserna A/B, C och D. Det betyder att den "normala" standarden C är acceptabel men att motiven för en högre standard är starka. Ljudklass C motsvarar de tidigare normkraven för hotell, ljudklass A/B motsvarar kraven för moderna hotell med hög standard och ljudklass D kan användas vid
LÄS NOGGRANT FÖLJANDE VILLKOR FÖR APPLE DEVELOPER PROGRAM LICENCE . Apple Developer Program License Agreement Syfte Du vill använda Apple-mjukvara (enligt definitionen nedan) för att utveckla en eller flera Applikationer (enligt definitionen nedan) för Apple-märkta produkter. . Applikationer som utvecklas för iOS-produkter, Apple .
Kandy. The highest vulnerability (0.45: moderate vulnerability) to dengue was indicated from CMC and the lowest indicated from Galaha MOH (0.15; very low vulnerability) in Kandy. Interestingly the KMC MOH area had a notable vulnerability of 0.41 (moderate vulnerability), which was the highes
facilitating system vulnerability assessment incorporates a single, graphical representation of a system. This system representation is provided to multiple risk/vulnerability assessment tools and vulnerability data or knowledge bases, resulting in a single, consolidated input to multiple tools. A Fuzzy E xpert System applies the unique correlation
Vulnerability Management solution available on demand Software-free, management free solution - Auto-updating - No software to install or maintain Industry's most comprehensive Vulnerability KnowledgeBase 3700 vulnerability signatures, updated daily Most accurate vulnerability scanner with less than .003% false positive rate
