BUILDING DESIGN FOR HOMELAND SECURITY Unit IV Vulnerability Assessment Vulnerability Any weakness that can be exploited by an aggressor or, in a non-terrorist threat environment, make an asset susceptible to hazard damage Unit Objectives Explain what constitutes a vulnerability. Identify vulnerabilities using the Building Vulnerability Assessment Checklist. Understand that an identified vulnerability may indicate that an asset: . Ą is vulnerable to more than one threat or hazard; . Ą and that mitigation measures may reduce vulnerability to one or more threats or hazards. Provide a numerical rating for the vulnerability and justify the basis for the rating. Vulnerability Assessment Identify site and building systems design issues Evaluate design issues against type and level of threat Determine level of protection sought for each mitigation measure against each threat Assessment Flow Chart Identifying Vulnerabilities Multidisciplinary Team . _ Engineers . _ Architects . _ Security specialists . _ Subject matter experts . _ Outside experts if necessary Vulnerability Assessment Preparation Coordinate with the building stakeholders: . Ą Site and Building Plans . Ą Utilities . Ą Emergency Plans (shelter, evacuation) . Ą Interview schedules . Ą Escorts for building access Assessment GIS Portfolio 10-Mile Radius Regional Transportation Metro Center Imagery Site Emergency Response Site Public and Government Buildings Site HazMat Site Local Transportation Network Site Principal Buildings by Use Site Truck Bomb Site Car Bomb Options to Reduce Vulnerability R e v i e w P r i n t s a n d S p e c s ; C h e c k w i t h S y s t e m s E x p e r t s U n i t I V - 2 0 Figure 1-8: Facility System Interactions, page 1-23 Single-Point Vulnerabilities Functional Analysis SPVs Standard 11 The loading dock and warehouse provide single point of entry to the interior Standard 13 and 17 The mailroom is located within the interior and not on exterior wall or separate HVAC system Standard 1 The telecom switch and computer data center are adjacent to the warehouse Standard 1 The trash dumpster and emergency generator are located adjacent to the loading dock Figure 1-10: Non-Redundant Critical Functions Collocated Near Loading Dock, p. 1-41 BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-23 Building Vulnerability Assessment Checklist Compiles best practices from many sources Includes questions that determine if critical systems will continue to function during an emergency or threat event Organized into 13 sections . Ą Each section should be assigned to a knowledgeable individual . Ą Results of all sections should be integrated into a master vulnerability assessment . Ą Compatible with CSI Master Format standard to facilitate cost estimates Building Vulnerability Assessment Checklist Site Architectural Structural Systems Building Envelope Utility Systems Mechanical Systems (HVAC and CBR) Plumbing and Gas Electric al System s Fire Alarm System s Commu nication s and IT System s Equi pme nt Ope ratio ns and Mai nten anc e Sec urity Syst ems Sec urity Mas ter Plan Building Vulnerability Assessment Checklist Mechanical Systems (HVAC and CBR) Where are the air intakes and exhaust louvers for the building? (low, high, or 6.1 midpoint of the building structure) Are the intakes and exhausts accessible to the public? Is roof access limited to authorized personnel by 6.2 means of locking mechanisms? Is access to mechanical areas similarly controlled? Air intakes should be located on the roof or as high as possible. Otherwise secure within CPTED-compliant fencing or enclosure. The fencing or enclosure should have a sloped roof to prevent throwing anything into the enclosure near the intakes. Ref: CDC/NIOSH Pub 2002-139 Roofs are like entrances to the building and are like mechanical rooms when HVAC is installed. Adjacent structures or landscaping should not allow access to the roof. Ref: GSA PBS ĐP100, CDC/NIOSH Pub 2002-139, and LBNL Pub 51959 Extracted from Table 1-22: Building Vulnerability Assessment Checklist, pages 1-46 to 1-92. BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-27 Building Vulnerability Assessment Checklist Extracted from Table 1-22: Building Vulnerability Assessment Checklist, pages 1-46 to 1-92. BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-31 Vulnerability Rating Very High Đ One or more major weaknesses have been identified that make the asset extremely susceptible to an aggressor or hazard. High -One or more significant weaknesses have been identified that make the asset highly susceptible to an aggressor or hazard. Medium High Đ An important weakness has been identified that makes the asset very susceptible to an aggressor or hazard. Medium Đ A weakness has been identified that makes the asset fairly susceptible to an aggressor or hazard. Medium Low Đ A weakness has been identified that makes the asset somewhat susceptible to an aggressor or hazard. Low Đ A minor weakness has been identified that slightly increases the susceptibility of the asset to an aggressor or hazard. Very Low Đ No weaknesses exist. Critical Functions Function Cyber attack Armed attack (single gunman) Vehicle bomb CBR attack Administration Asset Value 5 5 5 5 Threat Rating 8 4 3 2 Vulnerability Rating 7 7 9 9 Engineering Asset Value 8 8 8 8 Threat Rating 8 5 6 2 Vulnerability Rating 2 4 8 9 Extracted from Table 1-20, page 1-38 Critical Infrastructure Function Cyber attack Armed attack (single gunman) Vehicle bomb CBR attack Site Asset Value 4 4 4 4 Threat Rating 4 4 3 2 Vulnerability Rating 3 5 9 9 Structural Systems Asset Value 8 8 8 8 Threat Rating 3 4 3 2 Vulnerability Rating 2 4 8 9 Extracted from Table 1-21, page 1-39 Summary Step-by-Step Analysis Process: . Ą Expertly performed by experienced personnel . Ą Determines critical systems . Ą Identifies vulnerabilities . Ą Focuses survivability mitigation measures on critical areas . Ą Essential component of Critical Infrastructure and Critical Function Matrices Unit IV Case Study Activity Vulnerability Rating Background Vulnerability: any weakness that can be exploited by an aggressor or, in a non-terrorist threat environment, make an asset susceptible to hazard damage Requirements: Vulnerability Rating Approach Use rating scale of 1 (very low or no weakness) to 10 (one or major weaknesses) Refer to HIC case study and rate the vulnerability of asset-threat/hazard pairs: Ą HIC Critical Functions