The importance of (physical) security is increasingly acknowledged by society and the scientific community. In light of increasing terrorist threat levels, numerous security assessments of critical infrastructures are conducted in practice and researchers propose new approaches continuously. While practical security risk assessments (SRA) use mostly qualitative methods, most of the lately proposed approaches are based on quantitative metrics. Due to little evidence of actual attacks, both qualitative and quantitative approaches suffer from the fundamental problem of inherent uncertainties regarding threats and capabilities of security measures as a result from vague data or the usage of expert knowledge. In quantitative analysis, such uncertainties may be represented by, e.g., probability distributions to reflect the knowledge on security measure performance available. This paper focuses on the impact of these uncertainties in security assessment and their consideration in system design. We show this influence by comparing the results of a scalar evaluation that does not take into account uncertainties and another evaluation based on distributed input values. In addition, we show that the influence is concentrated on certain barriers of the security system. Specifically, we discuss the robustness of the system by conducting quantitative vulnerability assessment as part of the SRA process of an airport structure example. Based on these results, we propose the concept of a security margin. This concept accounts for the uncertain knowledge of the input parameters in the design of the security system and minimizes the influence of these uncertainties on the actual system performance. We show how this approach can be used for vulnerability assessment by applying it to the initially assessed configuration of the airport structure. The results of this case study support our assumptions that the security margin can help in targeted uncertainty consideration leading to reduced system vulnerability.

No abstract

No abstract

Threats posed by civilian drones are becoming an increasing security risk for critical infrastructures as well as events or companies. In order to protect an asset against a drone intrusion a security system is necessary, which in general is described by its capabilities of protection, detection, and intervention. The variety of different threat scenarios posed by drones raises the need for detailed analysis of scenario specific requirements on detection systems. However, there is a lack of comprehensive scenario analyses in the literature that include relevant parameters for detection. Thus, in this paper a scenario analysis is conducted to identify consistent threat scenarios including factors critical for drone detection. The study is based on morphological analysis and applies methods of influence analysis and Cross-Impact Balance analysis. Using these methods, factors that influence the detectability of drones are specified and key factors identified. Potential states of these key factors are determined based on literature reviews or expert interviews. For the assessment of internal consistency of a scenario, a Cross-Impact-Balance analysis is conducted. Exemplarily, the paper shows how a remaining consistent scenario can be applied to derive requirements for a drone detection system or to validate existing systems regarding suitability for feasible threat scenarios.

The importance of (physical) security is increasingly acknowledged by society and the scientific community. In light of increasing terrorist threat levels, numerous security assessments of critical infrastructures are conducted and researchers continuously propose new approaches. Moreover, consideration is given to how security measures need to be (re)designed to address the findings of the assessments, taking into account the potentially costly nature of security investments. At the same time, however, assessments suffer from the fundamental problem of inherent uncertainties regarding threats and capabilities of security measures due to little evidence of actual attacks. In this paper, we combine previous work on the concept of security margins with an approach for cost-benefit optimal allocation of available resources considering budgetary constraints to form a three-step approach. In a first step, a security system is assessed for potential vulnerabilities. If such are found, most relevant model parameters are identified on barrier level via sensitivity analysis in a second step. In a third step, security margins are determined for these parameters by optimization, taking into account uncertainties in the assessment as well as cost constraints due to total available budget. The approach is demonstrated using a notional airport structure as an example. The optimization is performed for various budgets to investigate the influence of the budget on system vulnerability and allocation of resources to security measures.