Risk-Based Cost-Benefit Analysis for Security Assessment Problems

A Game Theoretic Approach to Nuclear Safeguards Selection and Optimization

“…The results presented in this work show that at low defender budgets at the enrichment facility, even a daily exogenous DP of 0.1% for detecting the production of undeclared feed altered the defender's optimal strategy at the facility. This result suggests that inspectorates like the IAEA, which is estimated to receive approximately 10% of its information from third-party intelligence, 26 should consider what types of attacks intelligence and other exogenous sources of DP are capable of detecting and how much additional detection capability exogenous sources provide. The inspection strategy that is optimal in the absence of exogenous detection sources may not be optimal in the presence of such sources, particularly at low defender budgets or if the exogenous sources provide DP against the most vulnerable proliferation pathways.…”

“…The results of this work confirm the intuitive notion that the attacker does at least as well, if not better, when he can choose between attacking either of two facilities. For a given 26 Remarks made by high-level IAEA official in an off the record session budget, the defender is better able to defend one facility than two, because he can invest all his resource at the single facility rather than allocate them across the two facilities. Thus the attacker's evasion probability is slightly higher in the case of the integrated facility model than it is for even the more vulnerable of the two stand-alone facilities.…”

“…To assess the risk posed by a given attack scenario, standard risk assessment approaches rely on triplets containing scenario description, probability of scenario, and consequence of scenario. In their updated framework for risk-based cost-benefit analysis, Wyss et al propose replacing the highly uncertain 'probability of scenario' value with a quantitative metric to describe 'adversary difficulty' [26], [27]. The resulting analysis is a target and scenario specific risk assessment.…”

Reducing normative conflicts in information security

“…Also, the apparatus for deriving capabilities in system models from norms is an area of future study. It has been suggested that attacks be expressed in terms of difficulty rather than possibility or probability [40], which would enable more fine-grained analysis, but at the same time requires rethinking the composition of norms into capabilities.…”

Systems analysis of past, present, and future chemical terrorism scenarios.

“…[2] Building on this insight, Wyss and coworkers recently developed a definition specifically for security risk which utilized "difficulty" rather than probability. [3] The modified security risk triplet -scenario, difficulty, and consequence -examines the how difficult it is for an adversary to execute a terrorism scenario in order to achieve their desired consequences. Therefore, while high consequences drive the risks of biological and nuclear terrorism, the low level of difficulty, or the ease of executing a chemical attack, may elevate the risk of chemical terrorism to levels of equal importance.…”