Text 2. Threat Definition. Before a vulnerability analysis can be completed, a description of the threat is required

Threat Definition. Before a vulnerability analysis can be completed, a description of the threat is required. This description includes the type of adversary, tactics, and capabilities (number in the group, weapons, equipment, and transportation mode). Also, information is needed about the threat to estimate the likelihood that they might attempt the undesired events. The specific type of threat to a facility is referred to as the design basis threat (DBT). The DBT is often reduced to several paragraphs that describe the number of adversaries, their modus operandi, the type of tools and weapons they would use, and the type of events or acts they are willing to commit.

The types of organizations that may be contacted during the development of a DBT description include local, state, and federal law enforcement (to include searching source material) and related intelligence agencies.

After the threat spectrum has been described, the information can be used together with statistics of past events and site-specific perception to categorize threats in terms of likelihood that each type of threat would attempt an undesired event. The likelihood of adversary attack can be estimated with a qualitative relative threat potential parameter. Below we describe the factors that can be used to estimate relative threat potential.

Adversary Capability

•Access to region

•Material resources

•Technical skills

•Planning/organizational skills

•Financial resources

Adversary History/Intent

•Historic interest

•Historic attacks

•Current interest in site

•Current surveillance

•Documented threats

Relative Attractiveness of Asset to Adversary

•Desired level of consequence

•Ideology

•Ease of attack

The process for estimating the threat potential follows a complete threat analysis and the parameter is estimated per undesired event and per adversary group. The basis of the parameter estimation includes:

• Characteristics of the adversary group relative to the asset to be protected

• Relative attractiveness of the asset to the adversary group.

The physical protection features must be described in detail before the security system effectiveness can be evaluated. An effective security system must be able to detect the adversary early and delay the adversary long enough for the security response force to arrive and neutralize the adversary before the mission is accomplished.

DETECTION, the first required function of a security system, is the discovery of adversary action and includes sensing covert or overt actions. In order to discover an adversary action, the following events must occur:

• sensor (equipment or personnel) reacts to an abnormal occurrence and initiates an alarm

• information from the sensor and assessment subsystems is reported and displayed

• someone assesses information and determines the alarm to be valid or invalid.

DELAY is the second required function of a security system. It impedes adversary progress. Delay can be accomplished by fixed or active barriers, (e.g., doors, vaults, locks) or by sensor-activated barriers, e.g., dispensed liquids, foams. The security police force can be considered an element of delay if personnel are in fixed and well-protected positions.

RESPONSE, the third requirement of security systems, comprises actions taken by the security police force (police force or law enforcement officers) to prevent adversarial success. Response consists of interruption and neutralization. Interruption is defined as the response force arriving at the appropriate location to stop the adversary’s progress. It includes the communication to the response force of accurate information about adversarial actions and the deployment of the response force. Neutralization is the act of stopping the adversary before the goal is accomplished. The effectiveness measures for neutralization are security police force equipment, training, tactics, and cover capabilities.

Protection System Effectiveness. Analysis and evaluation of the security system begin with a review and thorough understanding of the protection objectives and security environment. Analysis can be performed by simply checking for required features of a security system, such as intrusion detection, entry control, access delay, response communications, and a response force.