A proposed port security risk assessment approach, with application to a hypothetical port

Author(s):  
Mohamed Abdelfattah ◽  
Mohi-Eldin Elsayeh ◽  
Said Abdelkader
Author(s):  
Gencer Erdogan ◽  
Phu H. Nguyen ◽  
Fredrik Seehusen ◽  
Ketil Stølen ◽  
Jon Hofstad ◽  
...  

Risk-driven testing and test-driven risk assessment are two strongly related approaches, though the latter is less explored. This chapter presents an evaluation of a test-driven security risk assessment approach to assess how useful testing is for validating and correcting security risk models. Based on the guidelines for case study research, two industrial case studies were analyzed: a multilingual financial web application and a mobile financial application. In both case studies, the testing yielded new information, which was not found in the risk assessment phase. In the first case study, new vulnerabilities were found that resulted in an update of the likelihood values of threat scenarios and risks in the risk model. New vulnerabilities were also identified and added to the risk model in the second case study. These updates led to more accurate risk models, which indicate that the testing was indeed useful for validating and correcting the risk models.


2003 ◽  
Vol 2003 (1) ◽  
pp. 727-731
Author(s):  
Robert E. Bailey ◽  
Chris T. O'Neil

ABSTRACT In the wake of September 11, 2001, Captains of the Port (COTPs) nationwide set into motion various security measures to protect potential targets (referred to as an “asset” throughout this paper) located in, on or near navigable waterways. However, the way in which these measures were carried out and the degree to which they were enforced were vastly different from port to port and raised much speculation in the U.S. maritime community over what the security landscape of the future would look like. Over one year later, maritime security practices remain a widely debated issue and one that will continue to challenge COTPs to answer the constantly looming questions of, “what is an adequate level of security for my port?,” “what level of security can I maintain at predefined Maritime Security (MARSEC) Conditions?” (USCG, 2002) and “how can I defend my assertions?” It is widely agreed in maritime security circles that concepts such as MARSEC Conditions and Maritime Domain Awareness (MDA) (USCG, 2002) are essential components of the port security posture of the 21st century, but most of this community will concede that they do not have a clear cut strategy on how to bridge the gap between transforming these lofty concepts into clearly defined, tactically sound and implementable security solutions. The purpose of this paper is to describe such a bridge, or a port security risk assessment methodology if you will, that is based on factual data that is verified by Coast Guard personnel and that synthesizes security concepts and Risk-Based Decision-Making (RBDM) methodologies (USCG, 2001) into systematic assessment phases that have been developed and tested by U.S. Coast Guard Marine Safety Office (MSO) St. Louis, Missouri. Moreover, it describes how the analysis of the data gained from the assessment phases provided the COTP St. Louis with tangible and accurate data results that can now be used by Port Security Committees (PSCs) (USCG, 2002) as a foundation for tactical planning and the development of Port Security Plans (PSPs) (USCG, 2002). These PSPs meet the guidelines established in the U.S. Coast Guard's Navigation and Vessel Inspection Circular (NVIC) 9–02 entitled, “Guidelines for Port Security Committees, and Port Security Plans Required for U.S. Ports.” Once proven in broad applications, this tool can be consistently implemented by COTPs nationwide providing them with detailed port risk characterizations. Armed with this tactical analysis, COTPs can then accurately prioritize high-risk assets and maximize the use of PSC resources to stem potential terrorist threats or attacks.


2017 ◽  
Vol 25 (3) ◽  
pp. 345-354 ◽  
Author(s):  
Adrian Munteanu

Purpose This study aims to argue that in the case of quantitative security risk assessment, individuals do not estimate probabilities as a likelihood measure of event occurrence. Design/methodology/approach The study uses the most commonly used quantitative assessment approach, the annualized loss expectancy (ALE), to support the three research hypotheses. Findings The estimated probabilities used in quantitative models are subjective. Research limitations/implications The ALE model used in security risk assessment, although it is presented in the literature as quantitative, is, in fact, qualitative being influenced by bias. Practical implications The study provides a factual basis showing that quantitative assessment is neither realistic nor practical to the real world. Originality/value A model that cannot be tested experimentally is not a scientific model. In fact, the probability used in ISRM is an empirical probability or estimator of a probability because it estimates probabilities from experience and observation.


Sign in / Sign up

Export Citation Format

Share Document