Vulnerability Adjusted Metrics in Performance Based Physical Security Assessments

Kurzfassung

Critical infrastructure (CRITIS) protection requires the skillful integration of security measures to maintain integrity and functionality in the event of a potential attack. This involves the identification, categorization and assessment of elements requiring protection, followed by the astute allocation of security measures, all within the constraints of limited resources. The challenge is to make simple decisions about security-related investments. One solution is the use of risk-adjusted scorings. While risk-adjusted scoring scales are well established in functional safety (e.g. Braband, 2008), their application to physical vulnerability assessment remains a mostly unexplored area. This paper presents a versatile approach to performance-based physical vulnerability analysis using risk-adjusted scorings. Based on Harnser's (2010) framework, the presented method defines different barrier types and resistance classes. Each type is associated with a scale mapping probability intervals to vulnerability scores. By aligning with Termin et al.'s (2023) metric compatibility approach, these scores are locally adjusted to replicate quantitative vulnerability values derived from the application of Lichte et al.'s (2016) quantitative vulnerability metric. To illustrate the potential of the approach, a vulnerability analysis based on the risk-adjusted scoring framework is demonstrated. This approach can support CRITIS operators in making informed security investment decisions when using the presented toolkit. Finally, challenges and opportunities are discussed and the findings summarized.