| The attacks of September 11, 2001, exposed the vulnerability of critical infrastructure to precipitating domestic catastrophic attack. In the intervening decade, the Department of Homeland Security (DHS) has struggled to develop a coherent infrastructure protection program but has been unable to formulate a risk measure capable of guiding strategic investment decisions. Most risk formulations use a threat-driven approach which suffers from a dearth of data incapable of supporting robust statistical analysis. This research examines prevailing challenges to propose criteria for developing an adequate strategic risk formulation. Key insights include 1) the viability of an asset-driven approach, 2) reducing threat prediction to threat localization, 3) eschewing complexity for transparency and repeatability, 4) addressing the five phases of emergency management, and 5) capturing the national impact of consequences. Accordingly, an Asset Vulnerability Model (AVM) is proposed based on these criteria. AVM provides baseline analysis, cost-benefit analysis, and decision support tools compatible with the DHS Risk Management Framework to 1) convey current risk levels, 2) evaluate alternative protection measures, 3) demonstrate risk reduction across multiple assets, and 4) measure and track improvements over time. AVM capabilities are unique among twenty-two models compared. AVM risk formulation is predicated on E, an attacker's probability of failure, derived from earlier work in game theory that found a coordinated defense more efficient than an uncoordinated one. This suggests that all means of domestic catastrophic attack should be protected collectively, both critical infrastructure and chemical, biological, radiological, and nuclear stockpiles. This research proposes a national policy framework supporting AVM extension to collectively defend all assets that may precipitate domestic catastrophic attack. This research concludes by using AVM to evaluate seven alternative risk reduction strategies: 1) Least Cost, 2) Least Protected, 3) Region Protection, 4) Sector Protection, 5) Highest DTheta (protective gain), 6) Highest Consequence, and 7) Random Protection. AVM simulations indicate that the Highest Consequence strategy is most effective across varying probabilities of attack, attacker perceptions, and different attack models. These simulations demonstrate the computational power of AVM, and how, with an appropriate supporting policy structure, AVM can objectively guide the nation towards a unified homeland security strategy. |
