critical analysis-1

Critical Asset Identification and Protection Guide

Prepared For:

Embry-Riddle Aeronautical University

Daytona Beach, Florida 32114

Prepared By:

Krystal Urban, Paul Dias, Josh Guerrero, Matthew Otto, & Bryan Wierson

November 2012

Critical Asset Identification and Protection Guide 2012

Table of Contents

Table of Contents............................................................................................................................ 2

Tables and Figures..........................................................................................................................3

Introduction......................................................................................................................................4

Purpose of this Assessment..................................................................................................4

Team Composition...................................................................................................................5

Step 1 – Critical Assets

Objective………...............................................................................................................6

Identification....................................................................................................................................6

Assessment....................................................................................................................................7

Step 2 – Vulnerability Assessment

Objective..........................................................................................................................................7

Identification....................................................................................................................................7

Assessment........................................................................................................................8

Step 3 – Consequence Assessment

Objective.......................................................................................................................................8

2


Identification....................................................................................................................................9

Assessment...........................................................................................................................9

Step 4 -- Countermeasures

Objective.......................................................................................................................................9

Identification....................................................................................................................................9

Assessment.........................................................................................................................10

Step 5 – Cost Estimation

Objective......................................................................................................................................10

Approach....................................................................................................................................10

Analysis…........................................................................................................................11

Step 6 – Security Operational Planning

Objective.....................................................................................................................................12

Approach........................................................................................................................................12

Added Countermeasures Explanation....................................................................................13

Step 7 - Conclusion

Analysis…………………………………………………………………………………………14

3


Tables and Figures

Table 1 – Asset Identification..........................................................................................5

Table 2 – Vulnerability Factor…………………………………………………………….…..6

Table 3 - Countermeasure Relative Cost Range........................................................................8

Table 4 - Costs Applied to Assets……………………………………………………………..8

Table 5 - Statewide Zoning System………………………………………………………….12

Introduction

The consequences of a category 3 hurricane with landfall near ERAU's campus could result in injury and death, disruption in the continuity of operations, as well as environmental damage hindering operations.

The Critical Asset Identification and Protection Guide was prepared under the direction of Robert T. Raffel, J.D. for the Critical Infrastructure and Risk Assessment course offered under Embry-Riddle Aeronautical University (ERAU), Daytona Beach, FL. This assessment was produced to address critical assets via means of a vulnerability assessment in the event of a category 3 hurricane.

This assessment can benefit many schools and businesses along hurricane-prone coast lands. It can be used by senior safety officials involved in the initial planning Stages, as well as mid-level officials charged with developing the assessment plans and procedures, and staff personnel who will likely conduct the assessments within ERAU. This assessment recommends that ERAU organize a team of individuals tasked with the assessment who are familiar with the schools mission, assets, policies and procedures.

Purpose of this Assessment

This assessment was developed as a guide for the protection of ERAU by:

Assessing the vulnerabilities of their physical assets such as buildings, roads, and equipment etc;

Developing possible countermeasures to forecast, mitigate, and provide for the continuity of operations consequences due to a category 3 hurricane;

4


Estimating the capital, operating, and maintenance costs of such countermeasures; and

Improving safety operational planning for better protection against future natural disasters.

Team Composition

This assessment was conducted by an ERAU student team comprised of individuals of various backgrounds and levels of study; each pursuing a Bachelor of Science degree in Homeland Security. Each team member is knowledgeable in critical asset identification and cost benefit analysis, by certifying in FEMA’s National Infrastructure Protection Plan.

Krystal Urban

New senior transfer to ERAU possessing adaptability and quick learning skills. She is currently serving in the U.S. Army Reserves under the HHD 377th MI BN. She demonstrated her cognitive aptitude and analytical ability by graduating at the top of her U.S. Army Intelligence Analyst Course. Immediately upon her return, she sought out additional intelligence training completing a two-week analytical course, two-week Distributed Common Ground System-Army certification, and 40-hour engineering intelligence and reconnaissance course. She is frequently sought out for her analytical knowledge and ability to effectively communicate concepts by subordinates, peers and seniors alike.

Paul Dias

Junior ERAU student. He possesses an ability to work quickly regardless of deadlines. He is a member of the U.S. Army Reserve Officer Training Corps. He has obtained multiple FEMA courses to include IS-235b Emergency Planning, IS-700a National Incident Management System, and IS-130 Exercise Evaluation and Improvement Planning.

Josh Guerrero

Junior ERAU student. He has participated in building an emergency management plan for Los Angeles International airport, which identified natural disasters, including earthquakes. Throughout his three years in college he has obtained multiple FEMA courses to include IS-235b Emergency Planning, IS-700a National Incident Management System, and IS-130 Exercise Evaluation and Improvement Planning.

Matthew Otto

Junior ERAU student. Experience in hurricane planning and countermeasures. Worked for 3 years as a professional property maintenance personnel, dealing with pre hurricane preparedness as well as post hurricane clean up. Knowledgeable in the field of emergency

5


preparedness. Prior work expertise in business, dealing with cost/benefit analysis on potential investments.

Brian Wierson

Born to a military family, Brian has traveled extensively and participated in numerous humanitarian efforts. Throughout his travels overseas, he has experienced typhoons, tsunamis, earthquakes, and other natural disasters. He has participated in building an emergency management plan for Honolulu City Hall, which identified natural disasters, including hurricanes, and how to protect Honolulu City Hall using the Emergency Management Cycle. He has taken multiple FEMA courses to include IS-120a Introduction to Exercises, IS-547a Continuity of Operations, and IS-130 Exercise Evaluation and Improvement Planning.

Step 1 - Critical Assets

Objective

The team identified all critical assets of ERAU in order to ensure minimal cost damage from a category 3 hurricane and the continuity of operations for the university.

The team identified ERAU’s assets through a step by step method. First, our team identified all known assets, and put them into four categories: Infrastructure, Facilities, Equipment, and Personnel, as seen in Table 1.

Identification

Table 1- Asset Identification

Infrastructure Facilities Equipment Personnel

Asset Value Asset Value Asset Value Asset Value

Storm Drains 11 Classrooms 27 Maintenance Equipment 20 Students 25

Roadways 13 University Center 27 Classroom

Equipment 1 ERAU Staff 25

Alarm Systems 22 Dorms 30 University

Fleet 20 Faculty 25

Sewer 17 Maintenance 28 Simulators 22

6


Building

IT systems 20 Labs 27

HVAC 21 Lehman Building 31

Water 20 Hangers 8

Electricity 26 Library 27

Fuel 17 Worldwide Center 15

Admin Building 15

Assessment

After identifying all assets, our team assigned values to each asset (shown above). From there, our team identified the assets which had high numbered values (in red). These values where given due to the criticality of the asset and the impact on the continuity of operations they would have on ERAU if damaged by the category 3 hurricane.

Step 2 – Vulnerability Assessment

Objective

The vulnerability assessment is designed to systematically identify and evaluate critical assets in terms of their susceptibility to, and the consequences of, a category 3 hurricane. Vulnerability of each asset was given a value of 1-4 pertaining to each of the categories: level of importance (A), attendance and users (B), asset construction (C), access (D), receptor impacts (E), and volume (F). This process identifies the most exposed and weakest assets that can be exploited by terrorists. Once these values were assigned, the team applied the values to the vulnerability assessment formula (Shown in Table 2).

Identification

Table 2 – Vulnerability Factor = (A*B) + (C*D) + (E*F)

Critical AssetVulnerability Factor Total

Score(A*B) + (C*D) + (E*F)Lehman 4 4 3 4 4 3 40

7


Dorms 3 4 4 4 4 3 40Maint. Facility 2 2 3 4 4 3 28Labs 2 4 3 2 2 2 18Student Center 4 4 3 4 4 3 40Classrooms 4 4 3 2 4 3 34Library 4 4 4 4 4 4 48Electrical 4 4 1 4 2 2 24Faculty 4 4 2 3 3 3 31Staff 3 4 2 3 3 3 27Students 4 4 1 3 3 3 28Alarm Systems 3 4 1 4 2 2 20Simulators 3 2 2 1 2 2 12HVAC 2 4 2 2 2 2 16IT Sytems 3 4 1 1 2 2 17Water 3 4 3 4 2 2 28Admin. Facility 2 2 3 4 4 3 28Fleet 2 3 2 3 2 3 18Maint. Equipment 1 2 2 3 2 2 12Fuel 1 3 1 2 2 2 9Sewer 2 4 4 2 2 2 18Computers/Printers 3 4 1 4 2 3 22W.W. Facility 1 2 3 4 4 3 26Storm Drains 2 4 3 2 2 2 18Roads 3 4 4 4 2 2 32Hangers 1 2 3 2 2 2 12

Assessment

After a vulnerability assessment, it was realized that our top four assets were the most crucial to the continuity of operations of ERAU. Inside of the school’s library, there are numerous amounts of NTSB reports and other aviation files that most other schools do not have. ERAU’s library has the largest collection of aviation information and record in the world which makes it pertinent to the school. The Lehman building is the number one building at ERAU that deals with their engineering department. Since ERAU has the number one aerospace engineering program in the world, the Lehman building is considered a critical asset to the continuity of operations. Without the dormitories and student center, ERAU cannot provide a proper living condition for their students. If not for the students, ERAU would not make the income it needs to sustain itself. Therefore, the students are also a critical asset to the school.

Step 3 – Consequence Assessment

Objective

8


The consequence assessment helps identify assets which, if damaged, produce the greatest risks for undesirable outcomes given a specific set of circumstances and conditions. This assessment is based on an integrated analysis of the data collected on key assets, realistic and credible threats, and known or specifically identified vulnerabilities (comparison of criticality and vulnerability values).

Identification

• Library• Lehman Building • Dormitories• Student Center/University Center• Classrooms• Faculty• Maintenance Facilities• Students• Water Source• Staff

Assessment

Prior to the conclusion of the consequence assessment, it has been decided that the high priority buildings at ERAU that were most vulnerable to consequence were the Lehman Building, Library, Student Center, and Dormitories. With the vast amount of aviation documentation, the library is very vulnerable to any form of weather and water damage. If the water can reach a high enough level, then there is a chance that the documents can be ruined. The Lehman building is also very susceptible to water damage due to the “Zeus” computer that contains all of the school’s data. With the immense amount of windows in the dormitories there is a large possibility of their destruction. If destroyed, the living condition of the dormitories would be unsuitable for the student. The student center is surrounded by a majority of windows on its sides. This glass is very fragile and even more susceptible to damage compared to the dormitories. A large number of the buildings on the ERAU campus have the same consequence vulnerabilities. One simple solution could be applied to all of the buildings and solve the consequence issues.

Step 4 - Countermeasures

Objective

Identify countermeasures to protect the critical assets from the threats and fix vulnerabilities assessed previously. The team developed countermeasures to protect the four critical assets

9


identified. These strategic countermeasures are meant to protect the integrity of the critical assets.

Identification

Board up windows Buy and place sandbags strategically around doors Evacuate students from Embry-Riddle ahead of time Move computers from bottom and top floor and place on top Buy tarps

Assessment

The implementation of these countermeasures will deter and defend the critical assets from any damage, and will insure the continuity of operations for the school in order to maintain instruction for students and a continued income for the university.

Step 5 – Cost Estimation

Objective

In this step, all countermeasures are evaluated on their range of cost. The cost range includes the cost of implementation, operating and maintenance costs of selected countermeasures.

Approach

The countermeasures identified below are intended to forecast, mitigate or ensure the Continuation of operation (COOP). In most cases the countermeasure will mitigate the potential loss of a critical asset and ensure its COOP. The countermeasures are assed as well by their relative capital, maintenance and operating cost. The costs are based on a high (H), medium (m) and low (L) value (Table 3). These values are applied to the countermeasures as shown in Table 4.

Table 3 - Countermeasure Relative Cost Range

Capital Investment

Operating Cost Maintenance Cost

L <$100K <$50K <$25K

M $100K to $500K $50K to $250K $25K to $100K

10


H >$500K >$250K >$100K

Table 4 - Costs Applied to Assets

Potential countermeasures

Fore

cast

Miti

gate

CO

OP

Cap

ital

Ope

ratin

g

Mai

nten

ance

Sandbags ✓ ✓ L L LClearing all drains and ditches ✓ L L LGrounds maintenance (trimming tree's) ✓ L L L

Securing movable objects ✓ L L LEvacuation ✓ ✓ L L LEvacuation of Fleet (air planes) ✓ ✓ H L LComputer moved 4' from ground ✓ L L LTarps ✓ L L LFull fuel tanks (generators/equipment) ✓ ✓ L L LSecuring equipment fuel tanks ✓ L L LExercises ✓ L L LHazardous waste area empty ✓ L L LHurricane tracking (EARU and NOAA) ✓ L L L

Board up windows ✓ H H LHurricane film windows ✓ H l LEmergency food stock ✓ H L H

Analysis

The potential Countermeasures contained in Table 4 have gone through the cost/benefit analysis and have all developed low costs with the exception of the evacuation of the air plane fleet and the protection of all windows on the ERAU Campus. The evacuation of the fleet has already been addressed by the ERAU Disaster and Emergency Management/Recovery Plan. The risk analyses team agrees with this countermeasure because of the potential high cost of replacement of the fleet.

Since the protection of the windows can cost upward of a million dollars, it is not beneficial for the high capital investment. The Florida building codes that the ERAU campus has been built

11


upon is determined by a statewide zoning system as shown in Table 5. Particularly stringent restrictions apply to the High-Velocity Hurricane Zone. Volusia County is currently zoned to have protection at the medium level up to 120 MPH. The level states that windows must be impact resistant. Therefore it is not beneficial to protect to the windows on campus.

The remaining countermeasures listed however, the risk analysis team believes are very beneficial for the mitigation of risk as well as the COOP. The countermeasures are all cost effective and provide a high level of protection for the critical assets. Countermeasures can be completed well before the storm arrives ensuring all personnel are off campus and safe.

Table 5 - Statewide Zoning System

STEP 6 - Security Operational Planning

Objective

This step will improve the operational security of all critical assets. By improving upon the post hurricane preparations as well as the emergency management plans already in place by ERAU.

12


Approach

The ERAU campus has already provided a Disaster and Emergency Management/Recovery Plan for the campus as well as a separate plan for the Hunt library. The risk assessment team agrees with all of the countermeasures already in place. The countermeasure team will improve upon the plan and place some of our suggested countermeasures in the pre existing plans.

Added Countermeasures Explanation

Sandbags

The pre hurricane season purchasing of 5000 sand bags is an excellent way to safeguard against flooding. The cost of this countermeasure will be $1900 dollars. Sand bags come in bulk of 1000 sand bags at $380 per 1000. Flooding is the most costly damage incurred by businesses every hurricane season. Sandbags are a very low capital investment and yield a large return on investment by safeguarding against flooding. Sandbags may also be stored for many years and may be utilized when a hurricane is impending upon the ERAU campus.

Post hurricane grounds maintenance

There are two parts to this countermeasure. First, post hurricane season clearing of ditches and trimming of trees around the ERAU campus. Second, during Stage 2 of the hurricane emergency plan, this countermeasure will be enacted to include, trimming of trees, clearing of gutters and other hazards around the ERAU campus. These countermeasures will safeguard against falling and flying tree debris as well as flooding. The ERAU campus has funds and equipment already in place for this countermeasure.

Securing all unsecure objects around ERAU campus

This countermeasure will be enacted during Stage 2 of the hurricane emergency plan. This countermeasure will include moving of all tables, chairs and any other unsecure objects around the ERAU campus to secured areas. The ERAU campus has funds and personnel already in place for this countermeasure

Filling all equipment fuel tanks

This countermeasure will be enacted during Stage 1 of the hurricane emergency plan. This countermeasure includes filling of all equipment fuel tanks for the maintenance equipment. Once filled during Stage 2 of the plan, the fuel tanks will be secured. The reason behind filling the tanks pre hurricane is that fuel will be scarce after a hurricane and will be needed to clean the ERAU campus and to ensure a swift reopening of business.

13


Emptying of the ERAU hazardous waste area

This countermeasure will be enacted during Stage 1 of the hurricane emergency plan. This countermeasure is in place to ensure there is not environmental contamination, which could potentially cost ERAU thousands of dollars, if not more. This hazardous waste area already has a contract to be cleared within 180 days of the last clean up, because ERAU is classified as a small quantity generator. We suggest ERAU to add to the contract that waste must be emptied once a tropical storm advisory is announced for the Volusia country area.

Step 7 - Conclusion

Analysis

The risk analyses team recommends the use of ERAU's Disaster and Emergency Management/Recovery Plan, with a few additional countermeasures recommended by the risk analyses team. In combination, the ERAU campus will be as secure as possible. Below is the combined Hurricane Emergency Plan and recommended countermeasures.

Combined Hurricane Emergency Plan and Recommended Countermeasures

Hurricane Season: June 1- November 30- update departmental plans. Communication & Marketing and Campus safety & security will notify campus of emergency communication methods (voice mail, e-mail, ERNIE, and the university website). EOT will meet each June to plan for the current forecasted hurricane season. The director of Campus Safety will make regular checks of the tropical weather forecast, and consult with meteorology faculty as needed.

Note: A hurricane Alert may be declared by the University EVP/CAO in the event of a tropical storm. Tropical storm warning should be considered as potentially dangerous as a hurricane watch.

Hurricane Alert: Decision by the Daytona Beach Exec VP/Chief Academic Officer (or designee), to implement the hurricane plan. (Can occur at any of the Stage below)

Stage 1: Advisory: Hurricane threatens US Mainland. Advisories are broadcast over radio and TV. Step up preparedness. Fill all equipment fuel tanks and clean the Hazardous waste area. Campus Safety & Security Department will issue weather advisories. EOT may be activated at the time or any future Stage.

Stage 2: Hurricane Watch: Hurricane threatens to enter Eastern Seaboard or gulf within 24-36 hours- preliminary storm preparations should begin. All unsecure objects should be secured and all equipment fuel tanks should be secured. EOC may be mobilized

Stage 3: Hurricane Warning: Hurricane expected to strike specific area within 12-24 hours EOC operational. All precautions should be taken immediately.

14


15

critical analysis-1

Documents