Vulnerability Assessment Program

Assessment Project Summary:

We can conduct vulnerability assessments to counter sophisticated attacks by an identified threatagainst any infrastructure, such as Nuclear Power Plants, Transportation Systems,Food, and Agriculture commodities and other national assets, as well as, individual targets. This can be done in any identified or potential target and in any location.

We recently facilitated assessments for the US Department of Homeland Security, the National Pork Producers Council, and scheduled to conduct a vulnerability assessment for the nations Milk Producers. Also, we have provided Vulnerability Assessment assistance to the White House Homeland Security CouncilBio-terrorism Team, US Department of Agriculture (USDA), US Food and Drug Administration (FDA), and other federal and private infrastructure providers.

Current United States Training Project Summary:

To train and network 2000 Vulnerability Analysts, within 12 months to defend the agriculture and food system against terrorist attacks, major disasters, and other emergencies. This development series is in direct support of Department for Homeland Security (DHS)/US Department of Agriculture’s (USDA) priorities and Presidential Directive Homeland Security Presidential Directive 9 (HSPD-9).

The project will generate an infrastructure of certified Government and Commercial Vulnerability Analysts, capable of analyzing the vulnerability of any portion of the farm-to-fork continuum, or any other critical infrastructure with which they are associated. Concurrently fielding a tool for realtime knowledge of what to do right now, in this situation.

These analysts will be empowered by a nationwide, knowledge-based system called the Vulnerability Analyst Network (VAN). The VAN provides newly trained analysts with a tailored, consistent, Online community to facilitate collaboration for planning and operational reachback. The VAN also offers the DHS/USDA a means of collecting and sharing nationwide best practices, lessons learned, standard operating procedures and threaded discussions from the analysts trained under their program in a controlled access environment.

APPROACH

We have employed the targeting tool used by US Special Operations Forces to quickly and thoroughly analyze critical infrastructure. This tool is based off of four basic principles of war:

  • Know Yourself. This includes the entire infrastructure or facility to be assessed. Many other Vulnerability Assessment (VA) systems attempt to identify only critical systems to evaluate in the hopes of saving time and resources. This shortcut can overlook crucial vulnerabilities as proven time and again by users of this tool. Results show that significant vulnerability lies in areas that most experts never considered critical and may have overlooked.
  • Know The Threat
  • Actual, localize threat for a specific target.
  • We must understand Who the threat is, Why they want to attack, How they will attack you, and What the desired effect is.
  • Design basis threat for a higher-level assessment as used by agencies such as the US Department of Agriculture (USDA), US Food and Drug Administration (FDA) or US Department of Homeland Security (DHS)
  • Know Your Environment. This is information about the physical, political, and legal environment that affects the target and the threat.
  • Know What Your Enemy Knows About You. This is an additional component to this pre-assessment information sometimes called Red Teaming. It is not required to identify the actual vulnerabilities, it is used more to predict probability of attack.

It allows for a ubiquitous look at the infrastructure, the perceived threat, and even looks at the target through the threats eyes. The CARVER+Shock Vulnerability Assessment Tool (The Tool) is invaluable for any of the 13 critical infrastructures, as well as, being used to uncover previously unidentified weaknesses in multiple agriculture commodities, food, power, and transportation industries.

The Tool

As the Director of The US Army’s Homeland Infrastructure Security Threats Office we developed a vulnerability assessment tool that was applicable across all critical infrastructures. The Tool is known as the CARVER+Shock Vulnerability Assessment Tool (The Tool). Since that time the Foundation for Institutional Development (The Foundation) expert team has shared many success stories in the Homeland Security applications of The Tool. The Foundation, using the Tool is setting the standard for infrastructure protection across America.

CARVER was originally developed as a targeting tool for used by US Special Operations Forces to quickly and thoroughly analyze enemy critical infrastructure. With this in mind, we selected the CARVER targeting tool and reversed engineered it as a vulnerability assessment tool. Since its inception, infrastructures all over the country have queried as to how it can best be used to protect their resources.

The CARVER+Shock Vulnerability Assessment Tool has been used to successfully identify vulnerabilities in the Power Industry, Agriculture, Food, and Transportation to name a few. The USDA and FDA have made public statements that this tool is the tool of choice for identifying vulnerabilities throughout the farm to fork continuum. The Department of Homeland Security has plans to train its Protective Services Division (PSD) in the use of this tool as well. Specific customers include:

  • The White House Homeland Security Council, Bio Security Team
  • The US Department of Agriculture
  • Food and Drug Administration Center for Food Safety and Applied Nutrition (CFSAN)
  • Government of Mexico Food and Agriculture Officials
  • Privately owned Nuclear Power Plants
  • National Pork Producers Council
  • Various Port and Airlift facilities
  • US NORTHERN COMMAND

With this level of support, it only made sense that The Foundation use The Tool to continue to fuel its own recent successes in providing Homeland Security education, training and services. The initial success of this new partnership was applying the Tool’s innate ability to very quickly breakdown a sophisticated infrastructure to analyzing the Public Health System. Using the Tool, we very quickly identified three basic subsystems that make up the Public Health System. These are Service providers, equipment and infrastructure, and consumables. This initial success gave the partnership visibility to organizations such as the RAND Corporation, The Department of Homeland Security, and the National Pork Producers Council. We are now poised to provide education, training, and services to infrastructure providers across America and the international market.

We can provide more than just assessments:

  • We offer in-depth training of vulnerability analysis.
  • Threat Identification through Open Source Intelligence, and Red Teaming.
  • Create a Vulnerability Analyst Network (VAN).
  • The VAN maximizes state of the art encryption and compression to provide real-time knowledge of what to do right now, in this situation.
  • We can develop a comprehensive program for your infrastructure.