Attack Scenarios

The interplay between the chemical and biological properties of the threat agent, on the one hand, and the specific attack scenario, on the other, can influence the lethality of the attack. Table 2-2 shows the relative respiratory toxicities (expressed as the lethal concentration of toxin at which 50 percent of test animals are killed, or LCT50, in milligrams per minute per cubic meter) of a variety of toxic gases compared with chlorine gas, which was used as a chemical weapon in World War I. According to Table 2-2, the nerve agent sarin (GB) has a respiratory toxicity approximately 100 times that of chlorine, while sulfur mustard (HD) is about 7 times more toxic. However, the lethality of an attack... 

The chemical and physical characteristics affect exposure levels, depending on the specific attack scenario. If, for example, the agent is released at ground level and victim exposure occurs by breathing the vapor while standing, the vola-... 

Examples of potential chemical attack scenarios are identified in a Federal Aviation Administration (FAA)-funded study undertaken at Johns Hopkins University Chemical Sensing and Mitigation Options for Commercial Airliners, Final Report, STD-01-189, Laurel, Md. Johns Hopkins University Applied Physics Laboratory, July 2001. 

Establish SCADA Red Teams to identify and evaluate possible attack scenarios. 

In silico models of anthrax release can be used to bridge the gap to help predict consequences of human exposure in the event of an outbreak or biological attack scenario. Several modeling studies have been pubhshed (Wein et al,... 

Several animal model studies have focused on the immime response to infection and also to vaccination. Most studies identify antibody titer, but some also show cytokine production or possible mechanisms of bacterial evasion. A focus on immime response studies will help to further define B. anthracis pathogenesis and provide insight into the design of future vaccines and therapeutics. Most countermeasure studies have been conducted on vaccines, as antibiotic studies have typically been performed in vitro. Primary concerns are the length of required treatment, effieient prophylaxis methods, and less complicated dosing regimens for vaccines. In a theoretical bioterrorist attack scenario, it will be essential to distribute effective treatment and prophylaxis to infected or potentially exposed persons in an expedient manner. 

The final result of this step is a set of design basis threat statements that you can use to develop attack scenarios in the next step. Some examples are... 

Attack Scenarios. In this step, you put together the information obtained in the previous three steps to establish scenarios for potential terrorist attacks using the design basis threats against your assets to produce adverse consequences. For example, you might identify that a terrorist could drive a VBIED close enough to an anhydrous ammonia storage tank that upon detonation, the tank will collapse and release ammonia, with resultant impact on the nearby population. 

Step 10 Determine if Existing Countermeasures are Sufficient to Address Possible Attack Scenarios. Security countermeasures envisage a four-tier approach, involving deterrence, detection, delay, and response. These four components are described briefly below. Persons wishing a detailed discussion of security countermeasures should obtain a copy of the Protection of Assets Manual, published by the American Society of Industrial Security (www.asis.org). 

Adopt a reasoned view of chemical and biological weapons exposure environments. In the Cold War, massive attack scenarios led to requirements for chemical and biological defense for the Services on the basis of exposures at the point of release (i.e., the highest level). The risk-based approach recommended by the committee ties levels of protection not to the worst case, but to an accep-... 

Detonation of an improvised or stolen nnclear weapon by terrorists is the worst-case radiological attack scenario (5). Althongh difficnlt to construct, due to requirements for sophisticated engineering and expertise, an improvised nuclear device could produce a yield similar to the Hiroshima bomb, with release or radiation, blast, thermal pulses, and radioactive fallout (1). At a minimum, a small nuclear detonation could cause damage equal or exceeding the September 11 attacks in New York City. Even if the nuclear detonation were unsuccessful, the conventional explosion associated with the device could cause significant environmental contamination with the nuclear weapons material, such as plutonium or uranium (1). 

See Dean Wilkening, BCW Attack Scenarios, Sidney D. Drell, Abraham D. Sofaer and George D. Wilson (eds), The New Terror. Facing the Threat of Biological and Chemical Weapons (Stanford, CA Hoover Institution Press, 1999), 76-114. 

ABSTRACT Network Access Control (NAC) implementations improve the security of enterprise networks by controlling the access of nodes to network resources. NAC prevents unauthorized or compromised nodes from accessing the protected network while granting network access to the authorized nodes which conform to security policies defined by network administrators. In this paper, NAC implementations are analyzed to identify their weaknesses. In addition, possible attack scenarios to defeat NAC implementations are addressed. Lastly, newly developing standards and technologies that can offer improved NAC services are explored. 

Day two of each workshop began with the presentation of a hypothetical bioterrorist attack scenario. From Workshop 1 through Workshop 5, the attack scenarios increased in scale from an attack on a single building to an attack on... 

As used here, a group exercise to imagine all possible terrorist attack scenarios against the chemical infrastructure and their consequences. 

The development of worst-case scenarios is certainly subjective, but government agencies and organizations develop guidelines for this task. For example, there is certainly a chance that an asteroid will inpact Earth direcdy in the middle of the chemical plant. Should this be the worst-case scenario Most people would argue that this takes the worst-case scenario study beyond reason, but there are no clear-cut rules. The subjective rules that have been developed contain definitions such as the worst accident that might reasonably be assumed possible over the life of the facility. Different people would define possible (or probable ) in different ways. Is sabotage by an enployee possible Is the simultaneous failure of three independent safety systems probable Certainly the events of September 11, 2001, have indicated that a terrorist-attack scenario is not inpossible. Sometimes probabilities of occurrence can be estimated, but often they cannot. 

The paper is structured as follows. In Section 2 related work is presented. Section 3 introduces PROFIsafe and in Section 4 the attack scenario and results are presented. In Section 5 network secmity countermeasmes are introduced and finally in Section 6 conclusions are presented. 

To illustrate these issues, we now discuss two exemplary attacking scenarios ... 

Figure 1 presents the proposed model-based attack scenario testing framework. Attack scenarios are modeled in extended abstract machines (ASMs), where states are instrumented with specific attack attributes. ASMs incorporate attack variables in the state machines [6,8,9]. The attack variables allow more specific descriptions of system attributes corresponding to different attacks. An attack is modeled as a set of states and transitions. States represent a snapshot of different system attributes during the course of attacks. The transitions are labeled with system events that cause changes from one state to another. A state transition can take place only if certain conditions associated with the transition are satisfied. The system events need to take place in certain order to make an attack successful. Once the system reaches a state under attack, an attack report is generated (see example in Section 3.3). 

The rest of the framework consists of three major modules signature-base module, sensor module, and main module (see Section 3.1). The three modules form the architecture of the attack test driver. Signature-base module provides the executable attack test scenarios called attack signatures that are ready to be used for testing by the attack test driver. The attack signature generator is used to produce attack signatures from the modeled attack scenarios. 

---