Risk and vulnerability analysis

The approach to be evaluated is suggested to be a risk and vulnerability analysis, one analysis performed with the perspective of Resilience Engineering and one classical without RE perspective. We are suggesting to compare the results of the two processes - both in the short term result and the long term effect. 

Aven T. 2007. A unified framework for risk and vulnerability analysis and management coveting both safety and security. ReliabiHty Engineering and stem Safety, 92, 745-754. 

ABSTRACT Critical infrastructures are important for maintaining essential functions in a modem society. Risk and vulnerability analysis (RVA) has been applied and adapted for each critical infrastrucmre sector independently. This has resulted in different risk assessment approaches, and insufficient analyses of interdependencies between the sectors. This article presents an approach for analyzing infrastructure interdependencies as part of a RVA. A short review of current models and analysis approaches is given, and an example from a case study of the city of Oslo, Norway, is presented. 

Over the years, risk and vulnerability analysis (RVA) has been appUed and adapted for various infrastructures. However, these analyses often do not evaluate the effects of undesired events across sectors. The need for a unified approach to such analyses is addressed in the research project DECRIS (Risk and Decision Systems for Critical Infiastructures). The main objective of DECRIS is to develop an all-hazard generic RVA suitable for a cross-sector infrastmcture analysis. Both safety (accidents, technological failures etc.) and security (dehberate actions) aspects are included. A general case study of the city of Oslo, Norway, focusing on imdesired events in the infrastructures electric supply, water supply, transportation, and ICT, has been carried out (Utne et al. 2008). 

Johansson, J. (2007). Risk and vulnerability analysis of large-scale technical infrastmctures. Department of Industrial Electrical Engineering and Automation, Lund University. Licentiate Thesis. 

Utne, I. B., P. Hokstad, G. KjOlle, J. Vatn, I. A. TOndel, D. Bertelsen, H. Ftidheim, and J. ROstum (2008). Risk and vulnerability analysis of critical infrastructures -the DECRIS Approach. In SAMRISK conference, Oslo, Norway, September 2008. 

Understanding the causes of poverty and vulnerability is of paramount importance to select policies and programs that can reduce or eliminate poverty, including safety nets. In general, poverty is generated by a lack of assets, uninsured exposure to shocks, or a combination of these factors. Poverty analysis and risk and vulnerability analysis will inform the choice of intervention whether to use a safety net program and which type of safety net program would be more appropriate. 

Risk and vulnerability analysis. Complements poverty analysis by providing insights into the risks the poor face, as well as the size and characteristics of the population at risk of becoming poor in the event of a shock. 

It was tried to align requirements for SILs (safety requirements) with related security requirements of appropriate level for products (components from CPS view point). This is based on the idea that a similar level of rigidness as defined e.g. in lEC 61508 and ISO 15408 should be applied to the SRLs on both sides (see Table 1). In case the risk and vulnerability analysis (combined safety and security analysis) provides evidence that different levels are required for both issues then the recommendations shall change. 

Unfortunately, the approach was in the end not accepted, security should not be tackled in such detail. The conclusion was to add separate clauses into lEC 61508 everywhere where security could have an impact on safety giving advice on how to integrate the security aspect as an additional hazard (risk) for the safety-critical system, i.e. to look at the safety impact of security breaches and then derive requirements for the safety critical system, based on a joint hazard, risk and vulnerability analysis. From a complete Annex remained a few clauses only, but at least there is some pointer in lEC 61508 to the security issue in safety related systems [20]. 

Describe risk assessment, hazard identification, and vulnerability analysis. 

In order to carry out a risk analysis study, the Company of Enviromnent Technology (CETESB, in Portuguese) of the Sao Paulo State Govermnent, Brazil, adopts a procedure constituted for six steps (CETESB, 2003) (i) characterization of the enterprise and the region (ii) hazard identification and estabUshment of accidental hypothesis (iii) estimation of physical effects and vulnerability analysis (iv) estimation of frequencies (v) risk estimation and assessment and (vi) risk management. 

Section 5. Emergency Response Planning (assembling hazards, vulnerability analysis, and risk analysis information). 

Risk assessment is an essential feature of disaster planning and is in essence a calculation or model of risk, in which a comprehensive inventory is created including all existing and potential dangers, the population most likely to be affected by each danger, and a prediction of the health consequences. Risk analysis uses the elements of hazard analysis and vulnerability... 

Source Information obtained from Landesman, L (2001). Chapter 5 Hazard assessment, vulnerability analysis, risk assessment and rapid heaith assessment In Public health management of disasters The practice guide. Washington, DC American Pubiic Heaith Association. The author gratefully acknowledges Dr. Linda Landesman and the American Public Heaith Association for permission to reproduce this work. 

Risk analysis is an assessment of the likelihood (probability) of an accidental release of a luizardous material and tlie actual consequences tliat might occur, based on tlie estimated vulnerable zones. It provides an estimation of tlie likelihood (probability) of an accidental release, tlie severity of consequences of human injuiy that may occur, the severity of consequences on critical facilities, tlic severity of consequences of damage to property, and the severity of consequences of damage to tlie enviromnent. Risk characterization estimates tlie healtli risk associated with tlie process under investigation. The result of tins cliaracterization is a number tliat represents tlie probability of adverse healtli effects from tliat process or from a substance released in tliat process. Tire major types of risk include Individual Risk, Maximum Individual Risk (MIR), Population Risk (PR), Societal Risk, and Risk Indices. 

---