Improving physical security with simulations

To assess the physical security of sites such as nuclear reactors, facilities are increasingly turning to modeling and simulation software that tests their security against external and internal threats.

Traditionally, subject-matter experts performed security assessments, but their accuracy depends on their knowledge and carrying out force-on-force attacks, or simulated attacks. Those efforts  can go only so far because “you’re not really going to blow a hole in a fence or knock down doors,” said Bob Scott, senior vice president of business development and marketing at ARES Security, the firm behind ARES Security’s Automated Vulnerability Evaluation for Risks of Terrorism software. AVERT was recently accredited by the Department of Energy after undergoing testing conducted in conjunction with the Defense Department.The industry and technological capabilities have evolved to go beyond such qualitative assessments to create a science based on computerized modeling and simulation, ARES Security Senior Vice President Blane Schertz said.

“You’re dealing with thousands and thousands of pieces of data, and quite frankly, it’s impossible for any one individual subject-matter expert to be able to put all those pieces together and to know for sure that you’re protecting the site against the threats that are possible,” Schertz said.

AVERT team members work with site security officials to collect data on details such as terrain, walls, fences, guard posts, towers, door types and weapons with the goal of creating a timeline for potential attack scenarios.

All of that information goes into the software to build a virtual model of the site. Then AVERT runs multiple attack scenarios, calculating the path attackers would take to get to their target, whether it’s a data center or nuclear controls. Using the resulting data, officials can see vulnerabilities, seal off breach points and test the scenario again using the Monte Carlo probability simulation process, which involves a random-number generator that can help users understand the likely length of time it would take an adversary to pull off an attack in each situation.

“That’s how we start to achieve a probabilistic, performance-based outcome and how well the security system achieves the goal,” Scott said.

For instance, guard costs at a nuclear reactor are $350,000 to $500,000 per year, he said, so if a facility can find a redundant post, it stands to make a significant savings.

“We can go in and play the ‘what if’ game,” Scott said. “We’ll model the site, and we’ll put in exactly what their security capabilities are today. We’ll run hundreds of simulations, we’ll put in different scenarios, different attack types, and we’ll take a look at how well the site does, and that gives us a baseline capability.”

Then officials can analyze the potential for removing a post. AVERT has helped one site reduce 14 posts and another halve its security costs, he said.

ARES Security employees help customers set up AVERT by spending about three days doing a walk-down inspection of the site, constructing a first version of the model over a three-month period and editing it for accuracy. Then security officials are trained so they can use the tool themselves.

Although the simulation and modeling could be done in the cloud, “traditionally in the security domain, we tend to run on fixed computers that are not connected to the network,” Scott said. “You’re modeling and identifying all the vulnerabilities, all the protective strategies, all the stuff that you really don’t want the bad guys to have access to, so we tend to run on a non-networked environment.”

AVERT is the first commercial software to receive verification, validation and accreditation after undergoing testing that DOE conducted in conjunction with the Defense Department. This adds to AVERT’s certification in accordance with to the Homeland Security Department’s Support Anti-Terrorism by Fostering Effective Technologies (SAFETY) Act, which it has held since 2010. That certification gives the company insurance protection, Scott said, against consequential damages if something goes awry.

Sandia National Laboratory performed the verification part of the testing, while the Johns Hopkins Physics Lab handled validation. In 2012, DOD validated the product for use, but a security breach by protesters at Oak Ridge National Laboratory’s nuclear plant in 2013 slowed DOE’s accreditation process. It was approved in February.

In the future, AVERT may be applied at agencies outside the defense and homeland security areas. Transportation departments have expressed interest in using it for critical infrastructure, Scott said.

Editor's note: This article was changed June 4 to correct the name of ARES Security.