Asset Vulnerabilty Model

AVM was developed to work with the Department of Homeland Security (DHS) Risk Management Framework (RMF) to provide 1) baseline analysis, 2) cost-benefit analysis, and ) decision support tools informing resource investments protecting the nation's critical assets. AVM caluclates risk as a function of theta, the probability of attack failure. Theta is calculated for each critical asset as the product of of P(dis), the probabiity an attack can be detected/disrupted, P(def), the probabiilty an attack can be defeated, P(den), the probability a worst case disaster can be averted, P(dim), the probability that 100% of survivors can be saved, and %(dam), the consequences of a worst cas diaster resulting from the loss or exploitation of the asset expressed in terms of changes to gross domestic product and national mortality rates (for assault). As real asset information is protected under the 2002 Homeland Security Act, simulated data is generated for his program model.

AVM Baseline Generator Program file Test20c.c generates a set of assets and computes theta for each one. This is a windows console application. The program is invoked from a windows command prompt. Arg1 is the # of assets to generate. Arg2 is the output file name (Comma Delimited Format text file). c:> Test20c arg1 arg2 Theta1.xlsx is an Excel 2010 spreadsheet for displaying the output from Test20c. The output file is loaded from the first tab in the spreadsheet my selecting Data/Get External Data/From Text.

AVM Cost-Benefit Analysis Cost benefit analysis is conducted on proprosed protective measure improvements generated by Test21f.c. This program takes as input the output from Test20c, the baseline assets. It produces an output file with the indicated assets and proposed protective measures. This file then becomes input to Test22e.c which will conduct cost-benefit analysis to find the optimum combination of protective measures for each asset. The results are written to a CDF file for upload and display in Theta2.xlsx (using same method as Theta1). Protective Measures Generator c:> Test21f asset_infile measures_outfile CBA Evaluation c:> Test22e measures_infile CBA_outfile

AVM Sensitivity Analysis Test23e.c generates data pursuant to conducting AVM sensitivity analysis. Test23e takes the output from cost benefit analysis, Test22e, and conducts a range of calculations on the data. The output from Test23e is a series of CDF files for upload into Theta3.xlsx. This program will graph the data for comparative analysis. c:> Test23e CBA_infile outfile