Chemical Plant Security

1
Chemical Plant Security

• Bill Hendon
• Eastman Chemical Company

2
Topics

• Role of Chemical Industry
• How we hardened up
• Getting some help
• Questions

3
Department of Homeland SecurityCritical
Infrastructure Key Resource Sectors (CIKR)
Critical Infrastructure Sectors

• Key Resources

• Commercial Facilities
• Commercial Nuclear Reactors, Materials, and Waste
• Dams
• Government Facilities

• Agriculture and Food
• Banking and Finance
• Chemical
• Defense Industrial Base
• Drinking Water and Wastewater Treatment Systems
• Emergency Services
• Energy
• Information Technology
• National Monuments and Icons
• Postal and Shipping
• Public Health and Healthcare
• Telecommunications
• Transportation Systems
• Critical Manufacturing

4
Dependency on our Critical Infrastructure Key
Resources

• National Security
• Economic Vitality
• Our Way of Life

• Attacks Could

• Disrupt government and private industry
  operations and impact our economy and society
• Result in large-scale human casualties, property
  destruction, and damage to national prestige and
  public confidence

5
So far..

• According to DHS, our country has critical
  infrastructure (CI) and key resources (KR).
• Chemical Industry is one of these critical
  infrastructures.
• Chemical industry provides mission support for
  the key resources.
• Also, 85 of all CIKR assets are privately-owned.
• ..so what do we do?

6
We protect our business and assets.

• Chemical Plant Security
• Long history of protecting employees,
  communities, and our business.
• Historical security program both in physical and
  cyber security.
• Utilized our trade association, American
  Chemistry Council (ACC), to function as the
  conduit and organizer of a chemical industry
  security program.

7
ACC Responsible Care (RC) program

• ACC created the RC program in response to safety
  and environmental issues for our industry
• The RC consists of 7 codes of manufacturing
  practices
• Employee Health and Safety
• Community Awareness and Emergency Response
• Process Safety
• Distribution
• Product Stewardship
• Pollution Prevention
• Security
• Well focus on the Security Code

8
ACC Security Code

• ACC created the Security Code in June 2002. The
  SC consists of these elements

Leadership Commitment Analysis of threats, vulnerabilities, and consequences
Implementation of Security Measures Information and Cyber Security
Security Program Documentation Security Training, drills, and guidance
Communications, dialogue, and information exchange Response to Security Threats
Response to Security Incidents Security Audits
Third-party verification Management of change
Continuous improvement process
9
Physical Security MeasuresOur industry
installed physical security measures including

• Gates,
• fences,
• closed circuit TV,
• identification badges and readers

• vehicle barriers
• railroad gates,
• motion detectors,
• turnstiles
• and lots of lights.

10
Security Vulnerability Analysis (SVA) our
hazard assessment tool

• A SVA is the process of determining the
  likelihood of an adversary successfully
  exploiting vulnerability, and the resulting
  degree of damage or impact on an asset.
• SVAs are not quantitative risk analyses, but
  instead are performed qualitatively using the
  best judgment of security, safety, and other
  appropriate professionals. This is similar to
  the qualitative risk analysis process that is
  routinely applied in assessing accidental risk at
  the same facilities.

11
Key concepts of the Security Vulnerability
Analysis (SVA)

• Evaluate facilities with highly hazardous
  chemical processes for attack scenarios.
• Relative difficulty of an attack
• Relative severity of an attack
• Attractiveness of a target

12
Center for Chemical Process Safety (CCPS) SVA
Methodology

• Focus on Four Key Security Events
• Loss of Containment release of hazardous
  chemicals
• Theft or Misuse theft of chemicals in order to
  cause harm or divert to criminal uses
• Contamination contaminate product to cause harm
• Degradation of Assets harm to assets, facility,
  infrastructure, business function

13
(No Transcript)
14
Risk Ranking Matrix for Assets
SEVERITY SEVERITY SEVERITY SEVERITY SEVERITY SEVERITY SEVERITY
1 2 3 4 5
1 R1 R2 R3 R4 R5
2 R2 R4 R6 R7 R8
3 R3 R6 R7 R8 R9
4 R4 R7 R8 R9 R10
5 R5 R8 R9 R10 R10
L I K E L I H O O D
L I K E L I HOOD
15
Differences between SVAs and PHAs

• SVA
• Intentional harm assumed
• Likelihood of success of attack, not likelihood
  of being attacked
• Start with perimeter general security measures
  and inward toward specific asset security
• Assume general measures are already in place when
  examining specific targets/assets

• PHA
• NO intentional harm assumed
• Likelihood of process event both being initiated
  and propagating to failure of interest
• Start with specific equipment items, work outward
• No assumption of upgrade completion as a part of
  the analysis

16
New Federal Security RegulationDHS Chemical
Facility Anti-Terrorism Standards (CFATS)

• Establishes risk-based performance standards for
  the security of chemical facilities
• Covered facilities must
• Prepare Security Vulnerability Assessments
  (SVAs), which identify vulnerabilities
• Develop and implement Site Security Plans (SSPs)
• Security Plans must identify specific security
  measures (standards)
• Comply with recordkeeping and information
  protection guidelines
• Establishes DHS authority for inspections, audits
  and compliance orders

17
CFATS Process Requirements
Facility receives Notice to compete "Top
Screen" Chemicals of interest and Quantities
provided
Feedback and Initial tier Assignment From DHS
Facility Completes Top Screen (60 Days)
Facility competes SVA using Chemical
Security Assessment Tool (CSAT) (90 Days)
Facility completes Site Security Plan Using CSAT
Specify Performance Measures (120 Days)
Facility receives final tier assignment from DHS
DHS Audit And SSP Approval
18
Not the end but the beginning

• Until early 2000s, security was based on theft
  prevention and protecting the public.
• Historical companion to safety programs.
• Post 9/11/01, governmental demands and activist
  interest have created several federal regulations
  for security of transportation, ports and
  chemical facilities.
• Chemical industry is much farther ahead than
  other industries.
• Corporate security programs are much more
  involved and sophisticated.