Vulnerability Assessment and Incident Prevention

1
Vulnerability Assessment and Incident Prevention

• Report Back
• Mike Cox EPA
• Robin Gardner BC, Canada
• Dan Phalen - EPA

2
Vulnerability Assessment and Incident Prevention

• Purpose of Track 1
• Develop an understanding of vulnerability
  assessments for water supplies
• Describe available tools for conducting
  vulnerability assessments
• Provide examples of how tools are used
• Identify data gaps and needs

3
Vulnerability Assessment and Incident Prevention

• General Observations
• Mission Provide safe, reliable water supply and
  wastewater collection and treatment
• VAs should be viewed in larger context Security
  of service, not just from terrorism
• Work that goes into VA process is most important
  and should be iterative and linked to other
  threat assessments

4
Vulnerability Assessment and Incident Prevention

• General Observations
• Integrated threat management (not just response
  but prevention, mitigation, and preparedness)
• Benefits of consulting w/ law enforcement
• Sensitivities around plans, sharing information
• What will EPA do with VAS?

5
Vulnerability Assessment and Incident Prevention

• Federal Coordination
• Central repository for grants (how to get and
  administer)
• Improve process for stuff
• Secrecy classification
• Security of information
• Information sharing within and outside government
• Develop standard security clearance system for
  people

6
Vulnerability Assessment and Incident Prevention

• EPA Actions
• Develop spreadsheet on comparison of tools and
  resources
• Information sharing/secrecy
• Guidance on detection and response to specific
  CBRN (chemical, biological, radiological, and
  nuclear) agents, incidents, and clean up for
  health professionals and facility operators

7
Vulnerability Assessment and Incident Prevention

• EPA Actions
• Risk communication Cultivating understanding of
  risk and development of pre-scripted materials
• Guidance on more complete ER Plans to encompass
  prevention, mitigation, preparedness,
  consequence management, and long-term recovery
• Expand RAM-W to include cost/benefit analysis and
  other threat types similar to VSAT

8
Vulnerability Assessment and Incident Prevention

• EPA Actions
• Change of focus to continuity of operations not
  just response
• Guidance on best practices for reducing
  vulnerabilities based on size and capability
• Determine vulnerability of web-based SCADA
  systems, maintenance management systems, and GIS