BUILDING DESIGN FOR HOMELAND SECURITY
Unit IV
Vulnerability Assessment
Vulnerability
Any weakness that can be exploited by an aggressor or, in a
non-terrorist threat environment, make an asset susceptible
to hazard damage
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-2
Unit Objectives
Explain what constitutes a vulnerability.
Identify vulnerabilities using the Building Vulnerability
Assessment Checklist.
Understand that an identified vulnerability may indicate that
an asset:
is vulnerable to more than one threat or hazard;
and that mitigation measures may reduce vulnerability to one or
more threats or hazards.
Provide a numerical rating for the vulnerability and justify
the basis for the rating.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-3
Vulnerability Assessment
Identify site and building systems design issues
Evaluate design issues against type and level of threat
Determine level of protection sought for each mitigation
measure against each threat
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-4
Assessment Flow Chart
Cost Analysis
AssetValue Analyze how mitigation
Assessment options affect asset criticality
(Section 1.1) and ultimately risk
Vulnerability Identify Decision
Assessment Risk Assessment Mitigation Options (Risk Management)
(Section 1.3 ) (Section 1.4)
(Chapters 2 and 3) (Section 1.5)
Analyze how mitigation
options change vulnerability
Threat/Hazard and ultimately risk
Assessment
(Section 1.2)
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-5
Identifying Vulnerabilities
Multidisciplinary Team
Engineers
Architects
Security specialists
Subject matter experts
Outside experts if necessary
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-6
Vulnerability Assessment Preparation
Coordinate with the building stakeholders:
Site and Building Plans
Utilities
Emergency Plans (shelter, evacuation)
Interview schedules
Escorts for building access
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-7
Assessment GIS Portfolio
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-8
10-Mile Radius
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-9
Regional Transportation
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-10
Metro Center Imagery
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-11
Site Emergency Response
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-12
Site Public and Government Buildings
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-13
Site HazMat
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-14
Site Local Transportation Network
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-15
Site Principal Buildings by Use
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-16
Site Perimeter Imagery
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-17
Site Truck Bomb
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-18
Site Car Bomb
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-19
Options to Reduce Vulnerability
1)
1) Define
Define Site
Site Functions
Functions
Interviews with Site Personnel
2)
2) Identify
Identify Critical
Critical Systems
Systems
3)
3) Evaluate
Evaluate Facility
Facility System
System Interactions
Interactions Review Prints and
Specs; Check with
4)
4) Determine
Determine Common
Common System
System Vulnerabilities
Vulnerabilities Systems Experts
5)
5) Physically
Physically Locate
Locate Components
Components and
and Lines
Lines On-site Inspections
Apply Vulnerability
6)
6) Identify
Identify Critical
Critical Components
Components and
and Nodes
Nodes Checklist
7)
7) Assess
Assess Critical
Critical Nodes
Nodes vs.
vs. Threats
Threats Threat Spectrum Evaluation
8)
8) Determine
Determine Survivability
Survivability Enhancements
Enhancements Survivability Options
9)
9) Document
Document Entire
Entire Analysis
Analysis Process
Process Records
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-20
Facility System Interactions
Figure 1-8: Facility System Interactions, page 1-23
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-21
Single-Point Vulnerabilities
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-22
Functional
Analysis
SPVs
Standard 11
The loading dock and warehouse provide single point of entry to the interior
Standard 13
and 17 The mailroom is located within the interior and not on exterior wall or separate HVAC system
Standard 1
The telecom switch and computer data center are adjacent to the warehouse
Standard 1
The trash dumpster and emergency generator are located adjacent to the loading dock
Figure 1-10: Non-Redundant Critical Functions
Collocated Near Loading Dock, p. 1-41
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-23
Infrastructure SPVs
Electrical Service
Air Intakes Drive Through
Telecom Service
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-24
Building Vulnerability Assessment Checklist
Compiles best practices from many sources
Includes questions that determine if critical systems will
continue to function during an emergency or threat event
Organized into 13 sections
Each section should be assigned to a
knowledgeable individual
Results of all sections should be integrated into a
master vulnerability assessment
Compatible with CSI Master Format standard to
facilitate cost estimates
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-25
Building Vulnerability Assessment Checklist
Site Electrical Systems
Architectural Fire Alarm Systems
Structural Systems Communications and IT
Building Envelope Systems
Utility Systems Equipment Operations
and Maintenance
Mechanical Systems Security Systems
(HVAC and CBR)
Plumbing and Gas Security Master Plan
Systems
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-26
Building Vulnerability Assessment Checklist
Vulnerability Question Guidance Observations
6 Mechanical Systems (HVAC and CBR)
Where are the air intakes Air intakes should be located on the roof or
and exhaust louvers for the as high as possible. Otherwise secure within
6.1 building? (low, high, or CPTED-compliant fencing or enclosure. The
midpoint of the building fencing or enclosure should have a sloped
structure) roof to prevent throwing anything into the
enclosure near the intakes.
Are the intakes and exhausts
accessible to the public? Ref: CDC/NIOSH Pub 2002-139
Is roof access limited to Roofs are like entrances to the building and are
authorized personnel by like mechanical rooms when HVAC is installed.
6.2 means of locking Adjacent structures or landscaping should not
mechanisms? allow access to the roof.
Is access to mechanical Ref: GSA PBS P100, CDC/NIOSH Pub
areas similarly controlled? 2002-139, and LBNL Pub 51959
Extracted from Table 1-22: Building Vulnerability
Assessment Checklist, pages 1-46 to 1-92.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-27
Building
Vulnerability
Assessment
Checklist
5.19 By what means does the main telephone and data communications interface the site or building?
5.20 Are there multiple or redundant locations for the telephone and communication service?
Does the fire alarm system require communication with external sources?
5.21 By what method is the alarm signal sent to the responding agency: telephone, radio, etc.?
Is there an intermediary alarm monitoring center?
Extracted from Table 1-22: Building Vulnerability
Assessment Checklist, pages 1-46 to 1-92.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-28
Building
Vulnerability
Assessment
Checklist
1.15 Is there minimum setback distance between the building and parked cars?
What is the designed or estimated protection level of the exterior walls against the postulated explosive
4.1
threat?
Is the window system design on the exterior faade balanced to mitigate the hazardous effects of flying
4.2
glazing following an explosive event? (glazing, frames, anchorage to supporting walls, etc.)?
Extracted from Table 1-22: Building Vulnerability
Assessment Checklist, pages 1-46 to 1-92.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-29
Building Vulnerability Assessment Checklist
Where are the air intakes and exhaust louvers for the building?
(low, high, or midpoint of the building structure)
6.1
Are the intakes and exhausts accessible to the public?
Is there any potential access to the site or building through utility
1.9 paths or water runoff? (Eliminate potential site access
through utility tunnels, corridors, manholes, storm water
runoff culverts, etc. Ensure covers to these access points
are secured.)
What type of construction?
3.1 What type of concrete and reinforcing steel?
What type of steel?
What type of foundation?
Extracted from Table 1-22: Building Vulnerability
Assessment Checklist, pages 1-46 to 1-92.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-30
Building
Vulnerability
Assessment
Checklist
Are loading docks and receiving and shipping areas separated in any direction from utility rooms, utility
2.19 mains, and service entrances, including electrical, telephone/data, fire detection/alarm systems, fire
suppression water mains, cooling and heating mains, etc.?
Does adjacent surface parking on site maintain a minimum standoff distance? For initial screening
1.16 consider using 25 meters (82 feet) as a minimum with more distance needed for unreinforced
masonry or wooden walls. Reference: GSA PBS-P100
Extracted from Table 1-22: Building Vulnerability
Assessment Checklist, pages 1-46 to 1-92.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-31
Vulnerability Rating
Very High One or more major weaknesses have been identified that
make the asset extremely susceptible to an aggressor or hazard.
High - One or more significant weaknesses have been identified that
make the asset highly susceptible to an aggressor or hazard.
Medium High An important weakness has been identified that makes
the asset very susceptible to an aggressor or hazard.
Medium A weakness has been identified that makes the asset fairly
susceptible to an aggressor or hazard.
Medium Low A weakness has been identified that makes the asset
somewhat susceptible to an aggressor or hazard.
Low A minor weakness has been identified that slightly increases the
susceptibility of the asset to an aggressor or hazard.
Very Low No weaknesses exist.
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-32
Critical Functions
Armed attack Vehicle
Function Cyber attack CBR attack
(single gunman) bomb
Administration
Asset Value 5 5 5 5
Threat Rating 8 4 3 2
Vulnerability Rating 7 7 9 9
Engineering
Asset Value 8 8 8 8
Threat Rating 8 5 6 2
Vulnerability Rating 2 4 8 9
Extracted from Table 1-20, page 1-38
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-33
Critical Infrastructure
Armed attack Vehicle
Function Cyber attack CBR attack
(single gunman) bomb
Site
Asset Value 4 4 4 4
Threat Rating 4 4 3 2
Vulnerability Rating 3 5 9 9
Structural Systems
Asset Value 8 8 8 8
Threat Rating 3 4 3 2
Vulnerability Rating 2 4 8 9
Extracted from Table 1-21, page 1-39
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-34
Summary
Step-by-Step Analysis Process:
Expertly performed by experienced personnel
Determines critical systems
Identifies vulnerabilities
Focuses survivability mitigation measures on critical
areas
Essential component of Critical Infrastructure and
Critical Function Matrices
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-35
Unit IV Case Study Activity
Vulnerability Rating
Background
Vulnerability: any weakness that can be exploited by an aggressor or, in
a non-terrorist threat environment, make an asset susceptible to hazard
damage
Requirements: Vulnerability Rating Approach
Use rating scale of 1 (very low or no weakness) to
10 (one or major weaknesses)
Refer to HIC case study and rate the vulnerability of asset-threat/hazard
pairs:
HIC Critical Functions
HIC Infrastructure
BUILDING DESIGN FOR HOMELAND SECURITY Unit IV-36
