Newswise — A new study will be published next month showing the standard risk analysis used by security risk analysts based on probabilities of uncertain hazards may not capture the impact of a so-called “intelligent attacker’s” intent.
The study, “Intelligent Adversary Risk Analysis: A Bioterrorism Risk Management Model,” was prepared by three professors at the United States Military Academy at West Point, New York, including Gregory S. Parnell, Ph.D, Professor of Systems Engineering, Department of Systems Engineering; U.S. Army Major Christopher M. Smith, an instructor in the Department of Mathematical Sciences; and Frederick I. Moxley, Ph.D, Director of Research for Network Science, Department of Electrical Engineering and Computer Science. Findings will appear in the January 2010 issue of the journal Risk Analysis, published by the Society for Risk Analysis.
"We show that treating adversary decisions as uncertain hazards is inappropriate because it can provide a different risk ranking and may underestimate the risk,” said Parnell. “Unlike uncertain hazards, terrorists and hostile states are intelligent adversaries who can observe our vulnerabilities and dynamically adapt their plans and actions to achieve their objectives.” He said modeling adversary objectives “will provide greater insight into the possible actions of opponents rather than exhaustively enumerating probabilities on all the possible actions they could take.”
The research compares the standard probabilistic risk analysis (PRA) of uncertain hazards (like engineering failures or natural disasters) modeled using probability distributions for threats, vulnerabilities, and consequences applied to “intelligent adversaries” to a “defender-attacker-defender” model that determines possible attacker intent decisions based on information and defender decisions revealed over time.
“A key difference is historical data,” the authors write, noting historical background “may not prove a valid estimate of future threats because of changes in adversary intent and capability.” The authors hypothesize, “Both uncertain hazard risks of occurrence and geographical risk can be narrowed down and identified concretely. Intelligent adversary targets vary by the goals of the adversary and can be vastly dissimilar between adversary attacks.” The research team notes the ability to influence an event is also different than the ability to influence uncertain hazards. Adversary attacks can take on so many forms that one cannot realistically defend, respond, or recover against all types of attacks. But, they write, “PRA still has an important role in intelligent adversary risk analysis for assessment of the capabilities of adversaries, the vulnerabilities of potential targets and potential consequences of attacks.”
“Use of our defender-attacker-defender model does not require a major intelligent adversary research program, it requires only the willingness to change” perspectives, according to the authors. “Assessing probabilities of attacker decisions will not increase our security, but defender-attacker-defender decision analysis models can provide a sound assessment of risk and the essential information our nation needs to make risk-informed decisions.”
Risk Analysis: An International Journal is published by the nonprofit Society for Risk Analysis (SRA). SRA is a multidisciplinary, interdisciplinary, scholarly, international society that provides an open forum for all those who are interested in risk analysis. Risk analysis is broadly defined to include risk assessment, risk characterization, risk communication, risk management, and policy relating to risk, in the context of risks of concern to individuals, to public and private sector organizations, and to society at a local, regional, national, or global level. www.sra.org
RSS