SARMA had the recent pleasure of co-hosting, with the George Mason University's Center for Infrastructure Protection and Homeland Security (CIP/HS), a one-day policy forum entitled The Relevance of Risk Management and Information Sharing to Homeland Security.

Delayed by the largest blizzard to hit the Washington area in 50 years, the March 30th event brought together a wide range of experts from academia, government and the private sector. What follows is a summary of the morning's panel discussions and presentations on risk management. In the May issue we will recap the afternoon sessions on information sharing.

David Maurer, Director of Homeland Security and Justice programs at the U.S. Government Accountability Office (GAO), was the day's first keynote speaker. In discussing the application of effective risk-management and information-sharing principles to homeland security, Mr. Maurer noted that the Department of Homeland Security has improved its cohesiveness and matured as a department, but that many of its 22 agencies still maintain their own institutional cultures. He stressed the importance of finding a unified mission for DHS, fostering a common internal culture and improving coordination between agencies.

Drawing from a 2008 GAO report entitled Risk Management: Strengthening the Use of Risk Management Principles in Homeland Security, Mr. Maurer advocated the adoption of five risk management phases:

Mr. Maurer stated that the first three phases relate to "mission risk" -- defined as the desired end state, the threats the US faces and how resources are allocated. The latter two fall under "program risk", or the resources needed and how to achieve results.

In his concluding remarks, Mr. Maurer emphasized that the federal government lacks an information-sharing roadmap, and a system of responsibility for dealing with security issues. Although DHS agencies have made some progress in trying to implement such a roadmap, he noted, there are also currently no metrics, accountability or clear lines of authority. He also noted the need for guidelines and training, and for better sharing of terrorism intelligence.

Panel I: Federal Program Risk Management
Moderator:Jack Johnson, Principal, PricewaterhouseCoopers
Panelists:Jack Kelly, Policy Analyst, Office of Management and Budget; Joseph Kull, Director, PricewaterhouseCoopers; Kerry Thomas, Senior Director, ABS Consulting/SARMA President

Mr. Kelly opened with a discussion of OMB Circular No. A-123, which defines management responsibilities for internal controls in federal agencies. Regarding risk management, he made the point that risk management has become too specialized and mysterious, when in fact it is essentially regular management "with a special focus on the consequences of failure."

In a subsequent discussion of internal controls, Mr. Kull noted their vital role in the development of policies and procedures, which in turn allow an organization to fulfill its mission, strategy and objectives. In the case of DHS, Mr. Kull also noted that there are cultural issues that affect the agency's mission. He further stressed that, in order to succeed, an agency must have a clear mission, an objective (long-term goals and the activities needed to achieve them), benchmarks, metrics, policies and procedures in place. It also must constantly monitor and fine-tune its programs, and employ grants as an important means of gauging results in measurable ways that can be communicated to key stakeholders.

Elaborating on this discussion of grant programs and metrics, Mr. Thomas stated that today there is an inability to answer the following question: how much safer are we? He asserted that since 9/11, there have been more than $30 billion in grants to secure the homeland, yet the grant-making progress still does not have an effective means of determining the effectiveness of these funds on reducing risk.

Mr. Thomas also suggested several approaches for doing things differently. First, he indicated there is a need for a common risk management framework and lexicon. Second, there is a need for a common governance structure to prevent "stovepiping." Challenges include the need to better communicate risk and the need to better manage resources. Mr. Thomas concluded by articulating a vision for future risk management, which includes:

Panel II: Cyber Risk Mitigation/Management
Moderator:Timothy Clancy, Senior Program Director, Cybersecurity, CIP/HS
Panelists: Rear Adm. Michael Brown, Deputy Assistant Secretary for Cybersecurity and Communications, DHS; Pablo Martinez, Assistant Special Agent in Charge, Criminal/Investigative Division, U.S. Secret Service; Gen. Robert Elder, Research Professor of Electrical & Computer Engineering, GMU

Adm. Brown stated that the mission of his office is tied to the intelligence community, the Department of Defense and the private sector, and noted that cyber-security is one of five mission areas highlighted in the Quadrennial Homeland Security Review (QHSR). He also mentioned the need for technical expertise, the need to take advantage of changes in technology, a skilled and trained workforce that understands the threat and the technology, and the freedom to allow the workforce to innovate.

With regard to transnational threats, Adm. Brown stressed the need for global situational awareness; the need to work with law enforcement and intelligence partners; international cooperation; the involvement of the private sector in public-private partnerships; and the establishment of rules and responsibilities and the ability to deal with cyber threats.

Concerning the recent establishment of the DoD Cyber Command, Adm. Brown stated that it was good to have a unified command, and that DHS's mission is to work with DoD and the National Security Agency to ensure success. With regard to information sharing, he said the public sector works well with the private sector, but there is an information-sharing problem between entities in the private sector.

Mr. Martinez asserted that because cyber crime is transnational, it poses logistical challenges to law enforcement agencies trying to investigate such crimes. He called for developing relationships with law enforcement counterparts overseas and with the private sector. He also talked about the role of the Internet in cyber crime, and about how every Secret Service Academy student now receives several weeks of instruction in the subject. He mentioned that the Secret Service is working with and providing key resources to state and local officials, and he stressed the importance of teaching people how to use technology and of using clear terminology to help judges and juries understand the nature of cyber crimes.

Gen. Elder talked about the need to acknowledge the vulnerabilities and the current lack of resiliency in systems. He discussed how the military studies previous incidents in order to understand their causes as part of a broader risk management process. When discussing the transnational threat, he suggested the need to focus on the behaviors of the system. He supported the establishment of a unified Cyber Command structure at DoD, but also expressed concern about the magnitude of the challenges facing its leaders.

Coming next month, Part II: information-sharing panel summaries, Gen. Michael Hayden, and more.

"About 0.01 percent of men with no known risk behavior are infected with HIV. If such a man has the virus, there is a 99.99 percent chance that the test result will be positive. If a man is not infected, there is a 99.99 percent chance that the test result will be negative. What is the chance that a man with no known risk behavior who tests positive actually has the virus?"  

"Imagine 10,000 men who are not in any known risk category. One is infected and will test positive with practical certainty. Of the 9,999 men who are not infected, one will test positive.  So we can expect that two men will test positive."

"Depending on the exact procedure used, an HIV test is likely to be positive for about 998 of 1,000 people infected with HIV. About one in 10,000 persons will generate a false positive result. False positives can be reduced by repeated testing using different methods but not completely eliminated as certain medical conditions and laboratory errors can still generate false positives.

"About one in 10,000 heterosexual men with low-risk behavior are infected with HIV. Of those 10,000 low-risk men, one is likely to be infected and will almost certainly test positive (99.8 percent likelihood). Of the 9,999 non-infected men, one will also test positive. Thus we expect that of 1 of 2 men who test positive, only one has HIV. This is the situation you would be in if you were to test positive and are in a low-risk group. Your chance of having the virus would be about one in two.

"Therefore, for persons with no known risk behaviors, a second HIV test should be conducted before confirming the positive diagnosis."

ABS Consulting is seeking a talented professional to provide technical and management consulting services to the federal government, specifically in the area of homeland security risk analysis for grant allocation at FEMA. Education and experience with economics or a related field is a key requirement. An active security clearance is preferred.