|
|
|
President's Corner
| | |
December 2012
Dear Fellow SARMA Members:
First, let me wish each of you all the best this holiday season and for the new year.
Hopefully many of you were also able to join us earlier this month at our rescheduled annual conference. Given all of the challenges involved, we were extremely fortunate to have most of our original speakers juggle their schedules and join us nearly a month later than planned - our sincerest thanks to them and to our co-hosts, the George Mason University School of Law's Center for Infrastructure Protection and Homeland Security, for helping make this year's conference another great success!
In addition to outstanding speakers, six Directors were also elected to serve on the SARMA Board for the 2012-2013 term. Please join me in congratulating Geoff French, Andrew Harter, John Paczkowski, and Julian Talbot on their re-election. Each has already contributed to SARMA in significant ways, and I look forward to continuing to work with them to further the important work of the Association in the year ahead. These incumbent Directors are joined by Ed Jopeck, a founding member returning for additional service, and Megan Samford, a first-time Board member who I am certain will bring new energy and ideas for advancing SARMA's mission.
Finally, I would like to recognize the efforts of two departing Board members, Frank Moret and Ben Nerud. Frank has been instrumental in nurturing our university partnerships, exemplified by the ongoing relationship with the Penn State Security and Risk Analysis Club. Likewise, Ben has worked closely with Andrew Harter and others in laying the groundwork for launching the SARMA Systems Renewal Project in 2013.
As we close out 2012, I ask that each of you take a moment to both congratulate our new Board members and thank Frank and Ben for their outstanding efforts on behalf of SARMA. For those who attended the conference, you should have also received an invitation to participate in an electronic survey. I ask that you please take a few moments to respond, as your input will help us shape and improve future events.
My best,
Kerry
Kerry L. Thomas
President
|
|
In The News
| | |
In roughly the 10 years following 9/11, terrorists attacked passenger rail systems worldwide 838 times, killing more than 1,370 people, according to the Mineta Transportation Institute. Concerns about the accessibility of US rail transportation systems prompted the Transportation Security Administration (TSA) in 2008 to issue a regulation directing passenger rail agencies to report potential threats and security concerns. Those concerns received some validation when federal authorities thwarted plots against rail systems in New York City and Washington, DC, in 2009 and 2010, respectively. Although TSA issued its rail reporting regulation, the agency hasn't managed it very well, said the Government Accountability Office (GAO) in an audit report released Thursday. Passenger rail agencies require more direction from TSA as to types of incidents they should report. In addition, TSA has not developed the means to consistently analyze the data it receives from rail organizations, GAO said in its report, Passenger Rail Security: Consistent Incident Reporting and Analysis Needed to Achieve Program Objectives.
More than a decade after 9/11, there are still persistent gaps in the country's ability to respond to health emergencies such as bioterrorism, serious disease outbreaks and extreme weather events, according to the 10th annual, Ready or Not? Protecting the Public from Diseases, Disasters and Bioterrorism, report by the Trust for America's Health (TFAH) and Robert Wood Johnson Foundation (RWJF) released Wednesday morning.
Thirty-five states and Washington, DC scored six or lower on ten key indicators of public health emergency preparedness, according to the report.
The annual study by the two groups "found that while there has been significant progress toward improving public health preparedness over the past ten years, particularly in core capabilities, there continue to be persistent gaps in the country's ability to respond to health emergencies," TFAH said in a statement.
"Last year's report painted the picture of what could happen to emergency planning and response if there were continued public health funding cuts. This year's report shows that, while there has been significant progress toward improving public health preparedness over the past ten years, particularly in core capabilities, there are persistent gaps in the country's ability to respond to health emergencies," TFAH Executive Director, Dr. Jeffrey Levi, told Homeland Security Today.
|
|
Analysis
| | |
SARMA 6th Annual Conference on Security Analysis & Risk Management
Assessing the terrorism risk to the commercial aviation system remains a constant, daily battle for the Transportation Security Administration (TSA). It's a process that the agency's deputy administrator acknowledges eventually becomes a leap of faith.
"Ninety-nine percent of the people out there are not terrorists," explained TSA Deputy Administrator John Halinski.
"We have to find that one percent ... and that's why we're looking at a different way using risk. And what comes with risk is that leap of faith you have to take at a certain point," said Halinski, who spoke Dec. 11 at the 6th Annual Conference of the Security Analysis and Risk Management Association (SARMA) in Arlingon, Va. "Our goal is 100 percent [security], but we also understand that you can never totally eliminate risk."
The operational shift to a risk-based system at TSA began about a year ago. And so far, Halinski said he thinks TSA is "fairly effective" in its screening efforts. However, he acknowledged, "at times it is very, very difficult to measure how effective TSA is." The agency has approximately 65,000 employees and screens roughly 1.8 million passengers and 5 million bags each day.
Halinski's comments come on the heels of an independent assessment by the Rand Corp. of the TSA's Risk Management Analysis Tool (RMAT), in which Rand experts concluded the software-based threat modeling system should not be relied upon to produce "credible estimates of the terrorism risk to the aviation system."
Developed for the TSA in 2007 by Boeing, RMAT leverages a wide range of knowledge about terrorist capabilities and weapons to simulate terrorist behavior and success in targeting specific vulnerabilities in the commercial aviation system.
Although the RMAT system is capable of supporting several of TSA's intended uses for conducting risk assessments, "its design is not always conducive to these purposes," the Rand study concluded.
"TSA must make high-stakes resource allocation decisions designed to counter threats that are not well known, that are continuously evolving, and that may intelligently adapt to circumvent our security measures. This is a complex problem and one for which there may not be one best answer."
According to Halinski, the TSA has adopted a risk management process that relies on specific intelligence, as well as randomness and unpredictability in the agency's daily security posture.
"In analyzing the threat, we modify our operations on what we believe the risk factors are," said Halinski. TSA has focused on introducing unpredictability into its operations because of the effort terrorists are known to put into studying airport security procedures, he said.
On a daily basis, TSA's resource management decisions are made using a concept called the "playbook," said Halinski. "We have about 120 plays, and the plays are based on specific threat streams." For example, if the agency receives intelligence indicating a possible vehicle-borne improvised explosive (VBIED) at an airport, passengers might encounter vehicle checkpoints as they enter the airport, said Halinski.
"We also use a system called the Randomizer," added Halinski. "It's a software package that on any given day, based on the threat, the system decides what play you're going to do."
TSA relies on the Randomizer system because studies found that security personnel tend to fall back on procedures "that they know and like," said Halinski. "So we use the Randomizer to hit these different plays based on threat. We think that breaks you out of the traditional mold and introduces unpredictability into your process."
The vast majority of the daily plays involve layers of security that most passengers do not see, according to Halinski. Although the most visible aspect of airport security is the security checkpoint, there are at least 20 layers of security built into the system, from intelligence to the hardened cockpit door on the aircraft, he said.
"We're never going to get away from that checkpoint, where [passengers and potential terrorists] are going to see technology and operations," said Halinski. "But it's the piece that they don't see that we are banking on as well."
WATCH JOHN HALINSKI'S KEYNOTE PRESENTATION
 | | SARMA Keynote: John Halinski, TSA |
By: Dan Verton When the news broke of the horrific slaughter of 20 children and six adults in Newtown, Conn., I was immediately reminded of how the Obama administration attempted to recast the homeland security mission in the days leading up to the 2008 presidential election. "Homeland Security starts with hometown security," said Barack Obama, candidate for president. It is a definition that the Department of Homeland Security uses to this day. But somehow it rings hollow after Newtown. What good is hometown security if it doesn't include protecting our children - the most vulnerable in our society - when they are at school? Since the founding of DHS, the government has spent hundreds of billions of dollars on things like information sharing; mitigating the impact of hurricanes, wildfires and even influenza pandemics; securing our nation's electric grid against computer hackers; as well as some highly questionable initiatives like remote-controlled helicopters for traffic accident surveillance and the infamous "Zombie Apocalypse" terrorism demonstration at a resort in San Diego. Meanwhile, our schools have been left to grapple with completely deficient active shooter guidance. They are taught what to expect during such a situation and how law enforcement in their community will respond - all of which is necessary information. But at the end of the day, they are left with a policy known as "lock-down," during which teachers lock the doors to their classrooms and children are huddled in a corner or, at best, in a closet. Lock-down is a policy designed to make parents feel better about the obvious lack of security at our nation's schools, and to make it easier for law enforcement to find the perpetrator. But there are few, if any, security benefits to lock-down procedures for our children during an active shooter scenario. An assailant with high-powered weapons can shoot their way into the school and through classroom doors and closets. They know where our children are hiding. They will find them. A radical re-thinking of lock-down policies and how the nation goes about addressing the lack of security at elementary and secondary schools is needed immediately. The nation needs is a concerted effort, led by the DHS, to devise a layered approach to school security. Today, our airports are more secure than our elementary schools. We post armed police outside our airports to watch for suspicious vehicles. But most schools go without a trained, on-site security guard. We require a ticket and a government-issued ID before we allow passengers to approach an airport security checkpoint. But our schools allow visitors in through locked doors without appointments or prior notification. We evacuate airports whenever a threat is detected. But we tell our teachers and children to hide behind curtains and wooden closet doors when a shooter is on the loose. We install automated security devices on doors at airports. Yet there are no such automated systems at our schools that would alert teachers to approaching trouble or slow down an attacker's advance through the building. These are easy things to do if a nation has the will. They will cost money, yes. But money is one thing our national security community has plenty of. It is time to put some of that money toward protecting our kids and their teachers. As a parent of a first grader, I will not be told we cannot afford to protect our children. They are our future and, therefore, a critical infrastructure. The price tag to do what is necessary to protect them is not too high. It is only when we stick our heads in the sand that the true, unbearable cost rears its ugly head. ABOUT THE AUTHOR 
Dan Verton is the Editor of The Risk Communicator and currently serves as Homeland Security Today's Director of Editorial Operations. He is a former intelligence officer in the United States Marine Corps. |
|
Key Reports
| | |
The Transportation Security Administration (TSA) has inconsistently overseen and enforced its rail security incident reporting requirement because it does not have guidance and its oversight mechanisms are limited, leading to considerable variation in the types and number of incidents reported.
Though some variation is expected in the number and type of incidents reported because of differences in rail agency size, location, and ridership, local TSA inspection officials have provided rail agencies with inconsistent interpretations of the reporting requirement.
For example, local TSA officials instructed one rail agency to report all incidents related to individuals struck by trains. However, local TSA officials responsible for another rail agency said these incidents would not need to be reported as they are most often suicides with no nexus to terrorism.
Providing guidance to local TSA inspection officials and rail agencies on the types of incidents that are to be reported could improve consistency across different TSA field offices. GAO also found inconsistency in TSA compliance inspections and enforcement actions because TSA has not utilized limited headquarters-level mechanisms as intended for ensuring consistency in these activities. TSA's rail security inspection policies do not specify inspection frequency but call for performing a "reasonable number" of inspections.
However, 3 of the 19 rail agencies GAO contacted were not inspected from January 2011 through June 2012, including a large metropolitan rail agency, although local officials said it was unlikely that no incidents had occurred at that agency. Without inspections, TSA's assurance that rail agencies are reporting security incidents, as required, is reduced.
In addition, TSA took enforcement action against an agency for not reporting an incident involving a knife, but did not take action against another agency for not reporting similar incidents, though the agency had been inspected. Enhancing headquarters-level mechanisms for overseeing inspection and enforcement actions in the field could help ensure more consistency in these activities and improve TSA's ability to use the information for trend analysis.
Download The Full Report http://www.gao.gov/assets/660/650995.pdf
The Department of Homeland Security (DHS) has taken some relatively recent steps to enhance strategic workforce planning across the department. These steps are generally consistent with leading principles, but the department has not yet implemented an effective oversight approach for monitoring and evaluating components' progress. Specifically, recent steps DHS has taken to develop and implement strategic workforce planning efforts are consistent with the leading principles GAO has reported that include involving management and stakeholders, identifying skills and competencies, developing strategies to fill gaps, and building capability through training. For example, the department demonstrated stakeholder involvement by including component-level stakeholders in the development of the DHS Workforce Strategy. Though DHS has taken steps to implement strategic workforce planning, recent internal audits, as well as GAO's previous work, identified challenges related to workforce planning at the component level that could impair the continued implementation of recently initiated strategic workforce planning efforts. For example, GAO reported in July 2009 that the Federal Protective Service's (FPS) workforce planning was limited because FPS headquarters did not collect data on its workforce's knowledge, skills, and abilities and subsequently could not determine optimal staffing levels or determine how to modify its workforce planning strategies accordingly, amongst others. GAO recommended that FPS take steps to address these issues. FPS officials agreed with our recommendations, and in June 2010 drafted a staffing plan consistent with our recommendation, but as of November 2012, FPS has not gained approval of its staffing plan. Download The Full Report http://www.gao.gov/assets/660/650479.pdf
|
|
Jobs
| | |
International Security Manager, Erickson Air Crane.
Job Description:
Note: Must be able to travel up to 75% on a global basis, and live within easy access to a major, international airport.
As a global corporation, Erickson Air-Crane is the manufacturer and world's largest operator of the S-64 Aircrane Helicopter. With comprehensive manufacturing, maintenance and repair services in Central Point, Oregon, as well as services throughout Canada, Europe and Malaysia, we have flown nearly 250,000 hours since 1971, harvesting timber in 5 countries, battling fires in 11 countries and placing over 40,000 air units on skyscrapers across the US.
The International Security Manager will provide leadership in the area of security for all of Erickson Air-Crane international operations globally, and is responsible for advising and managing all aspects of international security for assigned company projects, acting as the focal point for day to day security matters, providing thoughtful leadership in delivering a holistic, best-in-class International Security program aimed at mitigating risk, ensuring continuity of operations and safeguarding the company's personnel, assets, reputation and brand.
View Job Posting
IT Security Risk Analyst - Catholic Health Initiatives Job Description: Lead Information Security reviews to identify gaps with CHI Information Security requirements.
Lead IT risk assessments to identify key corporate security vulnerabilities that affect the confidentiality, integrity and availability of electronic protected health information and other company confidential data and provides support to systems owners to address and implement solutions to identified security and risk issues.
Provide Information Security guidance at all stages of the System Development and Acquisition Life Cycle. Participate in the development of the Information Security Awareness Program. View Job Posting
More Career Postings Available at SARMA Careers Online
|
|
|
|
|
