20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 1
20. Pa th In te r rupt ion Ana lys i s
October 24 – November 11, 2016Albuquerque, New Mexico, USA
Mark Snell
Path Interruption Analysis
S tudent Learning Object ives
After completing this module, you should be able to:
• Define an adversary path• Identify an adversary timeline and response timeline• Construct an adversary timeline and a response timeline• For an adversary timeline and response timeline
• Determine the Critical Detection Point (CDP) • Calculate Probability of Interruption, PI
2
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 2
Path Interruption Analysis
INFCIRC 225 Revis ion 5 References
• 3.13 The state should ensure that evaluations include exercises to test the physical protection system, including the training and readiness of guards and/or response forces.
• 3.29 The operator should develop and implement means and procedures for evaluations, including performance testing, and maintenance of the physical protection system.
• 4.35 Evaluations should be conducted regularly to determine reliability and effectiveness against the threat.
• 5.16 If the evaluation of the design of physical protection system indicates that it is ineffective, then the operator should redesign the physical protection system and re-evaluate its effectiveness.
3
Path Interruption Analysis
Adversary Path Def in i t ion
Adversary Path: A time-ordered sequence of path elements, areas, and a target task that the adversary must traverse to complete an attack from Offsite to the chosen target
Adversary paths are defined using an Adversary Sequence Diagram
4Target in Floor Vault
Secure Room Wall
Secure Room
Offsite
Door 2
Reactor Area
Building Door
Reactor Building
Personnel Portal
Research Complex
Facility Fence
Site Campus
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 3
Path Interruption Analysis
Purpose of Path Interrupt ion Analys is
Path Interruption Analysis: Determines whether detection and delay are sufficient along all adversary paths to provide an adequate level of Probability of Interruption, PI,• This is effectively a timeline analysis comparing adversary and
response timelines for each path to determine PI
5
Path Interruption Analysis
Adversary Timel ine and Response Timel ine• Adversary timeline is based upon adversary tasks• Response timeline is based on Detection and Response Times
6
Detection Time
Adversary Completes Task
Time
AdversaryBegins Task
Adversary Timeline
Ad
vers
ary
Det
ecte
d
Response Time
Ad
vers
ary
Inte
rru
pte
d
PPS Response Time*
Sensing Opportunities
*Response Force Time
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 4
Path Interruption Analysis
Example Set o f Adversary T ime l ine In format ion
7
Time Estimate
Task
Minimum Time
(seconds) Task
1 2
12 12
Penetrate fence Transit time
Cumulative Time
(seconds)1224
180
3 48 Penetrate Outer door 72 4 5 6 7 8
24 12
6 12 54
Transit timePenetrate Inner doorTransit time to container Open container and gather material Escape Total (approx. 3 minutes)
96 108 114 126 180
AreaAccess Building
Access
RoomAccess
ContainerAccess Sensitive
Material
TotalTime3 Minutes
Task1
Task2
Task6
Task 8
Task4
Task3
Task7
Task5
Path Interruption Analysis
Example Set o f Adversary T ime l ine In format ion: Assoc ia ted Adversary T ime l ine
8
Time Estimate
Task
Minimum Time
(seconds) Task
1 2
12 12
Penetrate fence Transit time
Cumulative Time
(seconds)1224
180
3 48 Penetrate Outer door 72 4 5 6 7 8
24 12
6 12 54
Transit timePenetrate Inner doorTransit time to container Open container and gather material Escape Total (approx. 3 minutes)
96 108 114 126 180
Task delay times
Sensing opportunities between tasks
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 5
Path Interruption Analysis
Example Set o f Response T ime l ine In format ion
• The PPS Response Time is the sum of the times for all response actions performed by the response
9
Response Action Patrol Team 1
Alarm communication time 1 1
Alarm assessment time 29 29
Response force communication time 10 10
Response force preparation time 0 20
Response force travel time (vehicle) 30 15
On‐site deployment time 10 15
PPS Response TIme (Total) 80 90
Average Response Times
(in seconds)
Path Interruption Analysis
The PPS Response T ime i s the Sum of a Detect ion T ime and a Response T ime
10
Example: PPS Response Time = 90 sec
Detection Time = 30 sec
Response Time = 60 sec
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 6
Path Interruption Analysis
Adversary T ime l ines and Response T ime l ines Can Then Be Combined onto the Same D iagram
Response Timeline Information
11
Adversary Timeline Information
Path Interruption Analysis
M in imum Probab i l i t i es o f Detec t ion , PD, Are A lso Needed for Each Task
AreaAccess Building
Access Room
Access
ContainerAccess Sensitive
Material
TotalTime
3 Minutes
Task1
Task2
Task6
Task 8
Task4
Task3
Task7
Task5
PD = .8
PD = .6
PD = .5
Minimum Probabilities of Detection depend upon performance tests for specific adversary defeat methods
PD = .6
12
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 7
Path Interruption Analysis
Ca l cu la t ing Probab i l i ty o f In ter rupt ion for an Adversary T ime l ine and Response T ime l ine
• Review of Terminology Timely detection Critical Detection Point (CDP)
• Formulas for calculating Probability of Interruption based on timelines
13
Path Interruption Analysis
Terminology
Timely Detection: A sensing opportunity on a path is timely ifPPS Response Time Is Less than the Adversary Task Time Remaining
After First Sensing
Critical Detection Point (CDP): Last sensing opportunity on a path at which detection can occur in time for response force to interrupt the adversary
Relationship to Timely Detection: The CDP is the last sensing opportunity that provides timely detection
14
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 8
Path Interruption Analysis
Us ing Adversary and PPS T ime l ines to F ind the Cr i t i ca l Detec t ion Po in t
15
AdversaryBegins Task
Adversary Completes Task
Time
Adversary Task Time
CT
PPS Response Time
Adversary Task Time Remaining After First Sensing
PPS Response Time
PPS Response Time
Adversary Task Time Remaining After First Sensing
Adversary Task Time Remaining After First Sensing
CDP
Sensing opportunities thatprovide timely detection
Path Interruption Analysis
P robab i l i ty o f In ter rupt ion , P I, Depends Upon Where the CDP i s on the Path
Probability of Interruption (PI) : The cumulative probability of detection up to and including the CDP
PI = 1 – (1-PD1)*(1-PD2)*…(1-PDCDP) where
• PDj is the Probability of Detection at the jth opportunity• PCDP is the Probability of Detection at the CDP
16
ExampleAdversary Task TimePD1=.8 PD2=.6 PD3=.6
Assume the 3rd sensing opportunity is the CDP
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) = 1-(1-.8)(1-.6)(1-.6) = .97
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 9
Start Path
Complete Path
Adversary Chooses Defeat Methods That
Minimize Delay
Adversary Uses Defeat Methods That Minimize Detection Probability
PPS Response Time
Time Remaining Along Path
Critical Detection
Point
Probability of Interruption, PI
Path Interruption Analysis
P robab i l i ty o f In ter rupt ion , Mode l Assumes Min imum De lays Af ter the CDP and Min imum PD’s up to/ Inc lud ing the CDP
17
Adversary Task Time
Path Interruption Analysis
To Determine Probab i l i ty o f In ter rupt ion , P I fo r a Path
• Create an Adversary Timeline Using Minimum Delay Times and Probabilities of Detection
• Determine the CDPStep 1: Sum delays from the end of the timelineStep 2: Stop when sum exceeds the PPS Response TimeStep 3: Assign CDP to last timely element/area
• Calculate PI as the cumulative probability of detection to the CDP
18
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 10
Path Interruption Analysis
T ime ly Detec t ion Example: Adversary and Response T ime l ines
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec
TaskDelay
Time (Seconds)Detection
Probability, PD
0.8
0.6
0.6
0.2
0.5
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
The Task Delay Times and PD’s Are Shown Vertically:
PPS Response Time = 90 sec 19
Path Interruption Analysis
T ime ly Detec t ion Example—Base l ine Vers ion
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec84
72
66
PPS Response Time = 90 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.6
0.2
0.5
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining
After First Sensing
108
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of InterruptionPI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) = 1-(1-.8)(1-.6)(1-.6) = .97
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
PD’s are timely
20
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 11
Path Interruption Analysis
Upgrad ing Ru les for Increas ing P I a long a Path
• Increase timely detection before/at the CDP Add detection before/at the CDP
• Move the CDP closer to the end of the path, making more sensing opportunities timely Increase delays after the CDP Decrease PPS Response Time
21
Path Interruption Analysis
T ime ly Detec t ion Upgrade Example—To Inc rease P I, Inc rease PD befo re o r a t the CDP
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec84
72
66
PPS Response Time = 90 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.9
0.2
0.5
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining After First
Sensing
108
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of Interruption
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) = 1-(1-.8)(1-.6)(1-.9) = .992
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
PD’s are timely
22
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 12
Path Interruption Analysis
T ime ly Detec t ion Upgrade Add ing PD a f te r the CDP Does Not Inc rease P I
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec84
72
66
PPS Response Time = 90 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.6
0.2
0.9
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining After First
Sensing
108
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of Interruption
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) = 1-(1-.8)(1-.6)(1-.6) = .97
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
PD’s are timely
23
Path Interruption Analysis
T ime ly Detec t ion Upgrade Example—To Try To Increase P I, Add De lay a f te r the CDP
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec
88 PPS ResponseTime = 90 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.6
0.2
0.5
Transit time
Gather material
Escape
6 sec
34 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining After First
Sensing
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of Interruption
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) *(1-PD4)*(1-PD5) = 1-(1-.8)(1-.6)(1-.6)(1-.2)(1-.5) = .987
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
92
PD’s are timely
24
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 13
Path Interruption Analysis
T ime ly Detec t ion Upgrade Example—Add ing De lay be fo re o r a t the CDP Does Not Change P I
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
96 sec
24 sec
12 sec
PPS Response Time = 90 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.6
0.2
0.5
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining After First
Sensing
84
72
66
108
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of Interruption
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) = 1-(1-.8)(1-.6)(1-.6) = .97
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
PD’s are timely
25
Path Interruption Analysis
T ime ly Detec t ion Upgrade Example—To Try To Increase P I, Decrease the PPS Response T ime
Penetrate Fence
Transit time
Penetrate Outer Door
Transit time
Penetrate Inner Door
12 sec
12 sec
48 sec
24 sec
12 sec
66 PPS ResponseTime = 70 sec
TaskDelayTime
Detection Probability,
PD
0.8
0.6
0.6
0.2
0.5
Transit time
Gather material
Escape
6 sec
12 sec
54 sec
0.1
0.9
1.0
Adversary Task Time Remaining After First
Sensing
0
54
(CDP)
• Step 1: Determine the CDP based on Adversary Task Time Remaining:
• Step 2: Calculate Probability of Interruption
PI = 1 – (1-PD1)*(1-PD2 )*(1-PD3) *(1-PD4)*(1-PD5) = 1-(1-.8)(1-.6)(1-.6)(1-.2)(1-.5) = .987
At CDP, Adversary Task Time Remaining Is Greater than the PPS Response Time
72
PD’s are timely
26
20 – Path Interruption Analysis
The Twenty-Sixth International Training Course
Page 14
Path Interruption Analysis
Summary: Path Interrupt ion Analys is
With respect to our Learning Objectives:• An adversary path is defined as:
• “A time-ordered sequence of path elements, areas, and a target task that the adversary must traverse to complete an attack”
• Adversary and response timelines show Times and sensing opportunities based upon
adversary tasks
27
PPS Response Time based on Detection and Response Times• Adversary timelines are constructed based on task delays and
detection probabilities for the adversary path• Response timelines are constructed based on time estimates for
all response actions
Path Interruption Analysis
Summary: Path Interrupt ion Analys is
With respect to our Learning Objectives:• To determine the CDP based on adversary and response
timelines:First: Sum delays from the end of the adversary timelineNext: Stop when sum exceeds the PPS Response TimeLast: Assign CDP to last timely element/area
• Calculate PI as the cumulative probability of detection up to and including the CDP:PI = 1 – (1-PD1)*(1-PD2)*…(1-PDCDP) where
• PDj is the Probability of Detection at the jth opportunity• PCDP is the Probability of Detection at the CDP
28