AIP 2 Update

1
AIP 2 Update

• Performance of Threat/Vulnerability/Risk
  Assessments leading to the determination of
  Mitigation and Security-Related Business Rules

Colonel Edward Addison USTRANSCOM Force
Protection edward.addison_at_hq.transcom.mil
January 25, 2005
2
Tasks

• 2.A. Perform threat, vulnerability, and risk
  assessments of the AAE distribution system to
  manage AAE risks with current information.
• Foundational to understanding the Current
  Operating Environment (COE) and discussions on
  mitigation, security initiatives, technologies,
  etc.
• 2.B. Based on the results of the most current
  threat, vulnerability and risk analysis, ensure
  DoD AAE security-related business rules are
  scalable and are applied appropriately and
  consistently with current distribution system
  risks.

3
Key Participants

• OSD Policy / execution guidance
• Services Intelligence, V/RA, mitigation support
• TRANSCOM Intelligence, V/RA, mitigation support
• Commercial Partners Source reporting,
  mitigation support
• DoT Intelligence, mitigation support
• TSA Intelligence, mitigation support
• NORTHCOM Intelligence, V/RA, mitigation support
• DIA Intelligence support
• CIFA Intelligence support
• FBI Intelligence support
• DTRA performance of VA
• DoD CIP performance of VA
• NCIS intelligence support
• Army CID intelligence support
• AFOSI intelligence support

4
Proposed Course of Action

• Identify PM for coordination and oversight of AIP
  2 execution
• Identify funding source
• Perform Threat Assessment
• Identify process / spectrum to be assessed (both
  in-transit and nodal)
• Use DIA transportation assessment as baseline /
  starting point.
• Collaboration by key participants in relative
  data collection, analysis and development of
  overall threat assessment
• Determination / prioritization of CONUS/OCONUS
  threats
• Continuous process v. minimum requirement every
  three years

5
Proposed Course of Action, cont.

• Coordination / Performance of Vulnerability /
  Risk Assessments
• Utilize threat assessment for focus of efforts,
  and determination of VA necessity / applicability
• Identify single points of failure, critical
  nodes, at-risk locations, activities
• Collaboration by key participants in performance
  of full-spectrum V/RA
• Determination of Mitigation and Security-Related
  Business Rules
• Leverage existing technologies / best security
  practices to respond, prevent and protect
  (mission assurance)
• Pursue / design / integrate future technologies /
  initiatives as required through collaborative
  relationships with key participants
• Clarification, verification and enforcement of
  regulatory policies and requirements in concert
  with commercial partners

6
Discussion