The document summarizes the work of the Office of Infrastructure Protection within the Department of Homeland Security to protect critical infrastructure sectors. It outlines the National Infrastructure Protection Plan's risk management framework and partnership approach. It also describes resources provided to critical infrastructure owners like protective security advisors, protected critical infrastructure information, and the enhanced critical infrastructure protection initiative. The overall goal is to use a risk-based methodology to deter, detect, delay and facilitate response to threats through approaches like defense in depth across the 16 identified critical infrastructure sectors.

1. The Office of Infrastructure Protection
National Protection and Programs Directorate
Department of Homeland Security
Office of Infrastructure Protection and Risk Management Overviews
Re-Energize the Americas 2012 Conference
October 17, 2012

2. Threats May Come from All Hazards
2

3. Critical Infrastructure Sectors
 Banking and Finance  Healthcare and Public Health
 Chemical  Information Technology
 Commercial Facilities  National Monuments and Icons
 Communications  Nuclear Reactors, Materials, and Waste
 Critical Manufacturing  Postal and Shipping
 Dams  Transportation Systems
 Defense Industrial Base  Water
 Emergency Services
 Energy
 Food and Agriculture
 Government Facilities
3

4. National Infrastructure Protection Plan
 Comprehensive plan and unifying structure
for the public and private sector to enhance
the protection and resilience of critical
infrastructure
– Partnership model
– Risk management framework
– Roles, responsibilities, and authorities
 Drives internal programs and activities, and
guides those of:
– Other Federal agencies and departments
– State, local, tribal, and territorial governments
– Critical infrastructure owners and operators
4

5. Understanding Risk
 RISK = (Threat X Vulnerability X Consequence)
R = (PA * [1-(PE )] * C)
5

6. Risk Mitigation
 Within the context of critical infrastructure, there are a variety of strategies
and approaches that can be taken to mitigate risk
– Risk assumption
– Risk avoidance
– Risk limitation
– Risk transference
– Site hardening
6

7. Methodology
 Effective risk management depends on a methodology that identifies what
is important:
7

8. Purpose of Protection
 Deter
 Detect and annunciate
 Delay
 Facilitate to rapid assessment
 Facilitate to rapid response
8

9. Defense in Depth
Land Area
Facility
Perimeter Fencing,
Interior Room
Exterior
Gates, & Lights
9

10. Mitigation Priorities
 Low cost
 Large increase in probability of preventing an aggressor attempt
 Large increase in probability of preventing an aggressor success
 Most attractive assets
 Large consequences
 High benefit-cost ratios
10

11. Security Solution Hierarchy
COST
People
Electro-
mechanical
Plans, Policies, Pro
cedures
< Benefits >
11

12. Must Look at Resilience
 Protection, in isolation, is a brittle strategy
 Resilience is the ability of
systems, infrastructure, government, business, and citizenry to
resist, absorb, and recover from or adapt to an adverse occurrence that
may cause harm, destruction, or loss of national significance
 Objectives of resilience:
– Resistance
– Absorption
– Restoration
12

13. Products and Resources
 Protective Security Advisors (PSAs)
 Protected Critical Infrastructure Information (PCII)
 Enhanced Critical Infrastructure Protection (ECIP) initiative
 Federal Bureau of Investigation (FBI) InfraGard
 Homeland Security Information Network (HSIN)
 Bomb-making Materials Awareness Program
 TRIPwire and TRIPwire Community Gateway
 Risk Mitigation Training
13

14. Protective Security Advisors
 93 PSAs and Regional Directors, including 87 field deployed
personnel, serve as critical infrastructure security specialists
 Deployed to 74 Districts in 50 states and Puerto Rico
 State, local, tribal, territorial, and private sector link to DHS infrastructure
protection resources
– Coordinate vulnerability assessments, training, and other DHS products and
services
– Provide a vital link for information sharing in steady-state and incident response
– Assist facility owners and operators with obtaining security clearances
 During contingency events, PSAs support the response, recovery, and
reconstitution efforts of the States by serving as pre-designated
Infrastructure Liaisons (IL) and Deputy ILs at the Joint Field Offices
14

15. Value of the PSA Program
 PSAs:
– Support comprehensive risk analyses for critical infrastructure
– Assist in the review and analysis of physical/technical security for critical
infrastructure
– Convey local concerns and sensitivities to DHS and other Federal agencies
– Relay disconnects between local, regional, and National protection activities
– Communicate requests for Federal training and exercises
15

16. Protected Critical Infrastructure Information
 Established under the Critical
Infrastructure Information Act of 2002
 Protects voluntarily submitted critical
infrastructure information from:
– Freedom of Information Act
– State and local sunshine laws
– Civil litigation proceedings
– Regulatory usage
 Provides private sector with legal
protections and “peace of mind”
16

17. ECIP Initiative
 Establishes/enhances DHS relationship with facility owners and
operators, and informs owners and operators of the importance of their
facilities and the need to be vigilant
 ECIP survey
– Identifies facilities’ physical security, security forces, security
management, protective measures, information sharing, and dependencies
– Tracks implementation of new protective measures
 ECIP Dashboard
– Creates facility protective measures index that can be used to compare against
similar facilities
– Tool for informing protective measures planning and resource allocation
 Information is protected under the PCII program
 Information used by DHS for steady-state analysis and incident
management
17

18. How Can You Help?
 Engage with PSAs and other partners on critical infrastructure protection
programs and initiatives
 Encourage participation in efforts to identify, assess, and secure critical
infrastructure in your community
 Communicate local critical infrastructure protection related concerns
 Enhanced protection and resilience depends on developing and
strengthening partnerships between all entities with a role in critical
infrastructure protection
28

19. Assessment References
 The Design & Evaluation of Physical Protection Systems – Mary Lynn
Garcia
 Risk Analysis and the Security Survey – James Broder
 PSP Study Guide – David Patterson
29

20. Summary
 Success will depend in part on the strength of our partnership
 Our approach to addressing the terrorism threat will be a long
term, ongoing project of the highest priority
 This effort will require the highest degree of vigilance and dedication from
all of us
30

21. For more information visit:
www.dhs.gov/criticalinfrastructure
CF “Buck” Hamilton
Protective Security Advisor – El Paso, TX
cf.hamilton@dhs.gov