UrRISK04

SRA 311.001

Fall 2014

Table/Row # 1

Student1 [bah5423]

Student2 [nxw5047]

2

Table of Contents Introduction .................................................................................................................................................. 3

A) Purpose ............................................................................................................................................. 4

B) Scope of the Risk Assessment ........................................................................................................... 5

II. Risk Assessment Approach ....................................................................................................................... 6

III. System Characterization .......................................................................................................................... 9

IV. Threat Statement ................................................................................................................................... 10

V. Risk Assessment Results ......................................................................................................................... 11

A. Threat/Vulnerability Pairs ................................................................................................................ 12

B. Existing Risk Controls ....................................................................................................................... 13

C. Likelihood: Discussion and Evaluation ............................................................................................ 14

D. Impact: Discussion and Evaluation ................................................................................................. 15

E. Risk Rating ....................................................................................................................................... 16

F. Recommended Controls .................................................................................................................. 17

VI. Summary ................................................................................................................................................ 19

Reference List .............................................................................................................................................. 20

Attachment 1: Information Sheet .............................................................................................................. 22

Attachment 2: Structured Analytic Results ................................................................................................ 24

Attachment 3: Threat Analysis ................................................................................................................... 26

Attachment 4: Vulnerability Analysis .......................................................................................................... 27

Attachment 5: Risk Scenario Likelihood ..................................................................................................... 28

Attachment 6: Risk Scenario Impact ........................................................................................................... 29

Attachment 7: Risk Matrix .......................................................................................................................... 30

Attachment 8: Risk Rating .......................................................................................................................... 31

Attachment 9: Summary Table ................................................................................................................... 32

3

Introduction This document is a risk assessment on the Lewistown, Pennsylvania Amtrak Station. The structure of the risk assessment is based on the NIST 800-30 document. This introduction outlines the purpose and scope of the risk assessment. Included next is an explanation of the three-part risk assessment approach including a literature review, structured analytics, and a virtual site visit. Following this, the system characterization is specified as an input-process-output (IPO) model. Next, the threat statement specifies which threat categories are being considered in the risk assessment and further defines these categories. Proceeding, the risk assessment results include threat/vulnerability pairs, existing controls, likelihood, impact, risk rating, and recommended controls. Lastly a high level summary is provided for the risk assessment results. There are several supporting attachments as noted within the associated sections of the document (Stoneburner, Goguen, & Feringa, 2002).

4

A) Purpose The location of this risk assessment is the Lewistown, Pennsylvania Amtrak train station. This station only has trains on the “Pennsylvanian” route which, runs between the cities of Pittsburgh and New York. Furthermore, this station lacks several amenities offered by larger stations in metropolitan areas such as a ticket office, kiosks, ATMs, elevators, lounges, storage, parking services, handicap assistance, and passenger assistance.

A risk assessment is particularly important because a wide range of more than nine frequently occurring factors, such as workload/mode transitions, expectations/situation awareness, and equipment, contribute to preventable passenger train accidents. Furthermore, many single accidents have several types of causal factors making the issue more complex and in need of analysis (cross-reference Table 2: Causal Factors in Train Accidents in Attachment 1: Information Sheet)

The point of view of this risk assessment is that of a train passenger. A train passenger is concerned with two components of travel: safety and function. Safety is the assurance that the passenger reaches his or her destination without injury or harm. The function is the train’s ability to get the passenger from the source to the destination.

5

B) Scope of the Risk Assessment The scope of this risk assessment is limited to the operational hazards of the train, as it approaches and departs from the Lewistown station. There are several subsets of operational hazards.

The first subset of operational hazards is severe weather, which includes the potential for tornadoes and strong hurricane winds which have a strong impact on the structural integrity of railroad tracks and trains. “Criteria for the safety risk from strong cross-winds may consider overturning of the vehicle, the risk of a lateral track shift and the risk of a flange climbing derailment” (Andersson, Häggström, Sima, & Stichel, 2004).

Another subset is the safety-critical control system that is in charge of controlling track placement, acceleration, and braking. “The new train control systems employ newer technologies and control architectures, such as positive train control (PTC) systems, train protection warning systems, train collision avoidance systems, etc.” (Mokkapati, Tse, & Rao, 2009). While this reduces the amount of human errors the train is susceptible to, it introduces more avenues for potential threats and risks. “It is easy to refer to automation as if it were a well-defined and homogenous category of technology. Clearly, however, this is not the case in reality” (Wreathall, Woods, Bing, & Christoffersen, 2007).

The last subset is the human control of railroad operations, where the potential of outside influence can be detrimental to set policies and standards. “Humans can play a very important role in ensuring safety with the current train control systems” (Weathall, Roth, Bley, & Multer, 2003). Workers have access to a multitude of the train’s critical control systems and that creates an inherent danger to people’s lives and properties.

Please reference Figure 1 below as a general diagram of the different areas of risk in a firm. Each section is broken down into the specific risks that can be classified by that subgroup.

Please note that the scope of this risk assessment only includes operational risk. The product market, financial, legal, regulatory, tax, and input risks will be beyond the scope of this risk assessment.

Figure 1: General scope of enterprise risk sources (http://bit.ly/1icMuln)

6

II. Risk Assessment Approach This risk assessment is being conducted by Student1 and Student2. Student1 is completing a degree this year in Security and Risk Analysis (SRA) at The Pennsylvania State University. has prior internship experience at KPMG, where he worked on a team to complete a technical security assessment (vulnerability assessment and penetration test), as an installment to a risk assessment. Student1 has extensive experience in technical security, research, and writing. Student2 is also a senior at The Pennsylvania State University majoring in SRA with specialization in information and cyber security. Student2 has conducted several in-depth reports on system characterization and risk analysis that follow the NIST guidelines in his SRA courses.

This risk assessment uses a three-part approach to hazard identification including a literature review, structured analytics, and a virtual site visit. The literature review contains a summary of the relevant information provided from each professional source. The detailed literature can be found in Attachment 1: Information Sheet.

The structured analytic technique used in this risk assessment is structured brainstorming. The first step in structured brainstorming is divergence, which consists of freeform idea generation without any criticism or constraints. The goal of this step is to generate as many ideas as possible. The second step is convergence, in which ideas are placed into groups and ranked. The result of this exercise is prioritized idea groups that can be seen in Attachment 2: Structured Analytics (Glantz, 2014).

The virtual site visit part of the approach includes the analysis of site photos. By examining these photos, risk that was previously unforeseen can be realized. For example, the gravel ground surface and limited lighting which can be observed in Figure 2 and Figure 3 below could pose a risk of passengers falling when exiting a train, which was not foreseen by the structured analytic technique described above.

7

Figure 2 Lewistown, PA, Amtrak Station | 1 / 2 (Sturmovik, 2009)

Figure 3 Lewistown, PA PRR/Amtrak station (Whipp, 2014)

8

A risk matrix will be used to evaluate risk impacts and likelihoods. Each axis includes a numeric scale so that comprehensive scores can be calculated by using products. For example, if the impact is scored as a three and the probability is scored as a five, the overall severity score is fifteen. Each cell is ranked by a very low, low, medium, high, or critical risk severity category. The categories are based on the following ranges of risk severity scores: very low 1-5, low 6-10, medium 11-15, high 16-20, and critical 21-25. In addition to their calculated score, these categories are also designated by green, yellow, orange, red, and purple respectively. Please reference Figure 4: Risk Matrix, below.

Impact

Prob

abili

ty

1 2 3 4 5

1 1 2 3 4 5

2 2 4 6 8 10

3 3 6 9 12 15

4 4 8 12 16 20

5 5 10 15 20 25

Figure 4 Risk Matrix

9

III. System Characterization The flow of passengers entering and exiting the train safely can be visualized as a system. This system can be modeled as an input-process-output (IPO) model. An IPO model helps to focus threat, vulnerability, and asset identification.

This risk assessment is from the viewpoint of a passenger. As such, the set of IPOs in this model directly relate to the passengers themselves. The input would be the passengers who board a train at the station. The process is the safe transportation of passengers as they arrive at or depart from the Lewistown station. The output is the passengers who exit their train at the station.

Figure 5: Basic Input, Process, Output Model, below is a visualization of an IPO model that shows how a system can be broken down into three distinct categories for risk assessment.

Figure 5 Basic Input, Process, Output Model (Nickols, 2004, p. 2)

10

IV. Threat Statement A threat-source is any circumstance or event with the potential to harm a system. There are three threats sources being considered in this assessment: human, natural, and environmental. Natural threats include acts of nature such as floods, earthquakes, tornadoes, landslides, avalanches, and electrical storms. Human threats are either enabled by or caused by human beings, whether unintentional or deliberate. Environmental threats are specific to the system being examined. While it is important to consider all potential threat-sources, human threats and natural threats are the main sources of threats covered in this report. Environmental threats are not extensively considered because the number of potential mechanical engineering failures in a train system is immense. Amtrak should more fully consider potential mechanical errors when purchasing new trains or tracks. Attachment 3 provides a table showing the source, motivation, and actions for each threat (Stoneburner, et al., 2002 p.13).

11

V. Risk Assessment Results The following risk scenarios were developed based on researched threats and vulnerabilities for the Lewistown, Pennsylvania Amtrak Station.

1. Severe weather causes damage to station and track 2. Spread of harmful pathogens among passengers 3. Hijacking of train or robbery occurring on or near the train 4. Unsafe staff operation of trains 5. Unsafe passenger environment

12

A. Threat/Vulnerability Pairs A threat is defined as the potential for exercise, either accidentally or intentionally, of a specific vulnerability. A vulnerability is defined as a flaw or weakness in a system’s security procedures, design, implementation, or internal controls that could be exercised, either accidentally or intentionally, and result in a security breach or a violation of the system’s security policy (Stoneburner, et al., 2002).

Risk Scenario #1’s vulnerability is the limited durability of Amtrak track and station infrastructure against severe weather and natural disasters. Risk Scenario #2’s vulnerability is that passengers do not follow proper hygiene precautions and procedures. Risk Scenario #3’s vulnerability is the limited Amtrak prevention measures against hijacking and robbery. Risk Scenario #4’s vulnerability is the unsafe procedures and human error of staff members. Scenario #5’s vulnerability is the lack of physical security at Amtrak stations and tracks.

Attachment 4 contains a detailed vulnerability analysis which summarizes vulnerabilities and their associated sources, and actions from the protector’s point-of-view (POV).

13

B. Existing Risk Controls To protect against a number of natural and human threats, the U.S. Department of Transportation has implemented a safety-critical train control system. Figure 6 shows a simple Train Protection Warning System (TPWS) that monitors speed relative to other traffic.

Figure 6: Simple Train Protection Warning System (Mokkapati, Tse, & Rao, 2009, p. 91)

The TPWS’s main function is to supervise train controls in order to relay alerts and warnings back to the train’s operator. This system is used on active train lines to prevent signals passed at danger (SPADs). The system sends out alerts that trains receive when they pass stop signals without the required authorization, or rather commit a SPAD. This system links the train and base stations together to provide each with important information such as current speed, distance to closest trains, rotational speeds, etc. However, this system is not the only control measure and is used in cooperation with the train’s conductor (Mokkapati, et al., 2009).

14

C. Likelihood: Discussion and Evaluation Likelihood is the first important factor which must be considered in order to quantify risk. Likelihood refers to the probability of each vulnerability being exploited. In this risk assessment, the likelihood of each risk scenario was rated on a scale from one to five, with five being a very high likelihood, and one being a very low likelihood.

The likelihood of severe weather causing damage to the station or track is rated as a ‘one’ or rather ‘rare’, because it would take an rare natural disaster such as a tornado or earthquake to cause considerable damage. Only routine wear and tear would be suffered as a result of ordinary severe weather such as a thunderstorm.

The likelihood of the spread of harmful pathogens among passengers is rated as a ‘four’ or rather ‘likely’, because it is very easy to spread common illnesses such as the common cold in public places. The spread of illness is even more likely in places where persons are in close proximity with one another and are enclosed, such as a train.

The likelihood of the train being hijacked or a robbery occurring is rated as a ‘two’ or rather ‘unlikely’. This is because trains are not an ideal target for either crime. A robbery is complicated with many potential witnesses and intervention by fellow passengers. The hijacking of a train requires considerable planning and force, with little opportunity to escape. Furthermore, Amtrak Police serves to deter crime at its various stations and on its trains.

The likelihood of unsafe operation of trains by Amtrak staff is rated as a ‘three’ or rather ‘possible’. This is because human error is a vast source of error in all systems, including train transportation. There are numerous situations in which a reckless, negligent, or simply incompetent staff operation of the train could occur.

The likelihood of an unsafe passenger environment is rated as a ‘four’ or rather ‘likely’. This is because there is a rather large gap in at the physical security of stations and tracks in particular. Amtrak stations are only selectively and periodically patrolled by police, and the tracks and trains themselves are typically left unguarded by Amtrak police while trains are in transit.

Attachment 5 contains a table summary of the likelihood associated with each risk scenario.

15

D. Impact: Discussion and Evaluation Impact is the second important factor which must be considered in order to quantify risk. Impact refers to the magnitude of harm that could be caused by a threat’s exercise of vulnerability. In this risk assessment, the impact of each risk scenario was rated on a scale from one to five, with five being a very high impact, and one being a very low impact (Stoneburner, et al., 2002).

The impact rating of severe weather causing damage to the station and track is a ‘two’ or rather a ‘considerable to indefinite travel delay’. This is because damage to a station or track delays train service. Depending on the extent of the damage there could be a moderate or indefinite delay to train travel. This risk scenario was not rated as a ‘three’ because modern weather and news capabilities make it easy for all regions to be aware of natural disasters. These capabilities allow Amtrak to be aware of natural disasters which could cause major track damage and thus injury to passengers.

The impact rating of the spread of harmful pathogens among passengers is a ‘three’ or rather a ‘minor injury’ to passengers. This is because the spread of ordinary infections such as the common cold, flu, and occasionally more deadly viruses such as Ebola can collectively be considered minor. In most cases the common cold is spread and is a minor inconvenience to a passenger who is infected, but occasionally the common cold could be a detrimental illness to a very old or young passenger. A more rare but deadly disease such as Ebola could potentially cause death. Collectively however, the harmful spread of pathogens among passengers is a minor impact.

The impact rating of a hijacking or robbery on the train is a ‘four’ or rather a ‘moderate to severe injury’. This is because the violent nature of a hijacking or robbery is likely to cause severe injury to a passenger. For example, this can occur when a passenger is struck so that a perpetrator can take her purse, or a passenger in a hijacking could be wounded by a gunshot in order to show that perpetrators are serious in their demands.

The impact rating of unsafe staff operation of the train is a ‘five’ or rather ‘multiple serious injuries or deaths’. This is because unsafe operation of the train can lead to derailment, collision with another train, or dangerously abrupt acceleration and deceleration. All of these events can cause death or life threatening injuries.

The impact rating of an unsafe passenger environment is a ‘five’ or rather ‘multiple serious injuries or deaths’. This is because an unsafe passenger environment allows for a number of hazards such as a bomb or chemical agent being planted on a station, train, or track. All of these events can cause death or life threatening injuries to passengers.

Attachment 6 contains a table summary of the impact associated with each risk scenario.

16

E. Risk Rating Attachment 8 shows the final calculated risk rating of each risk scenario that is the combination of risk likelihood and risk impact. The final risk rating is on a scale of 1-25, where 25 is an extremely high likelihood risk scenario that has a very high impact if exploited. A score of 1 is a low likelihood risk scenario that has a low impact. Attachment 7 shows the risk matrix that was used to calculate the final risk scores. The risk rating was calculated by multiplying the likelihood value by the impact value for each risk scenario. Both the likelihood values and the impact values are ranged from 1-5, with 1 being the lowest impact or rare likelihood, and 5 being high impact or almost certain likelihood.

Severe weather that causes damage to the track or station was given an overall risk rating of 2, which is very low. The harmful spread of pathogens among passengers due to close proximity scored a 12, which is still considered low. The risk scenario of a hijacking or robbery occurring scored a risk rating of 8, which is also considered low. Unsafe train operations due to poor staff performance scored a risk rating of 15 which is considered a medium risk level. The final risk scenario of an unsafe environment due to lack of physical security was given an overall risk rating of 20, which is considered high.

17

F. Recommended Controls When creating recommended controls for the risk scenarios, Figure 7: Probability/Impacts Quadrants, was used to determine the appropriate types of controls. Depending on the probability/impact of the risk scenario, different modes of controls can be utilized. For low-probability/low-impact risks, the risks are accepted as controls would not be cost beneficial. For low-probability/high-impact risks, the risks should be transferred or mitigated. For high-probability/low-impact risks, the controls aim to reduce the risk likelihood. Finally for high-probability/high-impact risk scenarios, the best control aims to avoid the scenarios all together.

Figure 7: Probability/Impact Quadrants (Heiser, 2010, p. 4)

One of the highest rating risk scenarios is an unsafe environment that is due to a lack of physical security that opens up an avenue for possible attacks. For this risk scenario a recommended control is to explore options of physical security for the tracks and station. While many big city Amtrak stations are guarded by private security, the outlier towns have limited protections. Each station is recommended to have private security personnel on site 24/7 as well as security cameras. The tracks should also have protections such as barbed wire fences surrounding the track and possibly small station posts at track/road intersections. This control measure will avoid risks and threats from unsafe environments.

In regards to the unsafe train operations due to poor staff performance, a recommended control is to install the PTC system more thoroughly throughout all trains and Amtrak lines. These controls are currently only running on high load busy tracks but need to be implemented everywhere. For the systems that this control has been installed, incident likelihoods have decreased and this control will help avoid this risk scenario (Mokkapati, et al., 2009). Furthermore, the training for employees should be greatly increased.

18

For the risk scenario that involves a harmful spread of pathogens among passengers, the recommended control is to install hand sanitizing dispensers. This control method is considered an avoid strategy that will decrease the probability of the scenario. These dispensers will be located at both the station and on the trains.

The risk scenario of hijacking or robberies occurring fits into the low-likelihood/high-impact quadrant. The control for this scenario is to devise an incident response procedure to mitigate the impact. However, on-site security personnel can also be used to act quickly if the scenario occurs.

The final risk scenario is for severe weather that can cause damage to the track and station. This risk scenario was only given a risk rating of 2, which is considered very low. For this risk scenario, the appropriate control is to simply accept the risk. However, a possible control is storage near the facility that contains replacement wood, windows, tracks, and related material on standby. In the event of a natural disaster, these supplies can be accessed and used to repair any damages in a timely fashion. The option of structurally reinforcing the tracks and stations would not be cost beneficial.

19

VI. Summary This risk assessment identified, quantified, and recommended controls for five risk scenarios faced by the Lewistown Amtrak Station. These scenarios include severe weather, pathogen spread, hijacking/robbery, unsafe train operation, and unsafe environment. The highest risk rating and therefore most pressing risk scenario is an unsafe environment due to a lack of physical security. The recommended risk control for this risk scenario is the installation of fences around all tracks and implementation of on-site security personnel. Refer to Attachment 9 for a complete summary of all risk scenarios, ratings, recommended controls, etc.

20

Reference List

Andersson, E., Häggström, J., Sima, M., & Stichel, S. (2004, May 1). Assessment of train-overturning risk due to strong cross-winds. Proceedings of the Institution of Mechanical Engineers, Part F: Journal of Rail and Rapid Transit, 218(3), 213-223. Retrieved September 22, 2014, from http://pif.sagepub.com/content/218/3/213.full.pdf+html

Glantz, E. (2014, September 3). SRA 311 Week02: Critical Thinking. In Angel Course Management System. Retrieved October 7, 2014, from https://cms.psu.edu/section/default.asp?id=MRG-140422-142639-EJG8&goto=

Heiser, J. (2010). Risk Assessment 101: What You Need to Know. Retrieved October 23, 2014, from http://goo.gl/FfxHxc

Mokkapati, C., Tse, T., & Rao, A. (2009, July). Practical Risk Assessment Methodology for Safety-Critical Train Control Systems (No. DOT-FRA-ORD-09-15). Retrieved September 24, 2014, from http://permanent.access.gpo.gov/gpo22485/ord0915.pdf

Nickols, F. (2004). Knowledge Management & Process Performance: Implications for Action. 2. Retrieved October 7, 2014, from http://mail.nickols.us/KM_and_Process.pdf

Stoneburner, G., Goguen, A., & Feringa, A. (2001). NIST Special Publication 800-30. Risk Management Guide for Information Technology Systems. Retrieved October 18, 2014, from http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

Stoneburner, G., Goguen, A., & Feringa, A. (2002, July). NIST Special Publication 800-30 - Risk Management Guide for Information Technology Systems. In National Institute of Standards and Technology. Retrieved September 25, 2014, from http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

Sturmovik. (2009) Lewistown, PA, Amtrak Station | 1 / 2 [Photograph], Retrieved October 9, 2014, from http://wikimapia.org/5627735/Lewistown-PA-Amtrak-Station#/photo/1153641

21

Vancouver Island University. (2013). Risk Management Framework. Retrieved October 22, 2014, from https://www2.viu.ca/riskmanagement/documents/July12_2013RiskManagementFramework.pdf

Whipp, C. (2014). Lewistown, PA PRR/Amtrak station [Photograph], Retrieved October 9, 2014, from http://static.panoramio.com/photos/large/105374606.jpg

Wreathall, J., Roth, E., Bley, D., & Multer, J. (2003, July). Human reliability analysis in support of risk assessment for positive train control (No. DOT-VNTSC-FRA-03-03,). Retrieved September 21, 2014, from http://ntl.bts.gov/lib/33000/33600/33684/33684.pdf

Wreathall, J., Woods, D., Bing, A., & Christoffersen, K. (2007, March). Relative risk of workload transitions in positive train control. Washington, DC: U.S. Dept. of Transportation, Federal Railroad Administration, Office of Safety and Research & Development. Retrieved September 22, 2014, from http://permanent.access.gpo.gov/gpo21449/ord0712.pdf

22

Attachment 1: Information Sheet

http://pif.sagepub.com/content/218/3/213.full.pdf+html

This assessment details the amount of force required by wind to cause damage or derailment. There are several factors that may cause variations in wind such as altitude changes, long flat paths, and pressure differences.

http://permanent.access.gpo.gov/gpo22485/ord0915.pdf

The severity of an accident can be represented by its associated damages to individuals, track, and equipment. This estimate can be used to create a more accurate risk assessment because each risk is valued not only on the likelihood but also on the resulting damage. This table shows the cost of the damages associated with a train crash.

Table 1: Valued Estimations of Individual and Property Damage

Type of Damage Cost

Injuries $1,500,000

Fatalities $3,000,000

Property Damages by a Low Speed Collision/Derailment (0-19 mph) $2,500,000

Property Damages by a Medium Speed Collision/Derailment (20-49 mph) $5,000,000

Property Damages by a High Speed Collision/Derailment (50+ mph) $10,000,000

http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

Appendix B of NIST 800-30 provides a sample risk assessment report outline. This provides the appropriate structure and content for this risk assessment.

http://ntl.bts.gov/lib/33000/33600/33684/33684.pdf

Human reliability is often compared to the reliability of automated machines, however this 2003 document of human reliability analysis has found that “unsafe actions by individuals or teams can reduce the effectiveness of the defenses, thereby making the likelihood of an accident higher” (Wreathall, et al, 2003). This source points out that more often than not, humans are at fault rather than automated machines.

23

http://permanent.access.gpo.gov/gpo21449/ord0712.pdf

This source by U.S. Department of Transportation provides data on the frequency of types of errors that lead to passenger train accidents. This table consists of 13 preventable accidents from 1986 - 2003. Please also note that a single accident may have several causal factors.

Table 2: Causal Factors in Train Accidents

Causal Factor Number Percent of Total

Workload/mode transition 7 54%

Expectations/situation awareness 5 38%

Equipment 5 38%

Distractions 5 38%

Inexperience 4 31%

Fitness for duty 4 31%

Inattentiveness 4 31%

Communications 3 23%

Weather 0 0%

24

Attachment 2: Structured Analytic Results In the divergent phase the team attempted to brainstorm all possible hazards. To facilitate creativity the ideas were listed as they were thought of without any restrictive structure.

Divergent Results

• Train derails as it arrives/departs from the station from high speeds.

• Train derailment caused during mode transitions.

• Train breaks down and is unable to start or move

• Train is unable to function due to employee errors

• Earthquake causes physical damage to track/station

• Storm causes physical damage to track/station

• Tornado causes physical damage to track/station

• Strong winds causes physical damage to track/station

• Robbery takes place on train

• Hijacking of train

• Viral Pandemic on train

• Incoming train crashes with stationed train

• Train is carrying material that is harmful to my well-being (Radioactive, Prisoners, Fugitives, Chemicals, etc.)

• Something located on tracks prevents arrival/departure

• Engine pressure build up causes an explosion

25

Convergent Results

The convergent phase is used to group the unordered hazards into categories based on their nature or root cause. These categories were then ranked by their priority from highest to lowest in the following order: passenger-based hazards, train malfunctions, and employee error. Please reference below Table 3: Convergent Brainstorming Results.

Table 3: Convergent Brainstorming Results

1. Passenger-Based Hazards

2. Train Malfunctions 3. Employee Error

Robbery on train Train derailment from high speeds

Train derailment during mode transition

Train hijacking Train breaks down and is unable to start/move

Employees poorly train and unable get train moving

Train is carrying harmful materials (Radioactive, chemical, prisoners, fugitives)

Explosion from engine pressure

Something left on track that prevents arrival/departure

Viral pandemic Earthquake causes damage to track/station

Incoming train crashes with stationed train

Storm causes damage to track/station

Tornado causes damage to track/station

Strong Winds cause damage to track/station

26

Attachment 3: Threat Analysis Table 4 describes the threat source, type, motivation and action for the Lewistown Amtrak Station and nearby tracks. Please note that these threats could be intentional or unintentional. This table is modeled after the table included in NIST 800-30 (2002, p. 14)

Table 4: Threat-Sources, Motivation, and Threat Actions

Threat Source (Type) Motivation Threat-Action

Hazardous weather (Natural)

Natural pressure differences Strong winds/hard rain/lightning

Tectonic plates (Natural)

Natural movement Earthquakes

Pathogens (Human) Dense population arrangement, poor hygiene

Pathogen spreading between passengers

People on-board (Human)

Malicious needs, terrorism Adversaries cause physical harm to passengers or take control of the train

Excessive speed (Human)

Poor regulations/safety controls Train derailment

Staff Members (Human)

Poor employee training, disregard of controls/maintenance

Train unable to move, breaks down, or gets damaged

Other trains (Environmental)

Poor or lack of safety controls Train on train collision

Objects on tracks (Environmental)

Misplaced, or intentionally left Object prevents incoming or outgoing train, causing delays

27

Attachment 4: Vulnerability Analysis Table 5 summarizes the possible vulnerabilities in the train station and tracks, as well as the source and vulnerability-actions from the passengers’ perspective. This table is modeled after the table included in NIST 800-30 (2002, p. 15-16).

Table 5: Vulnerability Source and Vulnerability-Action

Vulnerability Source Vulnerability-Action

Tracks/station are not built for handling severe weather or earthquakes

Tectonic plates and hazardous weather

Tornado/strong winds/earthquakes occur that cause damage to tracks/station

Passengers do not follow proper hygiene precautions and procedures

Pathogens Infected passengers or harmful supplies infect other passengers/employees

Limited hijacking/robbery prevention measures

Passengers/terrorists Adversaries/terrorists rob/hijack the passengers on the train

Unsafe staff procedures Staff members Short cuts are made that lead to damage of train, derailment, or train on train collisions

Lack of physical security Adversaries or careless workers

Objects are left on the tracks that prevent incoming and out-going trains

28

Attachment 5: Risk Scenario Likelihood Table 6 shows the likelihood of each risk scenario for the Lewistown Amtrak Station and nearby tracks. The risk scenario is a combination of the threat source and vulnerability.

Table 6: Risk Scenario and Likelihood Analysis

Risk Scenario Likelihood (1-5)

Severe weather causes damage due to limited durability of track/station 1

Harmful spread of pathogens among passengers due to close proximity required by train travel

4

Hijacking or robbery occurs due to limited prevention measures 2

Unsafe train operation due to poor staff performance 3

Unsafe environment due to lack of physical security 4

Table 7 shows the descriptions associated with the selected likelihood values. These descriptions were formulated for this report and are not generalized for all likelihood analyses.

Table 7: Likelihood Values and Descriptions (Vancouver Island University, 2014)

Descriptor Likelihood Value

Rare (Less than 5%) 1

Unlikely (5-25%) 2

Possible (25-55%) 3

Likely (55-90%) 4

Almost Certain (90-99%) 5

29

Attachment 6: Risk Scenario Impact Table 8 rates the impact of each of the risk scenarios on a scale of 1-5. Each risk scenario is described by the vulnerability being used and its impact rating.

Table 8: Risk Scenario and Impact Analysis

Risk Scenario Threat/Vulnerability Impact

Severe weather causes damage due to limited durability of track/station

Severe weather damaging the track and station

2

Harmful spread of pathogens among passengers due to close proximity required by train travel

Infectious pathogens spreading between passengers

3

Hijacking or robbery occurs due to limited prevention measures

Adversaries hijack or rob unprotected trains

4

Unsafe train operation due to poor staff performance

Unsafe train staff and operations causing severe accidents or damage

5

Unsafe environment due to lack of physical security

Lack of physical security protecting the track and station

5

Table 9 shows the descriptions associated with the selected impact values. These descriptions were formulated for this report and are not generalized for all impact analyses.

Table 9: Impact Values and Descriptions

Impact Descriptor Impact Rating

Minor travel delay 1

Considerable to indefinite travel delay 2

Minor injury 3

Moderate to severe Injury 4

Multiple deaths / serious Injury 5

30

Attachment 7: Risk Matrix A risk matrix will be used to evaluate risk impacts and likelihoods. Each axis includes a numeric scale so that comprehensive scores can be calculated by using products (please refer back to Table 7 and Table 9 for a description of each likelihood and impact numeric). For example, if the impact is scored as a three and the probability is scored as a five, the overall severity score is fifteen. Each cell is ranked by a very low, low, medium, high, or critical risk severity category. The categories are based on the following ranges of risk severity scores: very low 1-5, low 6-10, medium 11-15, high 16-20, and critical 21-25. In addition to their calculated score, these categories are also designated by green, yellow, orange, red, and purple respectively. Please reference Figure 8: Risk Matrix, below.

Figure 8: Risk Matrix

31

Attachment 8: Risk Rating The risk rating is the final value that describes the relationship between likelihood and impact. This is used when prioritizing risks and sorting scenarios by their overall risk level. Table 10 describes the final risk rating associated with the selected risk scenarios. The final risk rating was calculated by multiplying the likelihood value by the impact value. The likelihood and impact values were provided in Table 6 and Table 8 respectively.

Table 10: Risk Rating of Scenarios by Likelihood and Impact

Risk Scenario Likelihood Impact Risk Rating

Severe weather causes damage due to limited durability of track/station

1 2 2 (Very Low)

Harmful spread of pathogens among passengers due to close proximity required by train travel

4 3 12 (Medium)

Hijacking or robbery occurs due to limited prevention measures 2 4 8 (Low)

Unsafe train operation due to poor staff performance 3 5 15 (Medium)

Unsafe environment due to lack of physical security 4 5 20 (High)

32

Attachment 9: Summary Table Table 11 summarizes the selected risk scenarios as well as the associated recommended controls. The recommended controls are broken into the action priority, required resources, party responsible for control implementation, and any maintenance that may be required for the control.

Table 11: Summary Table of Risk Scenarios and Recommended Controls

Risk Scenario Risk Rating

Recommended Control

Action Priority

Required Resources

Responsible Party

Maintenance Requirement

Severe weather causes damage due to limited durability of track/station

2 (Very Low)

None, accept the risk

Low Tracks, concrete, wood, windows, labor, contractor

Property Owner

Reconstruct building/track if event occurs

Harmful spread of pathogens among passengers due to close proximity required by train travel

12 (Medium)

Hand sanitizing dispensers

Medium Hand sanitizing wall dispensers, labor, sanitizer bags

Property Owner

Refill dispensers

Hijacking or robbery occurs due to limited prevention measures

8 (Low) On-site security personnel, incident response procedures

Low Documents, security employees

Security team, Transit police

N/A

Unsafe train operation due to poor staff performance

15 (Medium)

PTC system implemented more thoroughly, better policies and training

Medium Circuitry, manuals, documents, labor, contractors

Property Owner, Training management

PTC system maintenance as needed

Unsafe environment due to lack of physical security

20 (High) Install fences around tracks, on-site security personnel

High Fences, contractors, security employees, contracts, labor

Property owner

Maintenance on fences if damaged

33

GRADING RUBRIC Peer Reviewer: Assign total points here for composition, contribution, subject knowledge and APA citations. Write specific comments into student’s paper.

Section _________

1st Author Name (Print): __________________ 2nd Author Name (Print): __________________

1st Peer Reviewer Name (Print): ________________ 2nd Peer Reviewer Name (Print): ________________

Peer Reviewer Points

Max Possible Points

Instructor Total Points

Item

25 Composition - Business professional writing with no grammatical or spelling errors.

25 Contribution - Improves class learning by providing new information or approach to topic under discussion.

25 Subject Knowledge - Knowledge of course content is illustrated by integrating concepts into the essay. Does it appear that you know what you are writing about? Are you aware of aspects of this covered in class?

15 Captions, References and APA Citations - Reference to article, book, or magazine where new information or approach is provided, and appropriate citation in text. Must follow APA format!!!

• In-Text Cite: Includes author/year, sometimes page number • Reference List: Each single-spaced with hanging indent, double-

space between citations • Captions: Tables/ figures must include complete captions with

citation (blank) 10 In-class peer review - Thorough and complete with specific comments (i.e.

NOT "good job" or "great opening") for what has been done well or what could be done to improve the paper

(blank) 100 Total

INSTRUCTOR/LA GRADER INITIALS ________