A big lesson learned

Design Basis Threat / Vulnerability of Integrated Security Analysis methodology

The VISA process begins with the creation of a Design Basis Threat (DBT) document, detailing potential security risks, adversaries, attack methods, and motivations. This helps tailor effective security measures.

The DBT serves as a foundation for creating scenarios to test the physical protection system. If your organization lacks a DBT, we can develop one to identify and protect against threats.

The VISA process involves a diverse team from various parts of your company, such as Operations, Engineering, Security, Human Resources, etc.  If possible, we try to get a representative from local law enforcement to participate.  They tour the facility to gather information on its functions, critical components, and vulnerabilities. The team then creates and analyzes three scenarios: an outsider-only attack, an insider-only attack, and a combined attack.

Scenarios must be reasonable, credible, and align with the DBT. The analysis evaluates the physical protection system’s effectiveness, often revealing weaknesses. Recommendations for upgrades are usually low-cost or procedural changes.

This VISA process emphasizes looking at security from an adversary’s perspective to find and fix vulnerabilities.  The outcome includes an assessment of the physical protection system and necessary upgrades to meet acceptable risk levels, providing a business case for improvements.

The product of the workshop will be a core group of employees within your organization who can organize VISA assessments of your facilities when and where you choose.  Additional benefits include improved communication between operations and security, better understanding with local law enforcement, and heightened awareness of security measures and insider threats. 

The DBT/VISA methodology is effective for any critical infrastructure sector.

If you have any questions about this workshop and how it might help your organization, please contact me at +1 (780) 405-5542 or ross@bridgeheadsecurity.com.