Securing critical infrastructure: portfolio based approach

of manpower and resources to secure all these critical assets if you have a portfolio management system that is able to track all those variables at the same time to see how your risk is changing. The portfolio approach also helps to judge risk not just in the present, but also to see where things are going in the future so you can build a long term strategy or plan to secure your enterprise.

HSNW: Naturally, from the federal perspective there is going to be a certain perspective or priority that differs from local and state governments. How do you reconcile these differences to ensure that all sides are working together and have unity of effort?

BW: This is a really important point and I think this is a point that is lost on federal agencies and their representatives almost all the time. What is important to the federal government is not necessarily the thing that is considered important to a local government and this holds true for industries as well.

The easiest example to draw out is from the defense industrial base. There could be a manufacturer of a very specific kind of composite chemical that is needed for armor. They may not employ a whole lot of people or drive a lot of revenue for a community, but it is nationally important to the defense mission as it is a critical supplier that would have a huge impact on the DOD’s abilities. To local authorities it could be one of their smaller businesses, one that they may not even know about, so making it critical to them is difficult to imagine.

The way that you balance this is you have to separate the concept, what we call the “domain model,” from the things that a business, local government, or federal agency thinks are important. In other words, you have to separate individual value judgments from the facts. The facts are it has an address, a number of employees, it occupies a certain part of the infrastructure taxonomy that it lives in, and it has an annual revenue. That whole series of attributes is factual data regardless of your opinion or your belief about it.From there, you can compile this data and then apply your judgment from your perspective. In practice those same assets may look different to the DHS than they do to a city, a state, or a corporation, but we