ARC³ Corporation is highly experienced in the full gamut of Threat, Vulnerability, and Criticality Assessments for critical infrastructure and operations on a worldwide basis. ARC³ has conducted security risk assessments and attack scenarios for a broad range of client facilities, including:

 

Hydroelectric Dams Chemical Plants Water Systems Airports

Railroads Port Facilities Power Plants Commercial Buildings

Large Public Venues Municipal Facilities Government & Military Facilities Maritime Assets

---

These core competencies are based on years of experience by the ARC³ team in the areas of counter-terrorism and special operations, intelligence, engineering, project management, law enforcement, tactical training and operations, and physical and operational security.

ARC³ is trained and experienced in a number of current vulnerability assessment tools, including:

• Security Risk Assessment Methodologies (RAM) developed by Sandia National Laboratories: RAM-T™ for Electric Transmission Facilities, RAM-D™ for Hydroelectric Projects, and RAM-W™ for Water Systems
• Vulnerability Assessment Methodology (VAM™)
• CARVER-S target analysis tool, developed by the U.S. intelligence and military communities
• Vulnerability Self-Assessment Tool (VSAT™), and Security Vulnerability Assessment (SVA™) methodologies, both developed by the Center for Chemical Process Safety (CCPS)

Attacker’s Perspective

ARC³ offers a uniquely valuable perspective in the risk assessment field: A true understanding of the adversary's mindset. This perspective enables a realistic assessment of risk, and development of pragmatic risk reduction measures. ARC³ takes this adversarial viewpoint of the terrorist or criminal in an offensive posture, and applies it to the client facility.

From their previous experience targeting and planning attacks on hostile foreign assets and infrastructure, ARC³ security specialists understand the steps that must be followed for an adversarial attack to be successful, and with that experience, know where the adversary is vulnerable in their attack process. We are experienced in leveraging the attacker’s weaknesses against them, and have in the past, successfully foiled attacks against key overseas facilities and infrastructure for both U.S. and allied foreign clients.

Threat Analysis & Assessment

ARC³ Corporation conducts a detailed threat assessment to determine the likelihood that an adversary will attack a critical asset or facility in order to achieve a particular consequence, and will succeed in defeating the existing security system. A site-specific threat analysis to define the threat posture for each client, against a broad range of adversaries-from international terrorists, to insiders, to hackers-is incorporated into the threat assessment. With decades of experience and background in counter-terrorism and law enforcement, ARC³ can evaluate the three critical threat variables specific for a facility: Capability, Intent, and Targeting.

ARC³ uses the CARVER-S methodology to apply its focused intelligence collection capabilities, knowledge and experience, to place a numerical tiered rank on the most credible threats. Ultimately, this will provide useable practical insight and the ability to prioritize the identified security enhancement recommendations.

Vulnerability Assessment

An ARC³ security consulting team will typically consist of engineers, project managers, former special operations operators, law enforcement specialists and subject-matter experts (as needed). This multidisciplinary team will conduct exhaustive site surveys, field investigations and existing policy and procedure reviews, as the first step in the vulnerability assessment process. This accumulated data will then be integrated into the overall risk assessment analysis.

Criticality Assessment

Every client facility is composed of a wide range of functional, operational, administrative, technology and logistical elements. Because in the real world it is virtually impossible to protect each and every asset, and each and every vulnerability, ARC³’s Security Consulting Team will collaborate with the client’s management and supervisory personnel to identify the most critical elements of client’s operations and enterprise business model. The ultimate test for the consequence of a successful attack is the business continuity implications for the organization.

With this information, ARC³ will craft the most cost-effective security enhancement strategy, which incorporates the ‘real world’ requirements of each client’s unique operation, balanced against a realistic and achievable risk reduction program.

Risk Reduction & Threat Mitigation

In the final step, ARC³’s risk reduction measures are assembled into coherent packages, based on cost, practicality of implementation, and quantifiable risk reduction. Further, scalable risk reduction measures, suited for rapid activation and deactivation, are identified in order to respond to rapidly changing threat conditions. This approach allows an organized site-specific surge capability to elevated threat conditions.

The ARC3 security risk assessment provides the client with a quantitative analysis, with prioritized threats, vulnerabilities, and risk-reduction measures, in an organized numerical-based matrix analysis-all of which is validated by experience-based qualitative review.

The bottom line: Any recommended risk reduction strategy that is either too expensive, unreasonably complex, impractical, or otherwise unachievable, provides no solution. Working closely with each and every client, the ARC³ team will assist the client in developing and fielding the most comprehensive, cost-effective and easily deployed integrated security solutions possible.