Vulnerability assessment

Last updated

A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system. Examples of systems for which vulnerability assessments are performed include, but are not limited to, information technology systems, energy supply systems, water supply systems, transportation systems, and communication systems. Such assessments may be conducted on behalf of a range of different organizations, from small businesses up to large regional infrastructures. Vulnerability from the perspective of disaster management means assessing the threats from potential hazards to the population and to infrastructure. It may be conducted in the political, social, economic or environmental fields.

Contents

Vulnerability assessment has many things in common with risk assessment. Assessments are typically performed according to the following steps:

  1. Cataloging assets and capabilities (resources) in a system.
  2. Assigning quantifiable value (or at least rank order) and importance to those resources
  3. Identifying the vulnerabilities or potential threats to each resource
  4. Mitigating or eliminating the most serious vulnerabilities for the most valuable resources

"Classical risk analysis is principally concerned with investigating the risks surrounding a plant (or some other object), its design and operations. Such analysis tends to focus on causes and the direct consequences for the studied object. Vulnerability analysis, on the other hand, focuses both on consequences for the object itself and on primary and secondary consequences for the surrounding environment. It also concerns itself with the possibilities of reducing such consequences and of improving the capacity to manage future incidents." (Lövkvist-Andersen, et al., 2004) [1] In general, a vulnerability analysis serves to "categorize key assets and drive the risk management process." (United States Department of Energy, 2002). [2]

In the United States, guides providing valuable considerations and templates for completing a vulnerability assessment are available from numerous agencies including the Department of Energy, the Environmental Protection Agency, and the United States Department of Transportation.

Several academic research papers including Turner et al. (2003), [3] Ford and Smith (2004), [4] Adger (2006), [5] Fraser (2007) [6] and Patt et al. (2010) [7] amongst others, have provided a detail review of the diverse epistemologies and methodologies in vulnerability research. Turner et al. (2003) [3] for example proposed a framework that illustrates the complexity and interactions involved in vulnerability analysis, draws attention to the array of factors and linkages that potentially affects the vulnerability of a couple of human–environment systems. The framework makes use of nested flowcharts to show how social and environmental forces interact to create situations vulnerable to sudden changes. Ford and Smith (2004), propose an analytical framework, based on research with Canadian arctic communities. They suggest that, the first stage is to assess current vulnerability by documenting exposures and current adaptive strategies. This should be followed by a second stage that estimates directional changes in those current risk factors and characterizes the community's future adaptive capacity. Ford and Smith's (2004) framework utilizes historic information including how communities have experienced and addressed climatic hazards, with information on what conditions are likely to change, and what constraints and opportunities there are for future adaptation.

Standardized Government Vulnerability Assessment Services

The GSA (also known as the General Services Administration) has standardized the “Risk and Vulnerability Assessments (RVA)” service as a pre-vetted support service, to rapidly conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations, enterprise or local policy, assess the level of risk, and develop and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. This standardized service offers the following pre-vetted support services:

These services are commonly referred to as Highly Adaptive Cybersecurity Services (HACS) and are listed at the US GSA Advantage website. [8]

This effort has identified key service providers which have been technically reviewed and vetted to provide these advanced services. This GSA service is intended to improve the rapid ordering and deployment of these services, reduce US government contract duplication, and to protect and support the US infrastructure in a more timely and efficient manner.

132-45D Risk and Vulnerability Assessment [9] identifies, quantifies, and prioritizes the risks and vulnerabilities in a system. A risk assessment identifies recognized threats and threat actors and the probability that these factors will result in exposure or loss.

Vulnerability to climate change

Vulnerability assessment is important because it provides information that can be used to develop management actions in response to climate change. [10] Climate change vulnerability assessments and tools are available at all scales. Macro-scale vulnerability assessment often uses indices. Modelling and participatory approaches are also in use. Global vulnerability assessments are based on spatial mapping using aggregated data for the regional or national level. [11] :1195–1199

See also


Related Research Articles

<span class="mw-page-title-main">Risk management</span> Identification, evaluation and control of risks

Risk management is the identification, evaluation, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities.

Risk assessment determines possible mishaps, their likelihood and consequences, and the tolerances for such events. The results of this process may be expressed in a quantitative or qualitative fashion. Risk assessment is an inherent part of a broader risk management strategy to help reduce any potential risk-related consequences.

<span class="mw-page-title-main">Critical infrastructure</span> Infrastructure important to national security

Critical infrastructure, or critical national infrastructure (CNI) in the UK, describes infrastructure considered essential by governments for the functioning of a society and economy and deserving of special protection for national security.

A penetration test, colloquially known as a pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; this is not to be confused with a vulnerability assessment. The test is performed to identify weaknesses, including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed.

<span class="mw-page-title-main">Effects of climate change</span>

Climate change affects the physical environment, ecosystems and human societies. Changes in the climate system include an overall warming trend, more extreme weather and rising sea levels. These in turn impact nature and wildlife, as well as human settlements and societies. The effects of human-caused climate change are broad and far-reaching. This is especially so if there is no significant climate action. Experts sometimes describe the projected and observed negative impacts of climate change as the climate crisis.

<span class="mw-page-title-main">Economic analysis of climate change</span>

The economic analysis of climate change explains how economic thinking, tools and techniques are applied to calculate the magnitude and distribution of damage caused by climate change. It also informs the policies and approaches for mitigation and adaptation to climate change from global to household scales. This topic is also inclusive of alternative economic approaches, including ecological economics and degrowth. In a cost–benefit analysis, the trade offs between climate change impacts, adaptation, and mitigation are made explicit. Cost–benefit analyses of climate change are produced using integrated assessment models (IAMs), which incorporate aspects of the natural, social, and economic sciences. The total economic impacts from climate change are difficult to estimate, but increase for higher temperature changes.

<span class="mw-page-title-main">U.S. critical infrastructure protection</span>

In the U.S., critical infrastructure protection (CIP) is a concept that relates to the preparedness and response to serious incidents that involve the critical infrastructure of a region or the nation. The American Presidential directive PDD-63 of May 1998 set up a national program of "Critical Infrastructure Protection". In 2014 the NIST Cybersecurity Framework was published after further presidential directives.

<span class="mw-page-title-main">Climate change adaptation</span> Process of adjusting to effects of climate change

Climate change adaptation is the process of adjusting to the effects of climate change. These can be both current or expected impacts. Adaptation aims to moderate or avoid harm for people. It also aims to exploit opportunities. Humans may also intervene to help adjustment for natural systems. There are many adaptation strategies or options. They can help manage impacts and risks to people and nature. Adaptation actions can be classified in four ways: infrastructural and technological; institutional; behavioural and cultural; and nature-based options.

In its broadest sense, social vulnerability is one dimension of vulnerability to multiple stressors and shocks, including abuse, social exclusion and natural hazards. Social vulnerability refers to the inability of people, organizations, and societies to withstand adverse impacts from multiple stressors to which they are exposed. These impacts are due in part to characteristics inherent in social interactions, institutions, and systems of cultural values.

Climate risk is the potential for negative consequences for human or ecological systems from the impacts of climate change. It refers to risk assessments based on formal analysis of the consequences, likelihoods and responses to these impacts and how societal constraints shape adaptation options. However, the science also recognises different values and preferences around risk, and the importance of risk perception.

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

<span class="mw-page-title-main">Hazard</span> Situation or object that can cause damage

A hazard is a potential source of harm. Substances, events, or circumstances can constitute hazards when their nature would allow them, even just theoretically, to cause damage to health, life, property, or any other interest of value. The probability of that harm being realized in a specific incident, combined with the magnitude of potential harm, make up its risk, a term often used synonymously in colloquial speech.

Assessment may refer to:

<span class="mw-page-title-main">IT risk management</span>

IT risk management is the application of risk management methods to information technology in order to manage IT risk, i.e.:

The Arctic is a vast polar region comprising the northernmost parts of Canada, Norway, Greenland (Denmark), Sweden, Finland, the United States (Alaska), Iceland and Russia. In recent years, the Arctic has been at the forefront of political and social issues. Several matters have risen surrounding the issues of poverty and global warming and their effects on indigenous people in this region. Indigenous people in the Arctic statistically fall below their nation's poverty line.

Climate resilience is defined as the "capacity of social, economic and ecosystems to cope with a hazardous event or trend or disturbance". This is done by "responding or reorganising in ways that maintain their essential function, identity and structure while also maintaining the capacity for adaptation, learning and transformation". The key focus of increasing climate resilience is to reduce the climate vulnerability that communities, states, and countries currently have with regards to the many effects of climate change. Efforts to build climate resilience encompass social, economic, technological, and political strategies that are being implemented at all scales of society. From local community action to global treaties, addressing climate resilience is becoming a priority, although it could be argued that a significant amount of the theory has yet to be translated into practice.

The Global Sustainability Assessment System (GSAS) [Originally QSAS] is the first performance-based system in the Middle East and North Africa (MENA) region, developed for assessing and rating buildings and infrastructure for their sustainability impacts. In 2016, FIFA officially endorsed GSAS as the sustainability assessment system for Qatar's eight stadiums set to host the 2022 FIFA World Cup. The primary objective of GSAS is to create a sustainable built environment that minimizes ecological impact and reduces resources consumption while addressing the local needs and environmental conditions specific to the region. GSAS adopts an integrated lifecycle approach for the assessment of the built environment including design, construction and operation phases.

<span class="mw-page-title-main">Climate security</span> Environmental aspect of geopolitics

Climate security is a political and policy framework that looks at the impacts of climate on security. Climate security often refers to the national and international security risks induced, directly or indirectly, by changes in climate patterns. It is a concept that summons the idea that climate-related change amplifies existing risks in society that endangers the security of humans, ecosystems, economy, infrastructure and societies. Climate-related security risks have far-reaching implications for the way the world manages peace and security. Climate actions to adapt and mitigate impacts can also have a negative effect on human security if mishandled.

Climate change and agriculture are complexly related processes. In the United States, agriculture is the second largest emitter of greenhouse gases (GHG), behind the energy sector. Direct GHG emissions from the agricultural sector account for 8.4% of total U.S. emissions, but the loss of soil organic carbon through soil erosion indirectly contributes to emissions as well. While agriculture plays a role in propelling climate change, it is also affected by the direct and secondary consequences of climate change. USDA research indicates that these climatic changes will lead to a decline in yield and nutrient density in key crops, as well as decreased livestock productivity. Climate change poses unprecedented challenges to U.S. agriculture due to the sensitivity of agricultural productivity and costs to changing climate conditions. Rural communities dependent on agriculture are particularly vulnerable to climate change threats.

<span class="mw-page-title-main">Climate change vulnerability</span> Assessment of relative vulnerability to climate change and its effects

Climate change vulnerability is a concept that describes how strongly people or ecosystems are likely to be affected by climate change. It is defined as the "propensity or predisposition to be adversely affected" by climate change. It can apply to humans and also to natural systems. Related concepts include climate sensitivity and the ability, or lack thereof, to cope and adapt. Vulnerability is a component of climate risk. Vulnerability differs within communities and across societies, regions, and countries, and can increase or decrease over time.

References

  1. Handbook of International Electrical Safety Practices
  1. Lövkvist-Andersen, et al., 2004 https://www.researchgate.net/publication/242256695_Modelling_Society's_Capacity_to_Manage_Extraordinary_Events_Developing_a_Generic_Design_Basis_GDB_Model_for_Extraordinary_Societal_Events_using_Computer-Aided_Morphological_Analysis
  2. US Department of Energy. (2002). Vulnerability Assessment Methodology, Electric Power Infrastructure.
  3. 1 2 Turner, B. L.; Kasperson, R. E.; Matson, P. A.; McCarthy, J. J.; Corell, R. W.; Christensen, L.; Eckley, N.; Kasperson, J. X.; Luers, A.; Martello, M. L.; Polsky, C.; Pulsipher, A.; Schiller, A. (5 June 2003). "Science and Technology for Sustainable Development Special Feature: A framework for vulnerability analysis in sustainability science". Proceedings of the National Academy of Sciences. 100 (14): 8074–8079. Bibcode:2003PNAS..100.8074T. doi: 10.1073/pnas.1231335100 . PMC   166184 . PMID   12792023.
  4. Ford, James D.; Barry Smit (Dec 2004). "A Framework for Assessing the Vulnerability of Communities in the Canadian Arctic to Risks Associated with Climate Change". Arctic. 57 (4): 389–400. doi:10.14430/arctic516. hdl: 10535/3095 . JSTOR   40512642.
  5. Adger, W. Neil (August 2006). "Vulnerability". Global Environmental Change. 16 (3): 268–281. doi:10.1016/j.gloenvcha.2006.02.006.
  6. Fraser, Evan D. G. (August 2008). "Travelling in antique lands: using past famines to develop an adaptability/resilience framework to identify food systems vulnerable to climate change". Climatic Change. 83 (4): 495–514. doi: 10.1007/s10584-007-9240-9 . S2CID   154404797.
  7. Patt, Anthony; Dagmar Schröter; Richard Klein; Anne Cristina de la Vega-Leinert (2010). Assessing vulnerability to global environmental change : making research useful for adaptation decision making and policy (1st paperback ed.). London: Earthscan. ISBN   9781849711548.
  8. "132-45D Risk and Vulnerability Assessment Companies". 20 March 2018.
  9. "132-45D Risk and Vulnerability Assessment". 20 March 2018.
  10. "Climate Change Vulnerability Assessments | Climate Change Resource Center". www.fs.usda.gov. Archived from the original on 2022-10-04. Retrieved 2022-10-04.
  11. Birkmann, J., E. Liwenga, R. Pandey, E. Boyd, R. Djalante, F. Gemenne, W. Leal Filho, P.F. Pinho, L. Stringer, and D. Wrathall, 2022: Poverty, Livelihoods and Sustainable Development Archived 2023-03-14 at the Wayback Machine . In: Climate Change 2022: Impacts, Adaptation and Vulnerability. Contribution of Working Group II to the Sixth Assessment Report of the Intergovernmental Panel on Climate Change Archived 2022-02-28 at the Wayback Machine [H.-O. Pörtner, D.C. Roberts, M. Tignor, E.S. Poloczanska, K. Mintenbeck, A. Alegría, M. Craig, S. Langsdorf, S. Löschke, V. Möller, A. Okem, B. Rama (eds.)]. Cambridge University Press, Cambridge, UK and New York, NY, USA, pp. 1171–1274, doi:10.1017/9781009325844.010.