Chapter 21 - Understanding Layers of Protection Analysis

Abstract

The usage of risk analyses has been adopted by security professionals around the world as a best practice. This risk analysis typically begins with an assessment that determines the likelihood of an unfortunate event that may possibly occur. A risk analysis may or may not require some type of quantitative data in the event or likelihood that an event will occur. It also assesses this likelihood and provides a comparative analysis to determine the probability that the existing protection layers will or will not operate as required (sometimes technology, procedures, or human behavior may not act or perform as predetermined). In addition, a risk is the result of any deviation from the expected operation, process design, failed procedures, or a lax (possibly a nonexistent) site safety and security culture. The risk analysis seeks to identify these deviations and to develop a plan to reduce or mitigate an event should one occur. Once the results of each deviation have been measured and analyzed, the design and previous performance should be included as part of the holistic posture. This of course may result in some of the event deviations being significant enough that a serious hazard may be likely. However, by using the layers of protection analysis (LOPA) concept a security professional can reduce or mitigate the risk as low as reasonably manageable.