CARVER CARVER is a methodology first used.docx

CARVER
CARVER
is
a
methodology
first
used
by
the
Department
of
Defense
Special
Forces
to
rank
targets
so
that
their
resources
could
be
used
efficiently.
The
user
would
estimate

Criticality,
Accessibility,
Recuperability,
Vulnerability,
Effect,
and
Recognizability
as
nominal
scores
that
were
added
and
then
ranked.
The
methodology
was
later
adapted
for
Homeland
Security.
The
CARVER
tool
that
was
used
by
practitioners
had

proprietary
data
tables
behind
it
to
weigh
user
inputs
appropriately.
This
tool
makes
those
tables
available
so
that
the
user
can
experiment
with
weighting
and
modeling
if
desired.
Using
the
Tool

For
this
simple
tool,
only
one
asset
can
be
evaluated
for
each
spreadsheet.
To
evaluate
a
set
of
assets,
we
recommend
making
a
number
of
copies
of
the
Excel
file
with
one
evaluation

for
each
file.
All
data
is
input
into
the
Worksheet
tab
while
all
the
tables
are
on
the
Tables
tab.
The
Menu
Items
and
Results
tabs
are
used
to
store
values
temporarily
and
are

it
is
not
recommended
that
users
modify
these.
To
begin,
input
enough
data
to
uniquely
identify
the
asset
to
be
evaluated.
This
is
not
used
in
any
calculation
so
not
all
is

required,
but
at
a
minimum,
a
unique
name
is
helpful.
You
may
also
place
this
asset
into
a
specific
sector.
Criticality
assesses
the
impact
of
the
loss
of
this
asset.
Note
that

CARVER
is
not
threat
mode
specific
so
you
are
to
consider
any
threat
possible.
• Users
Affected
is
not
casualties,
but
rather
people
impacted
by
the
loss
of
this
asset.
If
it

is
a
bridge
and
100,000
people
will
not
be
able
to
get
to
work,
then
these
people
are
affected.
• Economic
Loss
and
Rebuild
Cost
is
and
estimate
of
the
financial
damage

associated
with
the
loss
of
this
asset.
Economic
loss
and
rebuild
cost
are
summed
together
in
this
estimate,
so
be
sure
that
if
you
include
economic
loss
for
one
asset,
you
include
it
throughout

your
assessment.
• Potential
Deaths
form
Attack
is
an
estimate
of
casualties
associated
with
an
attack
on
this
asset.
Again,
CARVER
is
not
threat
specific
so
assume
worst
case
scenario.

Accessibility
allows
you
to
indicate
what
security
may
be
in
place
to
limit
access
to
this
asset.
You
may
choose
from
Patrolled,
Perimeter
Fencing,
Armed
Security,
Unarmed
Security,
Access
Control,
Alarm
System,
Locked

Area,
Open
to
the
Public,
and
No
Control.
Recoverability
is
the
time
needed
to
replace
or
repair
this
asset,
if
possible.
Choose
an
estimate
from
the
menu.

Vulnerability
is
the
susceptibility
of
this
asset
to
damage
or
destruction.
Ignore
anything
related
to
access
(we
covered
that
under
Accessibility)
and
focus
instead
on
features
of
the
asset
that
will
help

it
to
withstand
or
survive
an
attack.
• Massive
refers
to
the
size
of
the
structure.
A
massive
structure,
like
a
major
bridge,
has
low
vulnerability
due
to
its
size.
• Building

Purpose
Unknown
to
Public
would
be
like
a
water
pumping
station
that
looks
like
a
non-‐descript
house
in
a
neighborhood.
• Operations
Structurally
Dispersed
would
be
a
facility
that
has
a
back-‐up
location

or
can
otherwise
function
without
all
of
its
parts
operating
at
the
same
time.
• Concrete/Stone
refers
to
the
structural
material
used
in
the
asset.
• Structural
Steel
also
refers
to
the
structural
material

used
in
the
asset.
• Flammable/Explosive
should
be
selected
if
either
the
asset
itself
burns
easily
or
if
it
contains
materials
that
burn
easily
or
are
potentially
explosive.
• Minor
Metal
Frame
again

refers
to
the
structural
material
used
in
the
asset.
• Wood
Design
refers
to
the
structural
material
used
in
the
asset.
• No
Security
Design
means
that
there
is
nothing
special
in
the
design
of
this

asset
to
reduce
vulnerability.
Espyability
refers
to
whether
or
not
the
asset
is
merely
functional
or
if
it
has
iconic
status
at
the
Local,
State,
Regional,
National,
or
World
level.

Choose
from:
• Locally
significant,
non-‐government
• Locally
significant,
government
• State
icon
only
• State
icon
+
function
• Regional
icon
only
• Regional
icon
+
function
• National
icon
only
• National

icon
+
function
• World
icon
only
• World
icon
+
function
Redundancy
is
an
estimate
of
the
percentage
overlap
or
back-‐up
capacity
there
is
to
offset
the
loss
of
this

asset.
Interdependency
is
a
list
of
sectors
that
might
be
interdependent
with
this
asset.
For
example,
if
this
is
a
power
station,
it
might
be
interdependent
with
the
water
sector,

commercial
facilities,
defense
industrial
base,
etc.
Interdependency
is
not
calculated
into
the
CARVER
score
but
is
represented
by
the
smaller
number
in
the
score.
A
CARVER
score
of
122-‐5
means
that
this
asset
has

a
score
of
122
with
5
interdependencies.
CARVER
scores
are
calculated
but
are
dimensionless.
The
score
does
not
represent
Risk,
Resilience,
Vulnerability,
or
anything
else.
The
higher
the
score,
the
more

likely
that
asset
may
require
resourcing.
But
you
cannot
say
that
an
asset
with
a
score
of
100
is
half
as
important
as
an
asset
with
a
score
of
200.

Modifications
The
best
place
to
experiment
with
CARVER
is
in
the
Tables
tab.
Here
you
will
see
all
of
the
categories
we
just
described
here
with
all
of
the
items
in
the

menus
that
you
can
select.
Notice
that
for
each
menu
selection,
there
is
an
associated
Score.
Do
not
change
the
Value
column.
That
is
there
as
an
identifier
for
that
menu
selection.
But

do
experiment
with
changing
the
Scores.
Should
a
criticality
that
impacts
500,000
people
(score
of
40)
be
only
four
times
higher
than
that
for
25,000
people
(score
of
10)?
Maybe

it
should
be
higher.
Experiment
with
changing
scores.
Test
your
configurations
with
a
set
of
assets
to
make
sure
that
it
makes
sense.
Does
the
overall
CARVER
score
go
up
when
you
expect

it
to?
Does
it
decrease
when
you
expect
it
to?
By
default,
the
data
tables
we
provide
are
all
independent
but
they
don’t
have
to
be.
You
could
experiment
by
having
a
score
linked

to
another
value.
For
example,
what
if
you
wanted
the
Criticality
score
to
be
higher
if
the
Recoverability
time
was
longer?
How
would
you
do
that?
Multi-‐Criteria
Assessment
Methodology

This
multi-‐criteria
tool
is
an
example
of
a
simple
risk-‐based
model
that
assesses
assets
independently
but
with
multiple
measures.
For
this
example,
we
used
a
subset
of
the
MSRAM
model,
at
least
in

the
way
MSRAM
models
risk
and
its
components.
Description
Asset
is
a
unique
name
of
the
asset
to
be
evaluated.
Attack
Mode
is
a
description
of
the
type

of
attack
being
considered.
Multiple
attack
modes
can
be
considered
for
any
asset.
We
consider
Asset
+
Attack
Mode
as
the
key
data
pair
that
uniquely
identifies
one
assessment.
An
electrical
switching

station
could
be
paired
with
an
explosive
device,
a
SCADA
attack,
or
other
mode,
each
of
which
would
be
considered
separately.
We
use
the
standard
equation
for
Risk

R
=
T
*
V
*
C
where
T
is
Threat,
V
is
Vulnerability,
and
C
is
Consequence.
The
components
of
each
is
described
below.
Threat
is

the
percentage
product
of
Intent
and
Capability.
• Intent
is
the
probability
that
a
person
or
group
would
want
to
damage
or
destroy
this
asset.
High
intent
would
imply
knowledge
of
an
impending

attack
or
a
credible
threat.
• Capability
is
the
probability
that
a
person
or
group
would
have
the
capability
to
execute
this
attack.
Note
that
this
requires
an
attack
mode.
The
capability

of
a
group
to
obtain
small
explosives
is
likely
to
be
higher
than
their
capability
to
obtain
radioactive
material.
Vulnerability
is
the
percentage
product
of
Achievability
and
Target
Hardness.
• Achievability
is
the

probability
of
successful
attack
assuming
no
security
measures.
Do
not
consider
existing
security
features
such
as
fencing,
key
card
control,
CCTV,
etc.
Assume
that
this
person
or
group
gains
access
to
this
asset

with
a
small
explosive
device
(for
example).
What
is
the
likelihood
that
it
would
successfully
disable
the
asset?
• Target
Hardness
is
the
probability
that
the
target
cannot
withstand
the
attack.
Note

this
implies
that
a
lower
value
means
a
harder
target.
An
asset
with
stand-‐off
barriers
and
physical
patrols
would
have
a
lower
target
hardness
value
than
one
with
only
light
fencing.

Consequence
is
the
sum
of
all
consequence
category
estimates.
All
categories
must
be
translated
to
a
single
unit
(e.g.
dollars,
millions
of
dollars,
lives).
• Death/Injury
is
the
number
of
casualties
that
would

be
expected
as
a
result
of
this
attack
on
this
asset.
We
use
a
value
per
statistical
life
(VSL)
of
$6.5M
but
this
can
be
adjusted.
• Economic
Loss
is
the
estimated
value

of
loss
due
to
attack.
This
should
include
the
damage
to
the
asset
itself
but
could
also
include
“downstream”
economic
damages.
For
example,
if
a
bridge
is
disabled,
the
cost
to
repair
the

bridge
could
be
added
to
the
estimated
loss
of
commerce
over
the
time
it
takes
to
repair
the
bridge
to
estimate
this
value.
It
is
important
to
be
consistent
throughout
all
entries
in
this

column.
• Environmental
is
the
estimated
value
of
the
environmental
impact
of
this
attack
on
this
asset.
If
there
is
no
environmental
impact,
then
this
can
be
zero.
In
cases
where
a
post-‐event

clean
up
must
be
performed,
as
would
be
the
case
in
a
radiological,
chemical,
or
biological
attack,
this
could
be
very
high.
• National
Security
is
the
estimated
value
of
the
impact
of
this

attack
on
this
asset
on
national
security.
An
attack
on
a
port
facility,
for
example,
might
have
a
large
impact
national
security,
whereas
an
attack
on
a
water
treatment
plant
may
have
a

smaller
estimated
value.
• Symbolic
is
the
estimated
value
of
impact
due
to
the
symbolic
value
of
this
target.
Damage
to
an
iconic
bridge
would
be
estimated
higher
than
a
generic
bridge.
Damage

to
a
national
monument
would
have
value
here
where
it
may
not
have
value
elsewhere.
Total
is
the
Risk
calculation
for
this
Asset-‐Attack
Mode
pair.
It
is
computed,
not
input

by
the
user.
Assuming
that
consequence
values
were
given
in
dollars,
then
the
Risk
calculation
is
also
in
dollars.
You
may
use
the
Sort
function
in
Excel
to
sort
the
table
on

Total
in
order
to
quickly
identify
the
Asset-‐Attack
Mode
pairs
with
the
highest
calculated
Risk.
Modifications
This
simple
tool
was
built
with
the
intention
that
it
would
be
modified
to
meet

specific
uses.
1. If
the
components
of
T,
C,
or
C
are
not
desired,
then
the
user
may
directly
input
percentage
values
(0-‐100)
in
columns
E
or
H.
For
consequence,
a

C
can
be
directly
input
into
column
N
or
any
of
the
columns
I
through
M
may
be
discarded
if
not
needed.
The
tool
will
sum
what
values
are
given.
2. If
you

wish
to
add
another
component
to
Threat
or
Vulnerability,
you
may
do
so
by
adding
a
new
column
under
that
category,
in
either
the
red
or
yellow
regions.
Make
sure
that
you
adjust
the

Score
column
to
include
the
new
column.
Also
make
sure
that
the
new
component
is
a
percentage
value
so
that
it
can
be
multiplied
without
affecting
the
other
components.
3. You

may
also
add
components
to
Consequence
easily.
Add
a
column
into
the
blue
region,
and
make
sure
that
the
Score
column
in
blue
includes
the
new
column(s)
in
the
sum.
It
should
do
that

by
default.
Sheet1ASSETATTACK
MODETHREATVULNERABILITYCONSEQUENCETOTALInte
ntCapabilityScoreAchievabilityTarget
HardnessScoreDeath/InjuryEconomic
LossEnvironmentalNational SecuritySymbolicScoreGW
BridgeWater B device by
X100%100%100%10%5%1%100$5,000$500$6,150$30.750%0%
$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.0
00%0%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0
%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.
000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0
%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.000%0%$0$0.
000%0%$0$0.000%0%$0$0.000%0%$0$0.00DEFINITIONS$MI
ntentProbability that a person or gorup would want to do
thisValue per statistical life (VSL)6.5CapabilityProbability that
a person or group would be able to do
thisAchievabilityProbability of successful attack assuming no
security measuresTarget hardnessProbability that the target
cannot withstand the attack (lower =
harder)Death/InjuryNumber of deaths or injuries as a result of
attackEconomic lossEstimated dollar value of loss due to
attackEnvironmental Estimated dollar value of environmental
impactNational securityEstimated dollar value of impact on
national securitySymbolicEstimated dollar value of impact due
to symbolic value of target
WorksheetCARVERAsset Name:GW
BridgeAddress:City:NYCTime needed to replace asset, if
possibleAdditional CI sectors affected by loss of

assetState:Zip:Select Value:County:Owner:Sector:Susceptibility
of asset to damage or destructionImpact of loss of assetSelect
Value:Users Affected:Economic Loss and Rebuild Cost ($):Is
the asset an "icon" representing more than a physical
structurePotential Deaths from Attack:Select Value:Ease of
entry into the asset to cause its damage or destructionPercentage
of "back-up" capacity to offset the loss of this assetSelect
Value:Select Value:SCORE:1225
CRITICALITY
ACCESSIBILITY
RECOVERABILITY
VULNERABILITY
ESPYABILITY
REDUNDANCY
Food & Agriculture
Banking & Finance
Chemical
Commercial Facilities
Communications
Critical Manufacturing
Dams
Defense Industrial Base
Emergency Services
Energy
INTERDEPENDENCY
Government Facilities
Healthcare & Public Health
Information Technology
National Monuments & Icons
Nuclear Reactors, Materials & Waste
Postal & Shipping
Transportation Systems
Water
Menu
ItemsSECTORVALUECRITICALITYVALUEVALUEVALUEFo
od & Agriculture1Less than 1000 people1Less than $10

million1N/A1Banking & Finance2More than 1000 people2Less
than $25 million2102Chemical3More than 10,000 people3Less
than $50 million3503Commercial Facilities4More than 25,000
people4Less than $100 million41004Communications5More
than 50,000 people5Less than $250 million52505Critical
Manufacturing6More than 100,000 people6Less than $500
million65006Dams7More than 500,000 people7Less than $750
million710007Defense Industrial Base8More than 1 million
people8Less than $1 billion850008Emergency Services9More
than 2.5 million people9Less than $25
billion9100009Energy10More than 5 million people10Less than
$50 billion105000010Government
Facilities11100,000+11Healthcare & Public
Health12Information Technology13National Monuments &
Icons14Nuclear Reactors, Materials & Waste15Postal &
Shipping16Transpostation
Systems17ACCESSIBILITYVALUERECOVERABILITYVALU
EVULNERABILITYVALUEWater18Patrolled1Less than 1
month1Special Hardening1Perimeter Fencing2More than 1
month2Massive2Armed Security3More than 3 months3Building
Purpose Unknown to Public3Unarmed Security4More than 6
months4Operations Structurally Dispersed4Access
Control5More than 1 year5Concrete/Stone5Alarm System6More
than 2 years6Structural Steel6Locked Area7More than 3
years7Flammable/Explosive7Open to Public8More than 4
years8Minor Metal Frame8No Control9More than 5 years9Wood
Design9Irreplacable10No Security
Design10ESPYABILITYVALUEREDUNDANCYVALUELocall
y significant, non-government1100%1Locally significant,
government290%2State icon only380%3State icon +
function470%4Regional icon only560%5Regional icon +
function650%6National icon only740%7National icon +
function830%8World icon only920%9World icon +
function1010%100%11
ResultsAsset Name:GW
BridgeAddress:0City:NYCState:0Zip:0County:0Owner:0Sector:

17CriticalityUsers affected625Economic loss9125Potential
deaths510Total160AccessibilityValue70.98RecoverabilityValue
515VulnerabilityValue90.99EspyabilityValue80.955Redundancy
Value60.75SCORE:121.60850625Food &
AgricultureTRUE1Banking &
FinanceFALSE0Chemical0Commercial
FacilitiesFALSE0CommunicationsTRUE1Critical
Manufacturing0Dams0Defense Industrial
BaseTRUE1Emergency
ServicesTRUE1EnergyFALSE0Government
Facilities0Healthcare & Public Health0Information
Technology0National Monuments & Icons0Nuclear Reactors,
Materials & Waste0Postal & ShippingTRUE1Transpostation
SystemsFALSE0Water0INTERDEPENDENCY5
TablesCRITICALITYVALUESCOREVALUESCOREVALUESC
ORELess than 1000 people11Less than $10
million11N/A10More than 1000 people23Less than $25
million231021More than 10,000 people35Less than $50
million7401000725More than 1 million people875Less than $1
billion8755000840More than 2.5 million people9125Less than
$25 billion912510000975More than 5 million people10200Less
than $50
billion102005000010125100,000+11200ACCESSIBILITYVALU
ESCORERECOVERABILITYVALUESCOREVULNERABILITY
VALUESCOREPatrolled10.99Less than 1 month11Special
Hardening10.9Perimeter Fencing20.98More than 1
month23Massive20.9Armed Security30.9More than 3
months35Building Purpose Unknown to Public30.95Unarmed
Security40.95More than 6 months410Operations Structurally
Dispersed40.95Access Control50.95More than 1
year515Concrete/Stone50.96Alarm System60.9More than 2
years625Structural Steel60.96Locked Area70.98More than 3

years740Flamable/Explosive70.97Open to Public80.99More
than 4 years875Minor Metal Frame80.98No Control90.999More
than 5 years9125Wood Design90.991Irreplacable10200No
Security
Design100.999ESPYABILITYVALUESCOREREDUNDANCYV
ALUESCORELocally significant, non-
government10.9100%10.001Locally significant,
government20.990%20.5State icon only30.9280%30.6State icon
+ function40.92570%40.65Regional icon
only50.9360%50.7Regional icon +
function60.93550%60.75National icon
only70.9540%70.8National icon +
function80.95530%80.85World icon only90.9920%90.9World
icon + function100.99510%100.950%111

CARVER CARVER is a methodology first used.docx

More Related Content

More from wendolynhalbert

Recently uploaded

CARVER CARVER is a methodology first used.docx