CARVER
CARVER is a methodology first used by the Department of Defense Special Forces to rank targets so that their resources could be used efficiently.
The user would estimate Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizability as nominal scores that were added and then ranked.
The methodology was later adapted for Homeland Security. The CARVER tool that was used by practitioners had proprietary data tables behind it to weigh user inputs appropriately. This tool makes those tables available so that the user can experiment with weighting and modeling if desired.
Using the Tool
For this simple tool, only one asset can be evaluated for each spreadsheet. To evaluate a set of assets, we recommend making a number of copies of the Excel file with one evaluation for each file. All data is input into the Worksheet tab while all the tables are on the Tables tab.
The Menu Items and Results tabs are used to store values temporarily and are it is not recommended that users modify these.
To begin, input enough data to uniquely identify the asset to be evaluated. This is not used in any calculation so not all is required, but at a minimum, a unique name is helpful. You may also place this asset into a specific sector.
Criticality assesses the impact of the loss of this asset. Note that CARVER is not threat mode specific so you are to consider any threat possible.
• Users Affected is not casualties, but rather people impacted by the loss of this asset. If it is a bridge and 100,000 people will not be able to get to work, then these people are affected.
• Economic Loss and Rebuild Cost is and estimate of the financial damage associated with the loss of this asset. Economic loss and rebuild cost are summed together in this estimate, so be sure that if you include economic loss for one asset, you include it throughout your assessment.
• Potential Deaths form Attack is an estimate of casualties associated with an attack on this asset. Again, CARVER is not threat specific so assume worst case scenario.
Accessibility allows you to indicate what security may be in place to limit access to this asset. You may choose from Patrolled, Perimeter Fencing, Armed Security, Unarmed Security, Access Control, Alarm System, Locked Area, Open to the Public, and No Control.
Recoverability is the time needed to replace or repair this asset, if possible. Choose an estimate from the menu.
Vulnerability is the susceptibility of this asset to damage or destruction. Ignore anything related to access (we covered that under Accessibility) and focus instead on features of the asset that will help it to withstand or survive an attack.
• Massive refers to the size of the structure. A massive structure, like a major bridge, has low vulnerability due to its size.
• Building Purpose Unknown to Public would be like a water pumping station that looks like a non--descript house in a neighborhood.
• Operations Structurally Dispersed would be a facility that has a back--up location or can otherwise function without all of its parts operating at the same time.
• Concrete/Stone refers to the structural material used in the asset.
• Structural Steel also refers to the structural material used in the asset.
• Flammable/Explosive should be selected if either the asset itself burns easily or if it contains materials that burn easily or are potentially explosive.
• Minor Metal Frame again refers to the structural material used in the asset.
• Wood Design refers to the structural material used in the asset.
• No Security Design means that there is nothing special in the design of this asset to reduce vulnerability.
Espyability refers to whether or not the asset is merely functional or if it has iconic status at the Local, State, Regional, National, or World level. Choose from:
• Locally significant, non--government
• Locally significant, government
• State icon only
• State icon + function
• Regional icon only
• Regional icon + function
• National icon only
• National icon + function
• World icon only
• World icon + function
Redundancy is an estimate of the percentage overlap or back--up capacity there is to offset the loss of this asset.
Interdependency is a list of sectors that might be interdependent with this asset. For example, if this is a power station, it might be interdependent with the water sector, commercial facilities, defense industrial base, etc. Interdependency is not calculated into the CARVER score but is represented by the smaller number in the score. A CARVER score of 122--5 means that this asset has a score of 122 with 5 interdependencies.
CARVER scores are calculated but are dimensionless. The score does not represent Risk, Resilience, Vulnerability, or anything else. The higher the score, the more likely that asset may require resourcing. But you cannot say that an asset with a score of 100 is half as important as an asset with a score of 200.
Modifications
The best place to experiment with CARVER is in the Tables tab. Here you will see all of the categories we just described here with all of the items in the menus that you can select. Notice that for each menu selection, there is an associated Score. Do not change the Value column. That is there as an identifier for that menu selection. But do experiment with changing the Scores.
Should a criticality that impacts 500,000 people (score of 40) be only four times higher than that for 25,000 people (score of 10)? Maybe it should be higher.
Experiment with changing scores. Test your configurations with a set of assets to make sure that it makes sense. Does the overall CARVER score go up when you expect it to?
Does it decrease when you expect it to? By default, the data tables we provide are all independent but they don't have to be.
You could experiment by having a score linked to another value. For example, what if you wanted the Criticality score to be higher if the Recoverability time was longer? How would you do that?
Multi--Criteria Assessment Methodology
This multi--criteria tool is an example of a simple risk--based model that assesses assets independently but with multiple measures. For this example, we used a subset of the MSRAM model, at least in the way MSRAM models risk and its components.
Description
Asset is a unique name of the asset to be evaluated.
Attack Mode is a description of the type of attack being considered. Multiple attack modes can be considered for any asset.
We consider Asset + Attack Mode as the key data pair that uniquely identifies one assessment. An electrical switching station could be paired with an explosive device, a SCADA attack, or other mode, each of which would be considered separately.
We use the standard equation for Risk
R = T * V * C where
T is Threat, V is Vulnerability, and C is Consequence. The components of each is described below.
Threat is the percentage product of Intent and Capability.
• Intent is the probability that a person or group would want to damage or destroy this asset. High intent would imply knowledge of an impending attack or a credible threat.
• Capability is the probability that a person or group would have the capability to execute this attack. Note that this requires an attack mode. The capability of a group to obtain small explosives is likely to be higher than their capability to obtain radioactive material.
Vulnerability is the percentage product of Achievability and Target Hardness.
• Achievability is the probability of successful attack assuming no security measures. Do not consider existing security features such as fencing, key card control, CCTV, etc. Assume that this person or group gains access to this asset with a small explosive device (for example). What is the likelihood that it would successfully disable the asset?
• Target Hardness is the probability that the target cannot withstand the attack. Note this implies that a lower value means a harder target. An asset with stand--off barriers and physical patrols would have a lower target hardness value than one with only light fencing.
Consequence is the sum of all consequence category estimates. All categories must be translated to a single unit (e.g. dollars, millions of dollars, lives).
• Death/Injury is the number of casualties that would be expected as a result of this attack on this asset. We use a value per statistical life (VSL) of $6.5M but this can be adjusted.
• Economic Loss is the estimated value of loss due to attack. This should include the damage to the asset itself but could also include "downstream" economic damages. For example, if a bridge is disabled, the cost to repair the bridge could be added to the estimated loss of commerce over the time it takes to repair the bridge to estimate this value. It is important to be consistent throughout all entries in this column.
• Environmental is the estimated value of the environmental impact of this attack on this asset. If there is no environmental impact, then this can be zero.
In cases where a post--event clean up must be performed, as would be the case in a radiological, chemical, or biological attack, this could be very high.
• National Security is the estimated value of the impact of this attack on this asset on national security. An attack on a port facility, for example, might have a large impact national security, whereas an attack on a water treatment plant may have a smaller estimated value.
• Symbolic is the estimated value of impact due to the symbolic value of this target. Damage to an iconic bridge would be estimated higher than a generic bridge. Damage to a national monument would have value here where it may not have value elsewhere.
Total is the Risk calculation for this Asset--Attack Mode pair. It is computed, not input by the user. Assuming that consequence values were given in dollars, then the Risk calculation is also in dollars.
You may use the Sort function in Excel to sort the table on Total in order to quickly identify the Asset--Attack Mode pairs with the highest calculated Risk.
Modifications
This simple tool was built with the intention that it would be modified to meet specific uses.
1. If the components of T, C, or C are not desired, then the user may directly input percentage values (0--100) in columns E or H. For consequence, a C can be directly input into column N or any of the columns I through M may be discarded if not needed. The tool will sum what values are given.
2. If you wish to add another component to Threat or Vulnerability, you may do so by adding a new column under that category, in either the red or yellow regions. Make sure that you adjust the Score column to include the new column. Also make sure that the new component is a percentage value so that it can be multiplied without affecting the other components.
3. You may also add components to Consequence easily. Add a column into the blue region, and make sure that the Score column in blue includes the new column(s) in the sum. It should do that by default.
Attachment:- Multi-Criterion_Workshop.rar