COMPLETE THESE SPREADSHEETS FOR A KNOWN CRITICAL INFRASTRUCTURE
abbey621
carver_tools_1_.pdf
CARVER CARVER is a methodology first used by the Department of Defense Special Forces to rank targets so that their resources could be used efficiently. The user would estimate Criticality, Accessibility, Recuperability, Vulnerability, Effect, and Recognizability as nominal scores that were added and then ranked. The methodology was later adapted for Homeland Security. The CARVER tool that was used by practitioners had proprietary data tables behind it to weigh user inputs appropriately. This tool makes those tables available so that the user can experiment with weighting and modeling if desired.
Using the Tool For this simple tool, only one asset can be evaluated for each spreadsheet. To evaluate a set of assets, we recommend making a number of copies of the Excel file with one evaluation for each file. All data is input into the Worksheet tab while all the tables are on the Tables tab. The Menu Items and Results tabs are used to store values temporarily and are it is not recommended that users modify these. To begin, input enough data to uniquely identify the asset to be evaluated. This is not used in any calculation so not all is required, but at a minimum, a unique name is helpful. You may also place this asset into a specific sector. Criticality assesses the impact of the loss of this asset. Note that CARVER is not threat mode specific so you are to consider any threat possible.
• Users Affected is not casualties, but rather people impacted by the loss of this asset. If it is a bridge and 100,000 people will not be able to get to work, then these people are affected.
• Economic Loss and Rebuild Cost is and estimate of the financial damage associated with the loss of this asset. Economic loss and rebuild cost are summed together in this estimate, so be sure that if you include economic loss for one asset, you include it throughout your assessment.
• Potential Deaths form Attack is an estimate of casualties associated with an attack on this asset. Again, CARVER is not threat specific so assume worst case scenario.
Accessibility allows you to indicate what security may be in place to limit access to this asset. You may choose from Patrolled, Perimeter Fencing, Armed Security, Unarmed Security, Access Control, Alarm System, Locked Area, Open to the Public, and No Control. Recoverability is the time needed to replace or repair this asset, if possible. Choose an estimate from the menu.
Vulnerability is the susceptibility of this asset to damage or destruction. Ignore anything related to access (we covered that under Accessibility) and focus instead on features of the asset that will help it to withstand or survive an attack.
• Massive refers to the size of the structure. A massive structure, like a major bridge, has low vulnerability due to its size.
• Building Purpose Unknown to Public would be like a water pumping station that looks like a non-‐descript house in a neighborhood.
• Operations Structurally Dispersed would be a facility that has a back-‐up location or can otherwise function without all of its parts operating at the same time.
• Concrete/Stone refers to the structural material used in the asset. • Structural Steel also refers to the structural material used in the asset. • Flammable/Explosive should be selected if either the asset itself burns easily
or if it contains materials that burn easily or are potentially explosive. • Minor Metal Frame again refers to the structural material used in the asset. • Wood Design refers to the structural material used in the asset. • No Security Design means that there is nothing special in the design of this
asset to reduce vulnerability. Espyability refers to whether or not the asset is merely functional or if it has iconic status at the Local, State, Regional, National, or World level. Choose from:
• Locally significant, non-‐government • Locally significant, government • State icon only • State icon + function • Regional icon only • Regional icon + function • National icon only • National icon + function • World icon only • World icon + function
Redundancy is an estimate of the percentage overlap or back-‐up capacity there is to offset the loss of this asset. Interdependency is a list of sectors that might be interdependent with this asset. For example, if this is a power station, it might be interdependent with the water sector, commercial facilities, defense industrial base, etc. Interdependency is not calculated into the CARVER score but is represented by the smaller number in the score. A CARVER score of 122-‐5 means that this asset has a score of 122 with 5 interdependencies. CARVER scores are calculated but are dimensionless. The score does not represent Risk, Resilience, Vulnerability, or anything else. The higher the score, the more likely
that asset may require resourcing. But you cannot say that an asset with a score of 100 is half as important as an asset with a score of 200.
Modifications The best place to experiment with CARVER is in the Tables tab. Here you will see all of the categories we just described here with all of the items in the menus that you can select. Notice that for each menu selection, there is an associated Score. Do not change the Value column. That is there as an identifier for that menu selection. But do experiment with changing the Scores. Should a criticality that impacts 500,000 people (score of 40) be only four times higher than that for 25,000 people (score of 10)? Maybe it should be higher. Experiment with changing scores. Test your configurations with a set of assets to make sure that it makes sense. Does the overall CARVER score go up when you expect it to? Does it decrease when you expect it to? By default, the data tables we provide are all independent but they don’t have to be. You could experiment by having a score linked to another value. For example, what if you wanted the Criticality score to be higher if the Recoverability time was longer? How would you do that?
