A portfolio approach to security risk assessments

The Common Risk Model for Dams (CRM-D), described here, was developed as a result of collaboration between the US Army Corps of Engineers and the US Department of Homeland Security. It is used for security risk assessment of dams, navigation locks, hydro projects, and similar infrastructure. The method provides a systematic approach for evaluating and comparing security risks across a large portfolio. Risk is calculated for attack scenarios (specific adversary using a specific attack vector against a specific target) by combining consequence, vulnerability, and threat estimates in a way that accounts for the relationships among these variables. The CRM-D can effectively quantify the benefits of implementing a particular risk mitigation strategy and, consequently, enable return-on-investment analyses for multiple mitigation options across a large portfolio.