1. TSA UPDATE
By Colonel Mike Licata

2. TOPICS What Law requires 2. What you can get for free from TSA
How to Protect your company
Risk Reduction Stratgies

3. What Law Requires Security Coordinator Security Assessment
Security Plans
Security Training
Required By law, not currently enforced other than in civil law suits, soon to be mandated by TSA

4. What TSA Can Do for you BASE TSTART (PLAN and ASSESSMENTS) TRAINING
HANDOUTS
OTRB ISAC
THREAT WARNING
GRANTS
EXERCISE

5. How to protect your company
Assess your risk
Write a plan
Train your people
Consider getting a free TSA Agent to assist or a paid consultant
Good Security Program can pay for itself, in grants, loss reduction, and civil protection from law suits

6. Risk Reduction Strategies
How do you define Risk? How do you quantify it in numbers?

7. Risk Formula RISK = Threats X Vulnerability X Consequence
Threats = Terrorist Threats, criminal and Vandals
Vulnerability = How Open a bus is open to an attack (no GPS, No Fence, no security training etc….
Consequence = A Bus Blows up (Horrific) versus Bus gets robbed (bad)

8. Risk Formula RISK = Threats X Vulnerability X Consequence
Threats = worst Threat (5) and least Risk (1)
Vulnerability = No protection (5) and complete protection (1)
Consequence = A Bus Blows up (5) versus Bus gets robbed (1)

9. Risk worst case RISK = Threats X Vulnerability X Consequence
Threats = Terrorist Threats with a Bomb (5)
Vulnerability = Bus stored in a city with no fence, no cameras and no GPS (5)
Consequence = A Bus Blows up (5)
Total Risk (125) = 5 x 5 x 5

10. Risk Best case RISK = Threats X Vulnerability X Consequence
Threats = Stolen Bus (1)
Vulnerability = Bus stored in a fence, well light parking lots with GPS and cameras (1)
Consequence = Loss revenue (1)
Total Risk (1) = 1 x 1 x 1

11. Low risk 1 to 30 Medium Risk (31 to 60) High Risk (61 to 125)
RISK Range ( 1 to 125)
Low risk 1 to 30 Medium Risk (31 to 60) High Risk (61 to 125)

12. Risk Challenge For Industry
Very Subjective depends on the Evaluator No GPS: One evaluator says that is a 5, another a one

13. RISK PROJECT Standardize -- Make it easier to use
-- Make the numbers more meaningful
-- Can be used to get grant funding

14. Grant Funding
FEMA and TSA has agreed to put the numbers together for Threats
We should do Consequences and Vulnerability with standardized Numbers
Consequences of all the bad things that can happen from cyber attack, bus blowing up, active shooters (1 to 5)
Vulnerabilities Grade each protective measure

15. Vulnerabilities
100% Protected bus = 1 No GPS = +1 No Security Training +1/2 No Fence +1/2 No Bus cameras + 1/2 No Security Cameras + 1/2 No Alarm +1/2 No Lighting + 1/2

16. Need Help Volunteers Meet about 4 or 5 times for one hour
Small Company (;less than 50 buses)
Medium Company (more than 50 buses, less than 100)
Large Company: Greater than 100 Buses
NOTE: CYBER PROBLEMS AND VOLUNTEERS

17. Risk Formula RISK = Threats X Vulnerability X Consequence
Threats = Terrorist Threats, criminal and Vandals
Vulnerability = How Open a bus is open to an attack (no GPS, No Fence, no security training etc….
Consequence = A Bus Blows up (Horrific) versus Bus gets robbed (bad)

18. Risk Formula RISK = Threats X Vulnerability X Consequence
Threats = Terrorist Threats, criminal and Vandals
Vulnerability = How Open a bus is open to an attack (no GPS, No Fence, no security training etc….
Consequence = A Bus Blows up (Horrific) versus Bus gets robbed (bad)