SRA 311

Table 6
Corey J.Lee/ CJL234
Michael Castner/ MJC5231

Dr. Glantz
SRA 311_FA10
 Project: UrRISK04

Risk Assessment
I. Introduction

Executive Summary
This document serves as an official risk assessment that systematically identifies and

analyzes threats and vulnerabilities associated with hurricanes in the South Hampton Area of

Virginia Beach, Virginia and offers mitigation strategies. This document will assist government

officials, business owners, and citizens in Virginia Beach by identifying risks related to Hurricanes and

recommending effective controls to mitigate and reduce their impact if they were to occur. The

risks listed in this document, which were identified using the NIST 800-30 document as well as the

CIA Tradecraft Primer, directly impact the Virginia Beach Governments organizational mission which

includes:

1. Protecting all individuals in the area from harm.

2. Preventing damage to the beach and businesses.

3. Maintaining the area’s reputation as a safe place.

The assessment identifies many hurricane-related risks, including a lack of flood control,

insufficient emergency response organizations, low-level of public awareness, and inconsistencies

with the collection of soil erosion data. Proposed mitigation controls included a larger public

outreach program to spread awareness of hurricane / weather emergencies, as well as the

establishment of multiple volunteer emergency response organizations. In regards to soil erosion, it

is suggested that greater care be taken to accurately record and publish the data so that weather

patterns can be readily identified.

2
Project: UrRISK04

Purpose
The purpose of this document is to analyze and assess the present day hazard risks that exist

in Virginia Beach, Virginia due to its proximity to the ocean and thus exposure to the negative effects

of a hurricane. For this document, we will be considering the local Virginia Beach government as the

risk manager and derive our point of view from that perspective [City of Virginia Beach, 1;

Springston / Martz 1]. Thus, we will mainly be concerned with maintaining the safety of our

constituents (citizens of Virginia Beach) and profitability of the area (by minimizing damage to

existing businesses).

After risks have properly been assessed, ranked, and categorized, mitigation strategies will

be offered to the lower either the level of impact or the level of probability with the given issue.

Scope of this risk Assessment

The scope of this risk assessment will include a select number of hazard risks related to

hurricane storms and exclude all others. Our goal is to identify risks that may arise at Virginia Beach,

evaluate their probability of occurrence / impact, and offer potential suggestions for mitigation.

Some example of specific risks would include:

Scope (included)

 Hurricane risk
o Floods
o Wind
o Hail
o Business Interruption
o Loss of Life / Injury

Scope (not included)

 Financial Risk
o Price, liquidity, inflation, hedging, credit
 Operational
o Business functions, leadership, IT availability, data

3
 Project: UrRISK04

 Strategic
o Reputation, Competition, technology, regulatory

II. Risk Assessment Approach

The risk assessment methodology that we will use to conduct the risk assessment on select

natural hazards in Virginia Beach, Virginia will be the same robust methodology that is outlined in

the NIST 800-30 document, with a few complimenting techniques from the CIA Tradecraft Primer.

Our process will encompass the standard NIST Risk Assessment methodology, a multi-step analysis

consisting of the following steps:

1. System Characterization.
2. Threat Identification.
3. Vulnerability Identification.
4. Control Analysis.
5. Likelihood Determination.
6. Impact Analysis.
7. Risk Determination.
8. Control Recommendations.
9. Results Documentation [Stoneburner, 10-26].

Through the observation and extensive evaluation of each of the above risk methodology

steps we aim to complete a detailed risk assessment pertaining to selected hazard risks in Virginia

Beach, Virginia.

For this risk assessment we will be using a quantitative approach to assess the selected

natural hazards in Virginia Beach, as it will best lend itself to analysis and modelling of the given

data. We will be utilizing the “Indicators or Signposts of Change” technique that is outlined in the

Tradecraft Primer, which involves keeping track of observable events and creating plans of action

based on probabilities and trends [Tradecraft Primer, 1]. Due to the observable and largely

unpredictable nature of natural and weather-related risks, a system allowing for constant addition

and analysis of new data will be the most effective way to create a reliable risk assessment. We will

4
Project: UrRISK04

add data to our initially identified areas of focus, and periodically analyze them in conjunction with

the Virginia Beach governing body to create proper responses to the most probable risks.

The team members that will be involved in this risk assessment are Corey Lee and Michael

Castner, both seniors majoring in Security and Risk Analysis at The Pennsylvania State University.

Each team member has had a considerable amount of experience conducting risk assessments and

fully understands what it takes to complete the task at hand. They are also well-versed in data

analysis techniques and probability calculations.

Although there are many sources of information that could be utilized in completing our risk

assessment, we wish to avoid common cognitive fallacies and information overload, and will thus

utilize a small number of publicly available / reviewable sources. Many of our sources will come

from prominent scientific researchers in the fields of Meteorology, Seismology, and Oceanography

(specifically flood, current, and tide analysis), and will involve taking their new findings to

incorporate into our already existing system of analysis. We will utilize both their publications and

their scientific reasoning to help inform our decisions [City of Virginia Beach…, 1].

Finally, a risk scale will be established that will grade each factor on a scale ranging from Low

to Moderate, and then Moderate to High. This will make the risks easier to categorize and

understand for both the participants of analysis, and those who read the end report.

Impact

Threat Likelihood Low(10) Moderate(50) High(100)

High(1.0) 10x1.0= 10(Low) 50x1.0= 50(Mod) 100x1.0=100(High)

Moderate(0.5) 10x.05=5(Low) 50x0.5= 25(Mod) 100x0.5=50(Mod)

Low(0.1) 10x0.1= 1(Low) 50x0.1= 5(Low) 100x0.1= 10(Low)

Risk Scale: This scale provides a visual representation of our risk calculation matrix. All potential risks are rated using this figure.

5
 Project: UrRISK04

III. System Characterization

The system within this experiment will involve three main factors: inputs, processes, and outputs.

The basics of those factors has already been alluded to by describing our risk assessment

methodology, the “Indicators or Signposts of Change” process, which involves taking data from

observable / quantifiable events and analyzing them to see where they fit within the risk analysis.

The new data in this methodology will fall largely under the “inputs” category [Tradecraft Primer, 1].

Specifically, inputs to our system will include:

 Historical / Empirical data of hurricanes in Virginia Beach

 Yearly Weather Forecasts / Almanac information
 Prior risk assessments dealing with similar a similar scope / intent
 Current weather reports from multiple scientific sources
 Current risk plans in place / revisions to plans
 Evacuation protocol
 Business Revenue Reports
 Beach / Property Value Reports
 Beach / Property Damage Reports
 Casualty Reports

Once these inputs have been sorted, the processes in place to analyze the

information will begin. The analytical process will involve both the governing body of

Virginia Beach [Virginia Beach Mitigation Plan Overview, 1] and the risk assessment team

from Penn State. The analysis will follow the NIST 800-30 Guidelines exactly, and will include

the multi-step methodology mentioned in our Risk Assessment Approach [Stoneburner, 10-

26].

After the analysis of data, we will have concrete outputs to describe within the risk

assessment and to the concerned parties. With quality inputs and thorough analysis, we

should be able to provide the following outputs:

 Accurate Predictions of Imminent Hurricanes

 Threat Statement detailing how individual risks should be dealt with
 List of Potential Vulnerabilities (updated as new factors are added, in order to always be
current)
 List of Current and Planned Controls, as well as specific procedures outlined within them

6
 Project: UrRISK04

 Likelihood ratings of risks within scope

 Impact ratings of risks within scope
 Risks and Associated Risk Levels
 Recommended Controls / Procedures
 A detailed and final Risk Assessment Report
A visual diagram of this system can be seen in Attachment #3, included with this document.

IV. Threat Statement

Explanation: The previously defined scope of this risk assessment stated that we are

concerned only with hazards related to hurricanes, particularly those that may occur with

greater frequency in Virginia Beach due to its proximity to the ocean. This segment of the

document will evaluate threat sources that fall into the category of being situations or

methods that may accidentally trigger vulnerabilities [Stoneburner, 12]. Thus, all threat

sources will be natural hazards, and mostly those that are tied to oceanic / water-related issues

[Virginia Beach Mitigation Plan Overview, 8].

Note: There will be no motivations associated with these threat sources, due to their nature.

Threat Sources Threat Actions

Hurricane Damage to Property(vehicles, buildings)
Hurricane Injuries and or Loss of Life
Hurricane Damage to beaches
Hurricane Negative Image Association
Hurricane Loss of Tourism
Hurricane Decline of Real Estate/Market Value
Hurricane Loss of Business availability and/or Business
Assets(fishing boats, ferries, tour boats)
Hurricane Loss of Transportation(ferries, tunnels etc..)

7
 Project: UrRISK04

V. Risk Assessment Results

Observations:

1. No flood control / water diversion systems in place on beach front property

(Associated Threat: Sea level rise due to a Hurricane)
Likelihood Impact Risk
Rating

Medium-High High High

Current Controls: No visible system is in place to protect beachfront property from

water-related damages or to control water-levels in a flood situation.

Recommended Controls: Introduce levy system in places where water-flow analysis

deems to be most effective. Create drainage system of increased capacity to move
water into location that can handle high amounts.

2. No fire department in vicinity

(Associated Threat: Fire caused by a Hurricane)
Likelihood Impact Risk
Rating

Medium Medium- Medium

High

Current Controls: There is no fire department within the Southside Hampton area,
though there is a department north of the area that serves the greater Virginia Beach
Area.

Recommended Controls: Create a volunteer fire department to deal with issues that
need quick response, or prepare an emergency response team for impending natural
disasters.

3. No Hospital / EMS within vicinity

(Associated Threats: Hurricane[human injury / treatment factor])
Likelihood Impact Risk
Rating

High High High

Current Controls: The closest hospital serving the Southside Hampton area is the
Sentara Hospital over 5 miles away from the Primary Area of Concern. EMS also
goes through this hospital.

8
Project: UrRISK04

Recommended Controls: Create volunteer EMS group, perhaps connected with Fire
group, to respond to emergencies happening within Southside Hampton / Surrounding
Areas.

4. Lack of sufficient public awareness and outreach programs

(Associated Threats: Hurricane [human injury/death/]
Likelihood Impact Risk
Rating

High High High

Current Controls: Public outreach and awareness programs exist for natural hazard
emergencies, but there are few of them held throughout the year and they are not
widely available to the public.

Recommended Controls: Hold monthly public awareness and outreach programs

that address the current state of natural hazard emergency preparedness for Southside
Hampton/Surrounding Areas.

5. Lack of accurate shoreline erosion data

(Associated Threats: Hurricane [reduced property value/property loss]
Likelihood Impact Risk
Rating

Medium Medium Medium

Current Controls: Policies are in place to regulate and control eroding areas by
restoring the shoreline through methods such as beach nourishment [Surfrider, 1].

Recommended Controls: Use reliable sources to conduct quarterly shoreline erosion

tests, and surveys to maintain accurate erosion data. This will allow the controls put
in place to be utilized effectively.

9
Project: UrRISK04

6. Lack of accurate data on sea level rise and its effects

(Associated Threats: Flooding caused by a Hurricane)
Likelihood Impact Risk
Rating

Medium High High

Current Controls: County-scale elevation maps are created to illustrate

vulnerabilities to sea level rise using existing data.

Recommended Controls: Conduct bi-weekly sea level rise tests to generate more up
to date data, and create more area specific elevation maps.

10
Project: UrRISK04

Summary

Threat / Vulnerability Risk Mitigation Suggestions

Rating

Flood caused by Hurricane / Lack of flood High - Create Levy system

control - Create Drainage
system
Fire caused by a Hurricane / No fire Medium - Create nearby
department in vicinity volunteer fire dept.

Loss of life or injury / No hospital or EMS in High - Create nearby

vicinity volunteer EMS group

Hurricane / Lack of public awareness High - Conduct monthly

outreach programs emergency
preparedness
programs
Beach Destruction caused by a Hurricane / Medium - Conduct quarterly
Lack of accurate shoreline erosion data tests and surveys on
shoreline erosion
Flood caused by a Hurricane / Lack of Medium - Conduct bi-weekly
accurate data on the effects of sea level rise sea level rise tests
- Develop new up to
date elevation maps
Revised Summary Table – Appendix C, NIST 800-30 –SEE ATTACHMENT 1

11
Project: UrRISK04

References

"City of Virginia Beach Project Impact." ESRI Conference Proceedings. Web. 14 Sept. 2010
.<http://proceedings.esri.com/library/userconf/proc01/professional/papers/pap1067/p1067.htm>.

Deirdre Fernandes. "Beach OKs hurricane upgrades to field house. " McClatchy - Tribune Business News
23 September 2009 ABI/INFORM Dateline, ProQuest. Web. 26 Oct. 2010.

"FEMA: City of Virginia Beach Gets Funds to Reduce Flood Risk." FEMA | Federal Emergency Management
Agency. Web. 14 Sept.2010. <http://www.fema.gov/news/newsrelease.fema?id=8379>.

Rex Springston, and Michael Martz. "All eyes on Hurricane Earl. " McClatchy - Tribune Business News
2 September 2010 ABI/INFORM Dateline, ProQuest. Web. 26 Oct. 2010.

Stoneburner, Gary, Alice Goguen, and Alexis Feringa. "Risk Management Guide for Information Technology
Systems." National Institute of Standards and Technology, July 2002. Web. 28 Sept. 2010.
<http://csrc.nist.gov/publications/nistpubs/800-‐30/sp800-‐30.pdf>.

"Surfrider Foundation's State Of The Beach Report." Surfrider Foundation - Home Page. Web. 14 Sept.
2010.<http://www.surfrider.org/stateofthebeach/05-sr/state.asp?zone=ma&state=va&cat=be>.

"Virginia Beach Mitigation Plan Overview." VBGov. Virginia Beach Government. Web. 13 Sept.
2010.<http://www.vbgov.com/file_source/dept/fire/Document/mitigationplanoverview.ppt>.

12
Project: UrRISK04

Attachment 1 – Fact Sheet

This attachment is a fact sheet that describes the Virginia Beach, Virginia area. The first
source used in this fact sheet explains the characteristics of the City of Virginia Beach and its
major risks due to hurricanes. The second source used in this fact sheet outlines the natural
hazards that occur in Virginia Beach and the level of concern associated with each hazard.

From http://proceedings.esri.com/library/userconf/proc01/professional/papers/pap1067/p1067.htm:

“The City of Virginia Beach is the most populated coastal jurisdiction in Virginia with a population of
450,000 and steady growth. It is a unique jurisdiction in the sense that it maintains both agricultural
and resort sectors in the midst of a thriving urban-suburban community. The city is home to several
military facilities: Oceana Naval Air Station, Dam Neck Fleet Combat Training Center, Little Creek
Amphibious Base, and historic Fort Story. Virginia Beach forms the southern gate to the Chesapeake
Bay Bridge-Tunnel that spans the mouth of the Bay. The city is 310 square miles, of which 258.7
square miles are land and 51.3 square miles are water.”

“The city's major risks stem from hurricane-force winds causing storm surge inundation and coastal
erosion to the 38 miles of shoreline. The city has been impacted by northeasters that have occurred
in 1927, 1948, 1956, 1962 and 1998. FEMA statistics show that the city has 17,191 flood insurance
policies in effect. This constitutes one fourth of all policies in Virginia with coverage totalling
approximately $230 million.”

From http://www.vbgov.com/file_source/dept/fire/Document/mitigationplanoverview.ppt:

Natural Hazards

 Drought
 Earthquake
 Erosion
 Extreme Temperature
 Flood (100-year and Storm Surge)
 Hurricanes and Tropical Storms
 Landslide
 Lightning
 Sinkhole
 Severe Thunderstorms
 Tornadoes
 Tsunami
 Wildfire
 Winter Storms

13
Project: UrRISK04

Attachment 2 - Weather Risks Statistics for Virginia Beach, VA

This attachment describes the weather risk statistics for the Virginia Beach, Virginia area.
The weather risk statistics displayed below represent the average weather risks in six
natural hazard categories based on historical data. Based on this data, hurricane risks are
shown to be the most prevalent having an index score of 312. In conclusion, Virginia Beach
has an average Hurricane risk that is 2 times greater than the national average in the U.S.

Index score (100=National Average) represents the average weather risks in this category
based on historical data.
Index
Earthquake Risk 25 Weather Risk
Score
Weather Risk 195
Earthquake Risk 25
Hail Risk 54
Weather Risk 195
Hurricane Risk 312
Hail Risk 54
Tornado Risk 79

Wind Risk 100 Hurricane Risk 312

Tornado Risk 79

Wind Risk 100

14
 Project: UrRISK04

Attachment 3 – System Characterization Diagram

This attachment is a system characterization diagram of the risk assessment activities pertaining to
this risk assessment. A system characterization diagram outlines the scope, inputs, and outputs of a
risk assessment. The purpose of this diagram is to establish the scope of the risk assessment effort.
This diagram is also known as a risk assessment methodology flowchart.

-Rain Step 1: System Characterization

-Wind Hurricane

-History of natural hazards

-Yearly weather forecasts Step 2: Threat Identification Threat Statement

-Reports from prior

risk assessments List of Potential
-Weather reports Step 3: Vulnerability Identification
Vulnerabilities
V.1.

-Current Controls List of Current

-Planned Controls Step 4: Control Analysis and Planned
-levies, evacuation
Controls

-Threat source motivation

V.2.Capacity
-Threat
Step 5: Likelihood Determination Likelihood Rating
-Nature of vulnerability

-Business Revenue
-Beach Damage Step 6: Impact Analysis Impact Rating
-Casualties

-Likelihood of threat
V.3.
exploitation Risks and
-Magnitude of Impact Step 7: Risk Determination Associated Risk
-Adequacy of planned or Levels
current controls

Step 8: Control Recommendations Recommended

Controls

Risk Assessment
Step 9: Results Documentation
Report

15
Project: UrRISK04

Attachment 4 – [Appendix C, NIST 800-30 Summary Table]

This attachment depicts the Summary Table found in Appendix C of the NIST 800-30 document
which was used as a reference to create the summary table included in this risk assessment. NIST
800-30 is a well-known risk management guide primarily used for information technology systems.
The summary table below displays the recommended approach to summarizing the results of a risk
assessment.

16
Project: UrRISK04

Attachment 5 – Areas of Concern/Geographical Scope

This attachment depicts the areas of concern and the geographical scope for the risk
assessment. The main area of concern for this risk assessment as demonstrated by the
figure below is the South Hampton Area of Virginia Beach, Virginia. As depicted in the figure
below the area levels of concern are the highest near the coastline and the lowest near the
cities center.

This attachment visually demonstrates the geographical scope of our risk assessment, detailing
exactly where in the Virginia Beach area we have chosen to focus our analysis and narrow our scope.

17
 Project: UrRISK04

VI. Grading Rubric

Grading Rubric - Short Essay

Peer Reviewer: Assign total points here for composition, contribution, subject knowledge and
MLA citations. Write specific comments into student’s paper.

Section SRA 311.001

Author1 Name (Print): __________________ Author2 Name (Print): __________________
Peer Reviewer1 Name (Print): ________________ Peer Reviewer2 Name (Print):
________________
Peer Max Instructor Item
Possible
Reviewer Total
Points
Points Points

25 Composition - Business professional writing with no

grammatical or spelling errors.

25 Contribution - Improves class learning by providing new

information or approach to topic under discussion.

25 Subject Knowledge - Knowledge of course content is illustrated

by integrating concepts into the essay. Does it appear that you
know what you are writing about? Are you aware of aspects of
this covered in class?

15 Captions, References and MLA Citations - Reference to article,

book, or magazine where new information or approach is
provided, and appropriate citation in text. Must follow MLA
format!!!

 In-Text: must include page number (assume “1” if not known)

 Works Cited: single-spaced (double between citations) with
hanging indent
 Captions: any tables or figures must include complete
captions
(blank) 10 In-class peer review - Thorough and complete with specific
comments (i.e. NOT "good job" or "great opening") for what has
been done well or what could be done to improve the paper

(blank) 100 Total

18