Design Reviews Versus Vulnerability Assessments for Physical Security
Vulnerability assessments aim to identify security flaws and likely attack scenarios in order to improve security, but they can be challenging for security managers due to fears about vulnerabilities being uncovered. Design reviews provide a less frightening alternative that still allows for security improvements. A design review briefly reviews design issues and offers recommendations, while identifying fewer vulnerabilities than a full assessment. However, about half of organizations that do a design review later pursue a more comprehensive vulnerability assessment once they see the initial results. The author suggests design reviews or market analyses as ways to introduce vulnerability issues in a palatable manner for hesitant organizations.
![Journal of Physical Security 12(3), 30-32 (2019)
30
Viewpoint Paper
Design Reviews Versus Vulnerability Assessments for Physical Security*
Roger G. Johnston, Ph.D., CPP
Right Brain Sekurity
http://rbsekurity.com
A Vulnerability Assessment (VA) involves identifying and perhaps testing/demonstrating
security flaws and likely attack scenarios, then recommending changes to how the security
device, system, or program is designed or used. This is done in hopes of improving
security.
Getting security managers and organizations to pursue a VA can be challenging. For one
thing, VAs often get confused with other, more familiar and comfortable analysis
techniques which either (1) aren't primarily about vulnerabilities at all, or (2) that do have
something minor to say about vulnerabilities but aren't typically very good at profoundly
uncovering new vulnerabilities.[1,2] For example, a VA is not a “test” or a “certification”
process for a security product or program. It is something quite different from “Red
Teaming”, penetration testing, security surveys, Threat Assessments, Risk Management,
fault/event trees, and Design Basis Threat—though these things might well be worth doing.
Another impediment to arranging for VAs is that are typically time-consuming and
relatively expensive. This is especially true given that VAs should ideally be done period-
ically and iteratively from the earliest design stage through marketing and deployment of a
new security product, system, strategy, or program.
Perhaps more daunting, VAs are often feared by security managers and organizations
because an effective VA will inevitably uncover multiple vulnerabilities. In my view, this is
the wrong mindset for thinking about security, but it nevertheless is quite common.
Finding a vulnerability is actually good news because vulnerabilities are always present in
large numbers, and finding one means we can potentially do something about it. Moreover,
it is my experience that serious vulnerabilities can often be mitigated or eliminated with
simple changes to the design of a security product/program, or how it is used. But the
security improvements aren’t possible if the vulnerabilities go unrecognized!
I have found that many security managers and organizations are much more comfortable
with a “Design Review”, rather than a Vulnerability Assessment. Arranging for a review of
the design of a security product, system, strategy, or program is more familiar—and a
whole lot less scary—than targeting security flaws. In a Design Review, there is a brief
________________
*This paper was not peer reviewed.](https://image.slidesharecdn.com/designreviews2020-200201160648/85/Design-Reviews-Versus-Vulnerability-Assessments-for-Physical-Security-1-320.jpg)
