Modeling and Simulation of Insider Adversary Scenarios

The use of simulation to support analysis of attack scenarios is a widely accepted means of security analysis within the U.S. Department of Energy. Commercial modeling and simulation (mod/sim) software is being applied for a variety of security applications, particularly for force-on-force combat engagements. Mod/Sim provides a cost-effective way to gather much more data than live experiments. This, in turn, supports analysis of alternatives with respect to PPS upgrades. This scenario development is based on characteristics of a demonstration facility that is being used by Sandia National Laboratories (SNL) for a variety of security training activities. To extend the range of simulation capabilities, an insider scenario has been developed based on an insider analysis method that integrates the evaluation of material control and accounting (MC&A) activities and physical protection system (PPS) elements. In the insider simulation, a “force-on-force” approach was taken to model two key entities – a malicious insider and an operational staff member who is responsible for performing MC&A activities that would provide a “detection capability” for material that has been taken. Additional entities include staff that provide possible observation of malicious insider activity and a facility response force that performs hypothetical activities when an alert indicates that material is missing. Logic rules were developed for insider and staff behaviors situations in which an insider might attempt theft of material. The initial scenario involves theft of an item that could be hand-carried by the adversary and possible detection of anomalous conditions through staff performance of one MC&A operational activity. This paper describes the insider simulation model and associated scenario. It is anticipated that training activities at the demonstration facility will be developed for scenarios with malicious activities by insiders and to consider how operational activities might be used to mitigate these types of scenarios.