Cybersecurity is currently an important and relevant issue, as more and more industries are taking advantage of the accessibility of storing information online. To create a secure system one must know the potential risks and attacks on that system, making risk analysis a very potent tool. In this study, we performed such an analysis using the risk analysis method OCTAVE Allegro on a company providing a cloud-based service to find out what risks a cloud service provider might be exposed to, and the usefulness of said risk analysis method in this circumstance. We found that OCTAVE Allegro is suitable to use on smaller companies and applicable to cloud services, and the most severe risks identified were connected to leakage of client data with a consequence of damaging the company's reputation. Common areas of concern for these risks were third parties hacking the cloud server or other company systems to gain access to sensitive information. Such risks will likely be found at any company providing a cloud service that manages sensitive data, increasing the importance of risk analysis at these companies.

The purpose of this study is to modify an existing static analytical model developed for a Re-circulating Aquaculture Systems through incorporation of risk considerations to evaluate the economic viability of the system. In addition the objective of this analysis is to provide a well documented risk based analytical system so that individuals (investors/lenders) can use it to tailor the analysis to their own investment decisions—that is to collect the input data, run the model, and interpret the results. The Aquaculture Economic Cost Model (AECM) was developed by Dr. Charles Coale, Jr. and others from the department of Agricultural and Applied Economics at Virginia Tech. The AECM is a spreadsheet model that was developed to help re-circulating aquaculture producers make strategic business decisions. The model can be used by potential producers interested in investing in re-circulating aquaculture through development of a financial analysis that in turn will help them obtain funding for the enterprise. The model is also useful for current producers who want to isolate inefficient aspects of their operation. AECM model consists of three major sections which include the Data Entry, Calculations and Analysis. The first section requires that the producer conducts background research about their operation to ensure accurate calculation and analysis. The calculation section provides a great deal of information about the operation's finances, while the analysis section provides information about the operation's financial stability. While the AECM is a powerful model, it is based on single, usually mean, values for prices, costs, and input and output quantities. However, market, financial and production uncertainties result in fluctuating prices, costs and yields. An individual who is making management decisions for a re-circulating aquaculture system will be faced with some or all of these uncertainties. By adding simulation to the AECM model to account for these uncertainties individuals will be able to make better management decisions. Information of the varying likelihoods or probabilities of achieving profits will be of crucial interest to individuals who plan on entering into or modifying an existing aquaculture system. Risks associated with six variables were examined in this paper: feed cost, feed conversion, mortality rate, capital interest rate, final weight, and output price. Data for the Interest Rate and output price were obtained from the Federal Reserve System and NMFS website respectively. Expert opinion was the source of data for the other variables. After probability distributions were applied to the random variables to account for the uncertainty the model was simulated for ten thousand iterations to obtain expected returns for three years in advance that the model calculates an income statement. In addition to that, sensitivity analyses were carried out in order to inform the producer which factors are contributing the most to the profitability of the operation. In this way the producer will have a better idea as to which aspects of the operation to monitor closely and consider modifying. The analysis shows that the mean income for the three years will be negative and thus the business would be losing money. The simulated mean net incomes were: -$216,905, -$53,689, -$53,111 for year1 through year3 respectively. Sensitivity analysis confirmed that output price is by far the most significant input that makes the overall bottom line to fluctuate most. Output price was on top of the list for all the three years analyzed in this study. Feed cost and Feed conversion were the next most significant inputs. The other inputs were also significant in explaining the fluctuation of the bottom line; however both their regression and correlation coefficients were small. / Master of Science

By definition, a system is comprised of hardware, software and "liveware". It also interacts with other systems composed themselves of those elements. However, the "human" element tends to be neglected in many projects, leading to unsafe or inefficient systems. Although some studies have shown that sociotechnical approaches to project management can generate economic gains of 20%, not to mention social gains, in practice, few projects integrate human factors correctly. Many reasons can explain this lack of integration. Humans alone are much more difficult to model and understand than technology. When considering groups or organizations, the problem increases exponentially. Hence, traditional engineering and risk management methods cannot be used to address the human side of a system. There exist approaches and methods to use our current understanding of human behavior, however these tend to be understood and used only by a small number of specialists. Most project managers, designers and engineers have insufficient knowledge of their existence or do not understand how to make good use of them. There are two major challenges in the integration of human factors. The first one is to justify an interest in such an approach. Given the educational background and experience of many engineers, this is no easy task. The SNCF (French Railways) has chosen to face this challenge and achieved quite good results. However, this does not solve the problem, as project managers and engineers then request tools and methods. Fulfilling this need represents the second challenge. This is the subject of this study: to make a shift from technology-centered approaches to design and risk management to a more sociotechnical approach thanks to a macroergonomics project framework. Human factors engineering and ergonomics is a multi-disciplinary domain. It goes from human resources management to physical ergonomics and integrates such subjects as psychology, sociology and human reliability. To improve the reliability or efficiency of systems, one approach is to develop a single tool addressing one aspect of human factors or integrating it with one kind of activities. However, many of those tools already exist, even if they have remained at the state of research results yet or been applied only in some very specific sectors. Hence, for this research, it was decided to develop a method that covers the whole process of a project and contains the different considerations related to human factors as well as the activities required to ensure the safety of the system. Recent research led by the US Army and adapted by the UK and Canadian Armies as well as Eurocontrol have lead to the emergence of a new discipline called Human Factors Integration (HFI). This discipline proposes a project management process that covers different domains of human factors: manpower, personnel, training, ergonomics, safety, health and hazards, survivability. HFI is a good starting point but it responds only partly to our expressed need. Indeed, the SNCF requires a more general approach, easily accessible, with a greater emphasis on organization and risk management. During this study, the HFI method was extended based on recent research results, especially in human and organizational reliability. The main improvements made are the addition of the "organization" domain and the development of safety-related activities. Many other principles were also integrated including barriers, prescribed vs. real tasks, redundancy, recovery, degraded situation, system dynamics and measurement. Some interests of this method are its inheritance from systems engineering, its capacity to be utilized by users from different cultures and experience, and its independence from specific models of human behavior or task processing. The main output of the study is a documentation of this method defining the activities and tasks for each phase of the project as well as the composition of the team. The method was evaluated based on its application on the "Sécurité des Travaux Organisation Réalisation Préparation" (STORP) project. This project aims at redesigning the infrastructure maintenance system of the SNCF, modifying the concepts, principles, guidelines and documentations, in order to improve its efficiency and safety. This application enabled to test the coherence and usability of the method, as well as highlight its main advantages, while underlining and improving the human factors integration in STORP. Through this evaluation, this study constitutes one of the first attempts to apply HFI to a non-military domain and to non-specific projects. / Master of Science

"Over the years, risk analysis methodologies have been developed and implemented by many industries. NASA has implemented a cost efficient Continuous Risk Analysis methodology with good results. The U. S. Department of Transportation also states that a continuous risk analysis is the key in identifying, addressing, and handling risks before they become threats to success. However, current practices seldom incorporate this concept into real transportation projects. In general, risk is simply disregarded in feasibility studies. One of primary reasons is the lack of a feasible and effective risk analysis approach to guide efficient implementation in real projects. This thesis reviews current risk analysis practices used in public transportation projects. Using a case study, it also explores potential obstacles encountered in the implementation of systematic risk analysis. Finally, this thesis presents a preliminary risk analysis framework developed through the case study and enriched subsequently by incorporating material documented in the literature. The proposed risk analysis approach is to help achieve continuous risk analysis in transportation projects by enabling early start, frequent implementation, extensive application and flexible adoption."

Risk management is a process through which organizations are methodically devoted to the risks associated with their activities in order to get the biggest benefit from their business. It is also a rapidly developing field, where there is a variety of different approaches, methods, methodologies and standards in which may be little confusing. Therefore, this work offers a comprehensive and systematic view on the issue of risk analysis and management. Risk analysis is a cornerstone for effective security management of each company used for identification, description and quantification of risks, which should lead to acceptance of suitable measures for risk treatment. That is the reason why it requires a careful and methodical procedure described in this work. The main objective of this work is to analyse different approaches to risk analysis and management and thus highlight the importance of information security and protection of corporate assets. This approaches need to be understood as a different levels of detail of conducted risk analysis which will depend on initial maturity level (according to the CMM -- Capability Maturity Model) of information security process. The theoretical part of this thesis will explain relevant methodologies, techniques and procedure of risk analysis based on the ISO 27005 standard. From this part reader should learn what risk analysis is, what is it used for, how can it be carried out and what standards and methods can be used. The practical part will solve a real risk analysis project, which will demonstrate application of information obtained in the theoretical part.

Orientadores: Elizabete Jordão, Vanderley de Vasconcelos / Dissertação (mestrado) - Universidade Estadual de Campinas, Faculdade de Engenharia Quimica / Made available in DSpace on 2018-08-08T02:59:27Z (GMT). No. of bitstreams: 1 Reis_HelioGervasio_M.pdf: 779503 bytes, checksum: c8238dcf1afddbfefe23a43639dff543 (MD5) Previous issue date: 2007 / Resumo: A partir da Resolução CONAMA n° 001/86, para o licenciamento de atividades modificadoras do meio ambiente, o Estudo de Análise de Riscos ¿ EAR passou a ser um dos documentos técnicos exigidos de forma que, além dos aspectos relacionados com a poluição, também a prevenção dos acidentes operacionais fosse contemplada no processo. São exemplos de atividades sujeitas a exigências de Estudos de Análise de Riscos: extração e beneficiamento de minérios; indústrias químicas e petroquímicas; produção e distribuição de energia elétrica; transporte, terminais e depósitos de materiais perigosos. Os requisitos mínimos para os EARs são normalmente definidos pelos órgãos ambientais competentes, dos diferentes estados da Federação, através do estabelecimento dos Termos de Referência. No caso do licenciamento de instalações nucleares e radiativas a CNEN (Comissão Nacional de Energia Nuclear) é partícipe no processo de licenciamento ambiental. Dentro dos Relatórios de Análise de Segurança de tais instalações a CNEN exige a apresentação de uma análise de risco de acidentes. No entanto, o escopo, a abrangência e os critérios para isenção da obrigatoriedade de realização de avaliações de risco não são claramente definidos por estes órgãos. O objetivo deste trabalho é avaliar as exigências legais em relação a análises de risco, bem como propor uma abordagem para o seu atendimento. Foram analisados dois Termos de Referência, de órgãos ambientais de dois estados da Federação ? CETESB (SP) e FEPAM (RS). Seus critérios foram comparados usando diferentes cenários de acidentes, envolvendo diferentes substâncias perigosas, quantidades e distância da população. Foi avaliado sob quais condições um dos critérios se torna mais conservativo que o outro. A abordagem proposta considera os aspectos determinístico e probabilístico da avaliação de risco e sugere o uso do Princípio da Precaução para auxiliar o processo de tomada de decisões envolvendo a análise e o gerenciamento de risco realizados / Abstract: According to CONAMA nr. 001/86 it is required, for licensing purposes, a Risk Analysis Study ? RAS of the activities that can harm the environment. Thus, not only the pollution questions should be considered in licensing process, but also the accident prevention and mitigation. Milling and mining, chemical and petrochemical industries, electric power generation and distribution, and handling, storage and transport of hazardous materials are examples of activities that should provide RAS to the environmental bodies. The minimal requirements of RAS are normally defined in different Reference Terms by the regulatory bodies of the states of Federation. In the case of nuclear and radioactive facilities both the environmental bodies and CNEN (Brazilian Nuclear Energy Commission) conduct the licensing process. Inside Safety Analysis Reports of such facilities it is required by CNEN the presentation of an accident risk analysis. However, neither the scope nor the exemption criteria for risk analysis are clearly defined. The purpose of this present work is to evaluate the legal requirements for accident risk analysis and propose an approach to comply them. Two different Reference Terms, from environmental bodies of São Paulo and Rio Grande do Sul (CETESB and FEPAM, respectively), were analyzed. They were compared using different accident scenarios, including different hazardous materials, quantities and population distances. It was verified the conditions that make one more conservative than the other. The deterministic and probabilistic approaches are considered and it is proposed the use of the Precaution Principle in order to help the decisions about the scope and completeness of the risk analysis and management / Mestrado / Sistemas de Processos Quimicos e Informatica / Mestre em Engenharia Química

Environmental risk assessment in industrial enterprise is important part of safety documentation required by legislation of the Czech Republic and of the EU. Despite that, there is given less attention to this part of risk analysis in the Czech Republic, than in the other countries of EU. Importance of this part is evident for a number of significant industrial accidents with impact to the environment. This Master’s thesis deals with the methods used in safety engineering for the environmental risk assessment, according to Act No. 59/2006 Coll., on the prevention of major accidents, as amended by later regulations. The thesis is divided into theoretical and practical part. Theoretical part includes the legislative summary of Act No. 59/2006 Coll. on the prevention of major accidents, as amended by later regulations and requirements for owners, which result from this law. Further, the frameworks for environmental risk assessment in the EU and USA were evaluated and compared. Main part deals with the characteristics of selected (most commonly used in practice) methods for environmental risk assessment, evaluation of its usability and creation of compact process for environmental risk assessment in industrial enterprise in accordance to legislative requirements. In the final part, there is performed application of suggested process for environmental risk assessment in the concrete industrial enterprise.

This thesis is about the risks, what is the risk and what methods exist for risk analysis with the focus on HAZOP, FMEA, ETA and FTA. At the end of the thesis is described RTC system, design and inpmelentation of extesion for the system.

Wave energy as an industry is yet to emerge as a reliable energy technology. As of now, no wave energy device is said to be a commercial success. Survival in the harsh ocean environment, the low frequency of waves and the variability of wave resources are the basic challenges that a wave power concept or a developer has to overcome. In addition to these challenges, there are number of other barriers such as economic and regulatory risks which hinder the development. A number of concepts or devices have failed one after another, to be commercially successful. Many of the failures were due to economic reasons and others were due to technical or environmental factors. Mistakes or failures can be repeated if they are not shared within the industry. This thesis attempts to identify the barriers to wave energy concepts and to analyse them qualitatively.  Efforts have been taken to include the previous instances of failures and their causes so as to avoid them in future. The data was collected through literature review of published papers, reports, news articles and through a survey which was distributed among  experts in the industry and academia.  It can be seen that one barrier can trigger others and that they are interconnected. In the same way, solving one barrier can clear the others too. The risks faced by wave energy technologies are identified, analysed and some mitigation methods are discussed.

Water distribution system utilities must be able to maintain a system’s assets (i.e., pumps, tanks, water mains, etc.) in good working condition in order to provide adequate water quantity and quality to its customers. Various asset management approaches are employed by utilities in order to make optimal decisions regarding the renewal of system components. Part of a good asset management approach is performing a comprehensive risk analysis which consists of considering all potential ways in which the system may fail, the likelihood failure of for each scenario, and the consequences of said failure. This study investigates a water distribution system’s risk of failure due to both acute transient events (e.g., pump trip) and standard pressure fluctuations due to daily system operations. Such an analysis may be useful in optimal decision making such as asset monitoring, scheduling of condition assessments or system renewal projects, policy implementation, and investment priorities in order to keep the utility’s total costs at a minimum. It may also be useful as a precautionary measure to help prevent catastrophic failures such as large main blowouts for which the utility would incur substantial costs, both direct and indirect. As part of this thesis, a database of water distribution system models is used to analyze the effects of an acute transient event for different system configurations. The database was created at the University of Kentucky and has been made available to the research community to test newly developed algorithms for various studies including optimal system operations and optimal system design.