The risk analysis process is the foundation of creating secure systems. An accurate and well defined risk analysis will therefore be a big help for any company, indicating what resources are needed and where they should be put to use. It can be difficult to know which risk analysis methodology to use given a set of parameters such as available resources, time, money etc. In this review we will introduce several different risk analysis methodologies and classify them using our risk analysis classification system. Our classification points out some of the pros and cons for each method, making it easier to choose the one best suited for a specific scenario. We will also connect the presented methods with real-world usage of said methods. To do this we have conducted interviews with IT-security experts at several major companies and we will present previous documented usage of risk analysis methods. Larger companies tend to develop their own methods for risk analysis, and smaller companies that do not have enough time or resources to develop their own methods are more likely to use already existing methods. With that said we believe that anyone that works with risk analysis could have use of our review.

This diploma thesis deals with the risks of managing the course of the order in a selected company. It is a production plant of a globally operating concern in the automotive industry, focused on the production of lights. The thesis is divided into three parts. In the first part of the thesis is presented theoretical background based on the literature related to the selected topic. The next part is an analysis of the current situation, which contains a description of the company, a description of order processing in the company and an analysis of the risks that may occur in the selected process. The design part is supposed to propose measures that will lead to minimization of the most serious risks.

No description available.

The explosive growth of the Internet of Things ecosystem has thrust these devices into the center of our lives. Unfortunately, the desire to create these devices has been stronger than the one to secure them. Recent attacks have shown us ignoring security in Internet of Things devices can cause severe harm in both a digital and physical sense. This thesis outlines a framework for developers and managers to assess the risk of IoT devices using a weighted scoring system across five different categories. Our case studies suggest that devices with higher security considerations have a better security posture and lower risk than those without.

In recent years studies have been conducted which suggest that taking an architecture first approach to managing large software projects can reduce a significant amount of the uncertainty present in project estimates. As the project progresses, more concrete information is known about the planned system and less risk is present. However, the rate at which risk is alleviated varies across the life-cycle. Research suggests that there exists a significant drop off in risk when the architecture is developed. Software risk assessment techniques have been developed which attempt to quantify the amount of risk that varying uncertainties convey to a software project. These techniques can be applied to architecture specific issues to show that in many cases, conducting an architecture centric approach to development will remove more risk than the cost of developing the architecture. By committing to developing the architecture prior to the formal estimation process, specific risks can be more tightly bounded, or even removed from the project. The premise presented here is that through the process of architecture-centric management, it is possible to remove substantial risk from the project. This decrease in risk exceeds that at other phases of the life-cycle, especially in comparison of the effort involved. Notably, at architecture, a sufficient amount knowledge is gained by which effort estimations may be tightly bounded, yet the project is early enough in the life-cycle for proper planning and scheduling. Thus, risk is mitigated through the increase in knowledge and the ability to maintain options at an early point. Further, architecture development and evaluation has been shown to incorporate quality factors normally insufficiently considered in the system design. The approach taken here is to consider specific knowledge gained through the architecting process and how this is reflected in parametric effort estimation models. This added knowledge is directly reflected in risk reduction. Drawing on experience of architecture researchers as well as project managers employing this approach, this thesis considers what benefits to the software development process are gained by taking this approach. Noting a strong reluctance of owners to incorporate solid software engineering practices, the thesis concludes with an outline for an experiment which goes about proving the reduction in risk at architecture exceeds the cost of that development. / Master of Science

This thesis describes the work of investigating and developing Arctic Paper Grycksbo’s work environment work, focusing on their use of the Paper industry’s information system on work environment (Pappersindustrins Informationssystem om Arbetsmiljö, PIA). The work took place between January and June 2018 as a final part of the Master Programme in Industrial Design Engineering at Luleå University of Technology. The client of the project was Arctic Paper Grycksbo, one of three paper mills in the Arctic Paper Group. The work began with a literature study where areas such as production design, safety, work environment management, risk analysis, etc. was covered. Subsequently, a comprehensive survey of the PIA system was conducted in parallel with a survey of the company’s overall work environment management. This resulted in a clear picture of how the system is used, the role of the system in the work environment management and where there were shortcomings in the work being done today. An  identified deficiency was that the quality of investigations of the reported events varied a lot depending on who performed the investigation, another identified deficiency was that there were a number of delayed events that appeared to be investigated and corrected but wasn’t marked as done in the system. To investigate how other companies use the system, a benchmarking was conducted where companies using any variant of the system got to answer how they use the system and what they like about the system. Based on the investigation of the system, Arctic Paper Grycksbo’s use of the system and the use of the benchmarked companies, six areas for improvement was identified, such as the uneven quality of investigation, the delayed events, their use of the risk management module and their analysing of the information in the system. When the areas of improvement were identified, the work was continued to develop how they could improve their use of PIA. First, six of the former benchmarked companies were contacted for more detailed interviews about how they use the system. Based on the deeper benchmarking, the theoretical framework and the areas where Arctic Paper Grycksbo can improve, new routines for Arctic Paper Grycksbo’s use of PIA was developed. As part of the routines, recommendations and instructions for statistics were also developed that they should begin to follow in the system. Arctic Paper Grycksbo is recommended to start following eight safety indicators, three leading and five lagging, and seven trends regarding the characteristics of accidents and incidents. The possibilities in the system are huge and there is a great potential to use it for most parts of the work environment work if you only set the time from the beginning and are aware that it requires some active work. / Det här examensarbetet beskriver arbetet med att undersöka och utveckla Arctic Paper Grycksbos arbetsmiljöarbete med fokus på deras användning av Pappersindustrins Informationssystem om Arbetsmiljö (PIA). Arbetet pågick mellan januari och juni 2018 som en avslutande del på civilingenjörsprogrammet Teknisk Design på Luleå Tekniska Universitet. Uppdragsgivare var Arctic Paper Grycksbo, ett av tre pappersbruk i Arctic Paper koncernen. Arbetet inleddes med en litteraturstudie där områden som produktionsdesign, säkerhet, arbetsmiljöarbete, riskanalys, m.m. behandlades. Därefter genomfördes en omfattande undersökning av PIA-systemet parallellt med en undersökning av företagets övergripande arbetsmiljöarbete. Detta resulterade i en tydlig bild av hur systemet används, systemets roll i arbetsmiljöarbetet och var det fanns brister i arbetet som görs idag. En brist som identifierades var att kvaliteten på utredningarna av de rapporterade händelserna varierade mycket beroende på vem som utfört utredningen, en annan brist som identifierades var att det fanns ett flertal förfallna händelser som såg ut att vara utredda och åtgärdade men saknade klarmarkering i systemet. För att undersöka hur andra företag använder systemet gjordes en benchmarking där företag som använder någon variant av systemet fick svara på hur de använder systemet och vad de tycker om systemet. Baserat på undersökningen av systemet, Arctic Paper Grycksbos användning av systemet och de benchmarkade företagens användning av systemet identifierades sex områden där de kan förbättra och utveckla sin användning av systemet, så som den ojämna kvaliteten på utredningarna, de förfallna händelserna, deras användning av riskhanteringsmodulen och deras användning av informationn i systemet. När förbättringsmöjligheterna var identifierade fortsatte arbetet med att utveckla hur de kan förbättra sig. Först så kontaktades sex av de tidigare benchmarkade företagen för mer detaljerade intervjuer av hur de använder systemet. Utifrån den djupare benchmarkingen, den teoretiska referensramen och de områden där Arctic Paper Grycksbo kan förbättra sig, utvecklades nya rutiner för användningen av PIA. Som en del av rutinerna utvecklades även rekommendationer och instruktioner för statistik de bör börja följa i systemet. Arctic Paper Grycksbo rekommenderas börja följa åtta säkerhetsindikatorer, tre ledande och fem eftersläpande, och sju trender gällande olyckornas och tillbudens egenskaper. Möjligheterna i systemet är enorma och det finns stor potential att nyttja det till de flesta delar av arbetsmiljöarbetet om man bara lägger tiden på det från början och är medveten om att det kräver visst aktivt arbete.

Quantitative risk analysis (QRA) is widely applied in several industries as a tool to improve safety, as part of design, licensing or operational processes. Nevertheless, there is much less academic research on the validity and validation of QRA, despite their importance both for the science of risk analysis and with respect to its practical implication for decision-making and improving system safety. In light of this, this paper presents a review focusing on the validity and validation of QRA in a safety context. Theoretical, methodological and empirical contributions in the scientific literature are reviewed, focusing on three questions. Which theoretical views on validity and validation of QRA can be found? Which features of QRA are useful to validate a particular QRA, and which frameworks are proposed to this effect? What kinds of claims are made about QRA, and what evidence is available for QRA being valid for the stated purposes? A discussion follows the review, focusing on the available evidence for the validity of QRA and the effectiveness of validation methods.

Master of Science / Department of Mechanical Engineering / Donald L. Fenton / This project was done to determine the effectiveness of different methods of mitigating the effects of an ammonia release through a pressure relief device in an ammonia refrigeration system. Several methods were considered, and five were selected for further study. The methods chosen for further study were discharge into a tank containing standing water, discharge into the atmosphere, discharge into a flare, discharge into a wet scrubber, and an emergency pressure control system. Discharge into a tank containing standing water is the most common method in existence today but several people in the ammonia refrigeration industry have questioned its reliability. The methods were compared based on a quantitative risk analysis, combining failure rates of each system with ammonia dispersion modeling and the monetized health effects of a system’s failure to contain an ammonia release. It was determined that the release height had a greater influence on the downwind cost impact than any other variable, including weather conditions and release from multiple sources. The discharge into a tank containing standing water was determined to have the lowest failure rate, while the flare system was found to be the most effective in terms of relative overall release consequent cost. The emergency pressure control system is now required by the codes, and any of the other mitigation systems would be very effective when used in conjunction with the emergency pressure control system.

Glacial-dominated areas pose unique challenges to downstream communities in adapting to recent and continuing global climate change, including increased threats of glacial lake outburst floods (GLOFs) that have substantial impacts on regional social, environmental and economic systems increasing risk due to flooding of downstream communities. In this dissertation, two lakes with potential to generate GLOFs were studied, Imja Lake in Nepal and Palcacocha Lake in Peru. At Imja Lake, basic data was generated that allowed the creation of a conceptual model of the lake. Ground penetrating radar and bathymetric surveys were performed. Also, an inundation model was developed in order to evaluate the effectiveness of a project that seeks to reduce flooding risk by lowering the lake at least 3 meters. In Peru, a GLOF inundation model was created. Also, the vulnerability of the people living downstream in the City of Huaraz was calculated, and the impacts of an early warning system were evaluated. The results at Imja indicated that the lake deepened from 98 m in 2002 to 116 m in 2012. Likewise, the lake volume increased from 35.8 to 61.6±1.8 million m3 over the past decade. The GPR survey at Imja and Lhotse-Shar glaciers shows that the glacier is over 200 m thick in the center of the glacier. The modeling work at Imja shows that the proposed project will not have major impacts downstream since the area inundated does not reduce considerably unless the lake is lowered by about 20 m. In Huaraz, the results indicate that approximately 40646 people live in the potentially inundated area. Using the flow simulation and the Peru Census 2007, a map of vulnerability was generated indicating that the most vulnerable areas are near the river. Finally, the potential number of fatalities in a worst case GLOF scenario from Lake Palcacocha was calculated to be 19773 with a standard deviation of 1191 if there is no early warning system and 7344 with a standard deviation of 1446 people if an early warning system is installed. Finally, if evacuation measures are improved the number reduces to 2865 with a standard deviation of 462. / text

<p>An increasing number of chemicals are being transported by ships along the Swedish coastline. Many of these chemicals may pose a threat to the environment. Accidents and spills are luckily rare, but nonetheless it is important to be prepared for a possible chemical spill. The Swedish Coast Guard is responsible for responding to chemical spills at sea, and has both equipment and trained personnel for the purpose. In order to prepare for a possible accident one also needs to know what is currently being transported at sea. The aim of this project is therefore to survey the chemical transports in Swedish waters.</p><p>The survey shows that many of the chemicals transported at sea are environmentally harmful and may harm the environment in the event of a spill. The number of accidents that occur is difficult to determine since not all of the smaller ones are reported. It is clear, however, that the main reasons for accidents are groundings and collisions. The collection of information about chemical transports has been difficult because many of the companies and ports are unwilling to give their information. This is part because of concurrence and part due to the fact that it is considered too much work to gather the data.</p><p>The project also aims to make a risk analysis for chemical transports at sea. Because of the insufficient data the risk analysis has only dealt with qualitative assessments for certain chemicals. These assessments show that chemicals which are less environmentally harmful may still pose a threat because of the safety issues for the personnel may delay or even prevent a response action.</p><p>International regulations for transports at sea can sometimes be complicated to apply because of the vast number of different chemicals. The classification process takes time because of the extensive research which is needed. Furthermore, many of the chemicals transported are classified in different systems and these do not always correspond. It is therefore difficult to conclude which chemicals that are actually a threat to the environment.</p> / <p>Varje år transporteras allt större mängder kemikalier med fartyg längs Sveriges kust. Många av dessa kan vara farliga för miljön. Olyckor och utsläpp sker lyckligtvis ganska sällan men det krävs ändå en beredskap för att kunna ta hand om ett eventuellt utsläpp. I Sverige har Kustbevakningen ansvaret för miljöräddningstjänst till sjöss och har både utrustning och personal som är speciellt utbildad för att bekämpa just kemikalieutsläpp. För att kunna förbereda sig på en eventuell olycka måste man dock också ha en aktuell bild av vilka kemikalier det är som transporteras till sjöss. Detta projekt har därför syftat till att kartlägga kemikalietransporterna i svenska farvatten.</p><p>Kartläggningen visar att flera av de kemikalier som transporteras till sjöss är miljöfarliga och kan skada miljön vid ett utsläpp eller en olycka. Hur många olyckor som sker är svårt att veta eftersom många av de mindre olyckorna inte rapporteras. Däremot kan man tydligt se att de vanligaste olycksorsakerna är kollisioner och grundstötningar. Att få tag i uppgifter om hur mycket kemikalier som transporteras har visat sig vara svårt eftersom flera företag och hamnar inte vill tala om hur mycket som transporteras. Det beror dels på konkurrensen mellan kemikalieföretag och dels på att man tycker att det är för jobbigt att behöva sammanställa informationen.</p><p>Projektet har också syftat till att göra en riskanalys över kemikalietransporterna. På grund av det bristfälliga underlaget har riskanalysen endast behandlat kvalitativa bedömningar av ett antal olika kemikalier. Dessa bedömningar visar att även kemikalier som är mindre miljöfarliga kan utgöra en stor risk eftersom de säkerhetsmässiga riskerna för insatspersonalen kan försena eller till och med förhindra en bekämpningsinsats.</p><p>De internationella reglerna kring transporter till sjöss kan ibland vara svåra att tillämpa eftersom det finns ett stort antal olika kemikalier. Klassningen av de olika kemikalierna tar också lång tid då det krävs omfattande underlag. Många av kemikalierna som transporteras är dessutom klassade enligt flera olika system och det är inte alltid dessa system överensstämmer. Det kan därför vara svårt att ta reda på vilka kemikalier som egentligen kan anses vara miljöfarliga.</p>