The threat originating from deliberate attacks against process and chemical sites where relevant quantities of hazardous substances are stored or processed is a credible one, as confirmed by the attacks carried out in France in the summer of 2015. Although such chemical sites implement multiple layers of protection to address safety-related accidents, they often get behind with providing adequate attention and resources to the protection of assets against external adversaries or, in other words, terrorist threats. The lack of a consolidated practice in the risk-informed implementation of security countermeasures goes hand in hand with the existence of very few rigorous approaches to the effectiveness assessment of security systems, and in particular of physical protection systems (PPSs). The present study addresses the issue of quantitatively assessing the effectiveness of physical security systems adopted to protect process and storage facilities, recognized as high-consequence loss physical assets. To this purpose, the security functions of PPSs were analyzed to guide the selection of performance parameters. Experts from the industry were involved to identify variables and influencing factors relevant to the successful accomplishment of security functions. Experience-based judgments on performance, to be expressed in terms of probabilistic estimates, were also obtained. An insight into the belief that experts hold on the probability of PPSs effectively preventing the success of an external attack and in the identification of critical elements was obtained. The application of the results to the quantitative assessment of the contribution of security controls in reducing vulnerability was also addressed.

Chemical and process facilities may be the target of external acts of interference, aimed at causing cascading events, which may escalate into severe fires, explosions or toxic dispersions. Recent accidents that occurred in European chemical facilities presented these features, showing that industry must address with the greatest urgency the need of increasing the attention to security issues. Objective, performance-based methods to verify the adequateness of the resources dedicated to the protection of assets against external attacks are needed. In the present study, a probabilistic risk analysis approach supported by a model based on Bayesian Networks is adopted to address the quantitative assessment of the attack likelihood and to incorporate the functional analysis of physical protection systems (PPS) applied the security of process and storage installations. A case study of industrial interest is analysed to exemplify the methodology, which may be adopted to evaluate the PPS in place in a given facility. The methodology also allows for a quantitative evaluation of attack success credibility and for the identification of the more critical escalation scenarios, thus supporting safety and security reviews of chemical and process facilities.