Risk Management Security Improving the United States Air Force Protection Level Asset Security System

For years, the Air Force methodology for securing its protection level assets has been primarily based on risk acceptance. Risk acceptance is basically an attempt to prevent the loss of, damage to, or theft of resources while "assuming" an acceptable level of risk from an adversarial attack. This "assumed" acceptable level of risk is primarily based on operational considerations and financial constraints, and in most cases, relies on a threat that is postulated rather than actual. However, in today's intense environment of strict personal and financial accountability, the Air Force can no longer afford to protect its assets in this manner. The threats and vulnerabilities associated with Air Force protection level assets can never be fully eliminated, nor would the cost and benefit warrant an attempt to do so. In most cases, however, it is possible to minimize these "assumptions" concerning risk by balancing the risk of loss or damage against the costs of countermeasures and select a mix that provides adequate protection without excessive cost. As opposed to risk acceptance, risk management security dictates protection of only those resources that can be justified as a result of a systematic process, thus limiting the "assumptions" concerning acceptable levels of risk. It requires measurement, estimation, and careful judgment based on available data. It is the process for determining protection level asset vulnerabilities and threats and then implementing security countermeasures to achieve an acceptable level of risk at an acceptable cost.