John Elway, a two-time Super Bowl champion quarterback with the Denver Broncos, transitioned to the role of President of Football Operations for the same team following his retirement. In this capacity, he was responsible for scouting and selecting highly skilled prospects and draft picks. Given his success as a quarterback, Elway was often questioned about his ability to identify talented quarterbacks and whether his experiences contributed to this skill. Elway provided an intriguing perspective, stating, “Actually, I’m much better at scouting defensive talent, such as linebackers, because I spent my entire career studying them and their skill sets, as they were the ones I faced after the play started.” This insight exemplifies the interplay between offensive and defensive strategies. The analysis of defensive and offensive attributes can be effectively conducted using the CARVER framework.

The CARVER matrix is a tool developed by the U.S. military to assess vulnerabilities and prioritize targets based on specific criteria. While originally designed for military use, the CARVER method can be adapted for civilian threat assessments. This system helps prioritize and evaluate potential threats to people, assets, or infrastructure, especially in areas like home security, workplace safety, or emergency preparedness.

CARVER stands for:

        •       Criticality
        •       Accessibility
        •       Recoverability
        •       Vulnerability
        •       Effect
        •       Recognizability

The purpose of using this matrix is to quantify and rank potential threats based on how likely they are to occur and the severity of their consequences.

How to Apply CARVER for Civilian Threat Assessments

Step 1: Identify Assets or Locations to Protect

        •       This could be your home, workplace, a public venue, or any location where you are responsible for safety.
        •       Assets could include physical structures (your home), people (family members), or information (digital data).

Step 2: Evaluate Using CARVER Criteria

For each asset or location, score the potential threat in each CARVER category on a scale of 1 to 5, where:

        •       1 indicates low significance or threat.
        •       5 indicates high significance or threat.

1. Criticality

Definition: How essential is the asset to your overall safety, or how damaging would its loss be?

        •       Example: If your home’s front door is breached, it’s critical to overall safety because it gives access to the entire house.
        •       Questions to ask:
        •       If the asset is lost or compromised, how severe would the consequences be?
        •       How important is this asset to your overall safety plan?

Scoring Example:

        •       Front door: 5 (because it is critical to home security).
        •       Garden shed: 2 (non-essential, low impact if compromised).

2. Accessibility

Definition: How easily can a threat access this asset?

        •       Example: A home’s back door may be more accessible than the front if it is less visible or monitored.
        •       Questions to ask:
        •       How easy is it for an intruder or natural event (e.g., flood) to reach this asset?
        •       Are there barriers (fences, locked doors) preventing access?

Scoring Example:

        •       Front door with security system: 2 (less accessible due to alarm system).
        •       Back door with no camera: 4 (easier to access with less visibility).

3. Recoverability

Definition: How quickly and easily can the asset recover after being compromised?

        •       Example: If a power outage affects your home, how quickly can the power be restored?
        •       Questions to ask:
        •       If this asset is compromised, how long will it take to recover?
        •       What is the cost and effort involved in recovery?

Scoring Example:

        •       Home’s internet system after a cyber-attack: 3 (can be restored within a day with moderate effort).
        •       Water supply during a natural disaster: 5 (difficult to recover quickly).

4. Vulnerability

Definition: How susceptible is the asset to threats?

        •       Example: A window without security bars is more vulnerable to break-ins than a reinforced door.
        •       Questions to ask:
        •       How well is this asset protected?
        •       Are there any weaknesses that make it easier to compromise?

Scoring Example:

        •       Ground-floor windows with no security measures: 5 (high vulnerability).
        •       Reinforced front door with deadbolt: 2 (low vulnerability).

5. Effect

Definition: What impact will the loss of the asset have on your overall safety or security?

        •       Example: The loss of a home’s security camera system might make it harder to detect future threats.
        •       Questions to ask:
        •       How significant would the impact be if this asset was compromised?
        •       Would it cause a cascade of other problems (e.g., loss of power leading to failure of security systems)?

Scoring Example:

        •       Loss of home security cameras: 4 (high impact, decreases ability to monitor threats).
        •       Damage to garden fence: 2 (low impact, minor repair).

6. Recognizability

Definition: How easy is it for a potential threat to identify this asset as a target?

        •       Example: A prominently placed security system may deter threats, while an unmarked side door might be overlooked.
        •       Questions to ask:
        •       How obvious is this asset to potential threats?
        •       Is it visible and attractive as a target?

Scoring Example:

        •       Visible home security camera system: 1 (low recognizability, clear deterrent).
        •       Unmonitored side door: 5 (high recognizability, easy target).

Step 3: Sum the Scores and Prioritize

Add the scores from each CARVER category for every asset or location. The higher the score, the greater the threat or risk.

Example:

Interpretation:      

• The back door (total score 26) poses the highest risk due to its accessibility, vulnerability, and recognizability as a target. It should be a priority for added security measures.
• The garden fence (total score 16) has the lowest threat level, meaning it requires less immediate attention.
  
  Step 4: Develop Mitigation Plans
  
  Based on the CARVER analysis, focus on reducing risks for assets with the highest scores. Examples of mitigation strategies include:
  
          1.      For high-criticality and high-vulnerability assets:
          •       Reinforce doors and windows with stronger locks or bars.
          •       Install security cameras or alarms in vulnerable areas.
          2.      For highly accessible and recognizable assets:
          •       Increase barriers to entry, such as adding fences or gates.
          •       Make assets less visible by using landscaping or obscuring lines of sight.
          3.      For assets with low recoverability:
          •       Prepare backup systems (e.g., emergency generators, water storage) to ensure quick recovery.
  
  CARVER for Specific Civilian Scenarios
  
          1.      Home Security:
          •       Evaluate entry points like doors, windows, and garages. Secure the most critical and accessible areas first, like the back door or garage, which are common entry points for intruders.
          2.      Workplace Safety:
          •       Assess the office building’s entry/exit points, especially in the case of emergencies like fires or active shooter scenarios. Ensure employees know safe evacuation routes.
          3.      Digital Security:
          •       For cyber threats, assess critical systems like email, cloud storage, and online banking. Use multi-factor authentication and encryption to reduce vulnerability.
          4.      Travel Security:
          •       When traveling, apply CARVER to identify critical aspects of your trip (e.g., airports, hotels) and assess potential risks like theft or emergency evacuation routes.
  
  Conclusion:
  
  Using the CARVER matrix helps you take a structured, analytical approach to assessing threats and vulnerabilities in everyday environments. By identifying the most critical and vulnerable assets and prioritizing mitigation efforts, you can enhance the safety and security in various scenarios. This method is practical for home security, personal safety, emergency preparedness, and even digital security.