In general, any system may be at risk in a case of losing the critical facilities by natural disasters or terrorist attacks. This paper focuses on identifying the critical facilities and planning to reduce the effect of this event. A three-level model is suggested in the form of a defender-attacker-defender. It is assumed that the facilities are hierarchical and capable of nesting. Also, the attacker budget for the interdiction and defender budget for fortification is limited. At the first level, a defender locates facilities in order to enhance the system capability with the lowest possible cost and full covering customer demand before any interdiction. The worst-case scenario losses are modeled in the second-level. At the third level, a defender is responsible for satisfying the demand of all customers while minimizing the total transportation and outsourcing costs. We use two different approaches to solve this model. In the first approach, the third level of the presented model is coded in Gams software, its second level is solved by an explicit enumeration method, and the first level is solved by tabu search (TS). In the second approach the first level is solved by the bat algorithm (BA). Finally, the conclusion is provided.