InfoGram

April 5, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical information systems. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov

Common Errors Leading to Computer Security Vulnerabilities

Over 1,850 computer security experts meeting at two recent conferences identified seven common errors resulting in probable computer security vulnerabilities. They are offered here given their relevance to the fire and emergency community:

1. Ignoring the problem expecting it will soon disappear.
2. Providing reactive, short-term solutions allowing the problem to quickly reappear.
3. Underestimating the high value of cyber-based systems as well as the organizational reputation.
4. Relying primarily on a firewall (electronic boundary preventing unauthorized access).
5. Failing to follow through on fixes to ensure problems are permanently corrected.
6. Misunderstanding the relationship between information security and physical security.
7. Assigning untrained personnel to maintain security for the cyber-based systems.

Cyber Crime Expected to Soar

A major computer technology research firm says at least one "massive cyber criminal attack" will occur no later than next year. The Gartner Group predicts an extremely sharp rise in cyber crime due to inadequate laws, but also because new technology will mean more opportunities for cyber criminals to exploit the latest technological developments. Gartner experts caution that the government and private sectors must work diligently at preventing such attacks from becoming widespread. They maintain that now is the time, particularly for leaders of the critical infrastructures, to guarantee implementation of the most comprehensive cyber security measures. Their experts further advise public and private online users to install the most reliable firewalls as soon as possible.

New Wave of Hackers

Leading computer security experts warned that the American reconnaissance plane incident with China could result in a monumental new wave of attacks by malicious hackers fueled by animosity against the United States. After the accidental bombing of the Chinese embassy at Belgrade in May 1999, Chinese hackers launched hundreds of attacks on American public and private Internet sites. "We always see an increase in hacking in times of crisis," said Ari Schwartz, senior policy analyst at the Center for Democracy and Technology. Although there has been no sizable increase in website intrusions or email spamming as of 4 April, Mr. Schwartz indicated that Chinese chat rooms "are seething over the U.S. refusal to apologize for the collision and loss of a Chinese pilot." Lessons learned in 1999 sustain that it would be ill-advised now not to fully prepare for a "politically-oriented" new wave of hackers.

Computer Security Advice

System administrators of the fire and emergency services in search of advice on computer and network security can log onto three websites:

1. bsp.cio.gov The Chief Information Officers Council sponsors the best security practices initiative at this site according to a senior advisor for information technology security management at the National Institute of Standards and Technology (NIST).
2. csrc.nist.gov NIST's Computer Security Resource Center has a section at this site on proper implementation of key public infrastructure systems. In the next two months NIST will add sections on risk assessment, incident handling, and firewall realities.
3. icat.nist.gov At this site, the Internet Categorization of Attacks (ICAT) Metabase, there are more than 2300 known computer and network vulnerabilities organized by the Common Vulnerabilities and Exposures naming standards.

Partnership for Critical Infrastructure Security

The Partnership for Critical Infrastructure Security (PCIS) has incorporated, adopted corporate by-laws, and elected directors and officers at a meeting in late March. It is a collaborative effort of eight industry sectors deemed by Presidential Decision Directive 63 as "critical" to the infrastructure of this nation's economic and national security. The PCIS currently includes 51 organizations representing energy, financial services, transportation, communications, and information technology. "This corporation gives member organizations a vehicle to coordinate activities, minimize duplication, and develop real, operational solutions." The ultimate goal of PCIS is to assure the delivery of critical services to customers and citizens. "The private sector owns most of the nation's critical infrastructure and must take the lead in protecting it from security threats," said Michehl R. Gent, President of the North American Electric Reliability Council. "We are confident that by having wide representation from numerous industries, we have joined in common cause and created an organization that will make a substantial contribution to safeguarding national infrastructure assets."

The basis of confidence that computer software or hardware systems meet precise requirements and that implementation satisfies desired specifications.