InfoGram

July 5, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical infrastructures. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov.

Physical Threat to U.S. Infrastructures

A convicted terrorist testified on 3 July that top aides to Islamic militant Osama bin Laden helped prepare him for a bombing attack on the Los Angeles International Airport. The Los Angeles Times reported that he and other guerrillas trained in bin Laden's war camps for strikes at numerous U.S. targets. This individual further testified in detail about how several men and women in Afghanistan camps financed by bin Laden were taught to attack electrical power grids, airports, railroads, large corporations, hotels, and military installations.

Cyber Threat to U.S. Infrastructures

"Cybersecurity is slipping," a panel of security experts told U.S. lawmakers at a June hearing of the Joint Economic Committee. The biggest threat is cyber warfare sponsored by foreign governments, said Lawrence K. Gershwin, an officer of the CIA's National Intelligence Council. Mr. Gershwin said many modern nations have enough backing for "the future prospect of causing widespread, long-duration damage to critical U.S. infrastructures." According to a Government Computer News article, the committee's ranking Senate Republican, Senator Robert F. Bennett of Utah, said observers have missed the forest for the trees. "The complex issues of cybersecurity and infrastructure protection are overshadowed by the attention paid to hacking exploits and website defacements." Senator Bennett continued that "for the next five to ten years the U.S. is particularly vulnerable to those nations with the discipline, commitment, and resources to attack our nation's critical infrastructures."

Emergency Communications Network

The System Administration, Networking, and Security Institute (SANS) recently disclosed that the threat to critical Internet resources from distributed denial of service attack tools continues to increase. Members of the Institute believe an effective emergency communications network may be of great value if damage is done to both the Internet and to phone systems. Therefore, SANS is looking for ham and packet radio operators who are willing to take a leadership role to help establish and maintain an emergency communication channel. If you are qualified and interested, please send an electronic message telling SANS about your ham radio and computer security activities. Send it to info@sans.org with Emergency Communications Network in the subject line.

AAA Security

As the demand by emergency first responders for information grows, so does the demand for speed and convenience. To perform emergency rescue operations efficiently, more and more people will require access to a department's cyber systems. Experts from the Computer Security Institute (CSI) indicated that when more people are provided access into these systems, then the chances are greater for security breaches. Clearly, departments will need an effective way to let the right people into their systems. The CSI experts recommend authentication, authorization, and accountability (AAA or "triple A") as the means to ensure the right people are the only ones who enter a department's cyber systems.

• Authentication ensures that those gaining access are really the department personnel who have been approved for systems entry and use. Authentication can be performed using a variety of methods. A user's memorized password is appropriate for low security needs. A hardware token that generates one-time, dynamic passwords provides much higher security.
• Authorization guarantees that once authenticated personnel are inside the system, they will only have access to the information they need for efficient job performance.
• Accountability assures that all personnel who entered the system cannot deny their access and the tasks they performed.

Stopping Denial of Service Attacks

Denial of service (DOS) attacks on the web pages belonging to fire and emergency service departments will eventually begin - if not already started. To prevent DOS attacks, many agencies have installed two basic defenses: a firewall and an intrusion detection system. These two defensive systems are reactive measures that shut down part or most of an attack. However, just like PC antivirus software, both systems must constantly be updated.

• As the name implies, a firewall is a protection device to shield vulnerable areas from some form of danger. In the context of the Internet, a firewall is a system, i.e., a router, a personal computer, a host, or a collection of hosts, set up specifically to shield a site or subnet from protocols and services that can be abused from hosts on the outside of the subnet (or the department LAN). A firewall can keep hackers out, but it is not good at stopping a DOS attack. Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through.
• An intrusion detection system (IDS) monitors system and network resources and activities and, using information gathered from these sources, notifies the authorities when it identifies a possible intrusion. If a firewall is like having a security guard at your office door, checking the credentials of everyone coming and going, then IDS is like having a network of sensors that alerts when someone has broken in, where they are, and what they are doing. IDS is generally set to the "promiscuous mode" so it can see all passing data. It can log improper data or trigger an alarm.

USFACIPC Weekly Lexicon: Encryption

A change made to data, code, or a file so it no longer can be read or accessed without processing or decrypting. The process of encryption is roughly synonymous with encoding.