InfoGram

July 12, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical infrastructures. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov.

Managing Firefighting Resources

The Federal Computer Week reported that an interagency wildfire management organization has begun deploying two of three major components in a software application designed to manage firefighting resources. The application will automate the ordering of firefighting resources such as crews and airplanes and provide decision-makers with real-time information on the status of those resources. The National Wildfire Coordinating Group (NWCG) is rolling out the administrative and status reporting pieces of its Resource Ordering and Status System (ROSS). A third resource ordering capability will be disseminated around December. NWCG is composed of several federal agencies including the Forest Service, the Bureau of Land Management, the Fish and Wildlife Service as well as many state forestry agencies. The group oversees wildfire management via more than 400 dispatch and coordination offices across the country. ROSS will be deployed to enable dispatch officials to see what firefighting personnel and equipment are available and to order them electronically. "By automating this, we are immediately able to see the available resources, and as things change, their status is automatically updated," said Jon Skeels, ROSS project team leader for NWCG. Mr. Skeels continued that "just knowing where resources are is a very important piece of information." Currently, such information is sent daily to the National Interagency Fire Center in Boise, Idaho, "but by the time it is compiled, it is old news," he said.

Era of Mass Victimization

The focus on routine security and privacy issues partially caused by denial-of-service attacks and site defacements has too many government, corporate, and information systems leaders distracted from the more serious consequences. According to Frank Lesiak, a German intelligence expert, there is high threat of hostile governments or terrorists taking a sophisticated, long-term approach to wreaking havoc on American and European critical infrastructures. "Imagine a society that breaks down because the entire information technology structure disintegrates," he said. "That kills a lot of people, not just bits and bytes." A related study just completed by American market researchers Frost & Sullivan concludes a growing number of domestic and foreign hackers are no longer concentrating on disrupting online service and implanting viruses. "They are also doing less noticeable, but potentially more damaging activities such as reading email and gathering restricted information for future catastrophic use." Recent research by Gartner Inc., shows that within a year there will be at least one incident of economic mass victimization in this country caused by domestic cyberterrorists. Their research also points to the high threat of a cyberattack on United States critical infrastructures by foreign terrorists or hostile nations.

Information Sharing and Analysis Centers

Rep. Tom Davis (R-VA) reintroduced a bill aimed at encouraging the private sector to share cybersecurity incidents with federal agencies so the government has a better picture of threats to national security, according to an article in the Federal Computer Week. Rep. Davis and co-sponsor, Rep. Jim Moran (D-VA), first introduced the bill last year after the formation of several private-sector information sharing and analysis centers (ISACs). ISACs were designed to share security incidents as part of Presidential Decision Directive 63 (PDD 63). PDD 63 requires the federal government to secure the systems that support the nation's critical infrastructures (i.e., telecommunications, energy, water, banking and finance, transportation, and emergency services). Banking and finance and the information technology sectors are among those that have already formed ISACs. "Although they are sharing information among themselves, private sector leaders will not pass cybersecurity information to government incident response organizations," said Diane Frank, the article's author. "Their refusal stems from fears that information held by federal agencies may be exposed through the Freedom of Information Act." Note: It is the goal of the Critical Infrastructure Protection Information Center (USFA CIPIC) to eventually become an ISAC for the fire and emergency services sector.

Computer Security Maladies

The following are the most common errors still committed by corporate and personal computer users as observed by the experts from Computerworld. They are modified for consideration by those accountable for cybersecurity within the fire and emergency services sector.

• Post-it Note Violations. These convenient sticky note pads frequently defeat proper security measures. Personnel use them to remember their passwords and post them where they can be seen.
• Anti-Antivirus Software. Not all computer users believe certain security measures are necessary. Thinking that it slows down their machine, people turn things off such as antivirus software.
• Leaving it on Syndrome. Many individuals leave their computer on and unattended without protection. So who needs a password anyway?
• E-Mail Attachment Compulsion. Despite numerous warnings not to do so, some folks feel compelled to open attachments even from unknown sources.
• Poor Password Phenomenon. It is a phenomenal reality that computer users prefer easy passwords regardless of their department's policy on password selection.
• The Blabbermouths. People sometimes talk in public places about their "outstanding" or "oppressive" computer security policies. Such things should not be discussed outside the office environment.
• Disappearing Laptops. Notebook and laptop computers have a tremendous propensity to disappear when unattended in public. However, there is an increasing incidence of vanishing machines in the work place as well.
• Unenforced Policies. The best security plans and policies are useless if senior leaders fail to enforce them. Nevertheless, there are numerous organizations that have good policies, but only on paper - or in rhetoric - and not in reality.
• Inconsiderate Leadership. Senior leaders occasionally fail to consider the computer strengths and weaknesses of their subordinates. This shortcoming often causes disgruntlement and elevates the potential for a threat from within.
• The Slowpokes. Responsible personnel are routinely slow about updating antivirus software, service packs, etc. This procrastination creates a window of opportunity for hackers.

USFACIPC Weekly Lexicon: Execute

To carry out a task or set of tasks. To execute a program, for example, is to load it into memory and run it. An executable file is a program file. To execute code is to carry out the instructions described by the code.