InfoGram

June 28, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical infrastructures. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov.

Cyberterrorism

"In the near term, domestic and foreign terrorists are likely to stay focused on traditional attack methods - bombs still work better than bytes," according to Lawrence Gershwin, an intelligence officer at the CIA's National Intelligence Council. "But we anticipate more substantial cyber-threats in the future as a more technically competent generation enters the ranks," he told lawmakers at a recent Senate hearing. Mr. Gershwin also stated that the traditional adversaries of the United States are deliberately developing computer-based tools with the potential to do long-lasting harm to the critical infrastructures of this nation. At the same hearing, Duane Andrews, a former assistant secretary of defense reported that the United States has lost precious ground in dealing with cyber-based threats. To protect our economic security and the information infrastructure, a leading analyst from the Gartner Group testified that American governments and businesses must quickly spend ten times more on cyber security. The Gartner report said that "only 0.4 percent of a company's revenue is dedicated to information security even though nearly 80 percent depend on the Internet as an integral part of their business."

First Line of Defense

Special Agent Jim Christy from the Office of the Assistant Secretary of Defense stressed that American computer users can do simple things that make life harder for malicious hackers and not do other things that make their activities easier. Given that computer operators at fire and emergency service departments are the first line of defense for their respective organizations, SA Christy's do's and don'ts are listed here for consideration and application:

• Use different passwords at websites and on every machine used. Reject all site and system offers to "remember" your password.
• Never open email attachments from unfamiliar people. Definitely scan for viruses before opening attachments from those you know.
• Log off or lock your workstation when you go on breaks or out to lunch.
• Minimize the use of personal diskettes, zip disks, etc., to only those that have been under strict controls and custody.
• Do not process and save sensitive department operations information on computers that are not properly protected.

The Threat Within

Employees are responsible for the majority of electronic security breaches according to a new survey conducted by the market research firm Digital Research. However, most managers still believe that the only threat comes from faceless hackers and virus writers. Alan McGibbon of Network News wrote that employees understand in detail how their organization's systems work. "Those employees who are really computer literate can exploit software loopholes or weaknesses to introduce viruses, gain access, or use hacking tools to cause mayhem." Mr. McGibbon continued that employees can unwittingly expose a department's sensitive information through sheer carelessness (e.g., opening email attachments causing the spread of damaging viruses). He recommended intrusion detection, antivirus software, firewalls, network scanning, and encryption to provide an effective and coordinated set of defenses against the threat within.

A Layered Approach to Cyber Security

In a white paper by Tom Arnold, chief technical officer at CyberSource Corporation, Mr. Arnold advised to avoid the "eggshell security model" with its hard outer shell and soft center. He wrote that organizations following the "eggshell model" fortify the outer shell using filtering routers and firewalls. Their defense against internal attacks comes from simple user name and password logins. Though these are good, Mr. Arnold recommended an "electronic citadel" approach using layers of barriers to weaken and stop attackers in addition to an impenetrable fortress at the heart. He offered the following tips for those organizations having sensitive operational information to secure:

• Approach security as an integrated system of numerous interacting subsystems.
• Establish a clear security policy with everyone aware of their responsibility.
• Implement a "layered security model" where internal assets are secured, partitioned, and monitored.
• Use encryption and manage the encryption keys with physical controls and frequent rotation.
• Destroy sensitive data when no longer needed.
• Subscribe to information services and consider new developments in cyber security.
• Monitor and enforce security policy compliance.

Emergency Preparedness Canada

Canadian Prime Minister, Jean Chretien, announced the creation of a new Office of Critical Infrastructure Protection and Emergency Preparedness. The office will be the Canadian federal government's primary agency for ensuring emergency preparedness of all kinds. The new organization is charged with developing and implementing a comprehensive strategy for protecting Canada's critical infrastructure and is committed to working actively with provinces, territories, and municipalities, as well as the private sector, other countries, and organizations. The contact information for this new office: Emergency Preparedness Canada, 122 Bank Street, Second Floor, Ottawa, Ontario, Canada K1A0W6. Phone number: (800) 830-3118. Web address: www.epc-pcc.gc.ca/whatsnew/index.html.

Web Pages Defaced

The National Infrastructure Protection Center (NIPC) reported (27 June) the defacement of web pages belonging to two American and two Canadian police departments. The defacing of police web pages is occurring at increasing frequency. If it has not already begun, then it should be expected that defacement of web pages belonging to fire and emergency service departments will eventually begin. As there are no sacrosanct web pages immune from hacker activities, it is prudent to be prepared with preventive and incident response measures.

USFACIPC Weekly Lexicon: Dictionary Attack

An attempt to gain access to an information system by guessing a user's password using software that systematically enters words in a dictionary as passwords until a match is found.