InfoGram

October 11, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical infrastructures. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov.

Critical Infrastructure Countermeasures

The 4 October InfoGram continued the explanation of critical infrastructure protection (CIP) by reporting on the fourth step in the protection process. It initially reviewed that identifying critical infrastructures is the first step, determining the threat against those infrastructures is the second step, and analyzing vulnerabilities is the third step. The same InfoGram continued that assessing risk is the fourth step, which involves the comparison of threats and vulnerabilities to determine the potential risk of the degradation or loss of a critical infrastructure. When it is established that one or more infrastructures are threatened and vulnerable and, therefore, at high risk of degradation or loss, then the CIP practitioner proceeds to the fifth step of the CIP process: applying countermeasures. Countermeasures are any actions that reduce or prevent the loss of a critical infrastructure to an identified threat. They protect infrastruct and preserve the ability of emergency first responders to efficiently perform their services.

In this final step of the process, the CIP practitioner must weigh the loss of a critical infrastructure on mission success against the cost of implementing protective measures. Possible countermeasures differ in terms of feasibility, expense, and effectiveness. They can be simple or complex actions limited only by imagination and creativity. For example, to protect their personnel infrastructure, all FDNY digital radios will be inexpensively reprogrammed so that one channel will override all others and emit a long tone to warn each firefighter to immediately evacuate a building. Another easy and no cost example of a countermeasure is the growing number of departments that keep their apparatus bay doors closed at all times.

Decisions regarding the application of countermeasures will certainly influence personnel, material, and financial resources. These same decisions will inevitably drive a department's security budget as well as their associated action plans. Therefore, senior department leaders have the responsibility to allocate necessary resources when and where risk is unacceptable. Sometimes, prohibitive costs or other factors make it impossible to apply corrective measures. In such cases, senior department leaders must knowingly accept risk of the possible loss of a critical infrastructure. CIP experts advise that high risk physical or cyber systems should be considered a loss to plans and operations if not protected.

Infrastructure Protection Alert

Because of the prominent role the federal government has assigned to critical infrastructure protection, the National Infrastructure Protection Center (NIPC) issued a nationwide alert (7 October) to emergency first response agencies and all owners of national critical infrastructures to prepare for retaliatory attacks following allied military strikes against terrorist targets in Afghanistan. A NIPC spokesperson said the alert serves to encourage "heightened awareness for the security and safety of our nation's critical infrastructures." Security officials expressed concern, however, that the interdependent nature of national infrastructure systems means that failure in one sector could lead to serious problems in the others. Therefore, the fire and emergency medical services are urged to maintain the highest level of vigilance and to make daily evaluations regarding whether additional security measures are warranted.

Cybersecurity Key to Homeland Defense

Much of the reaction to the terrorist attacks has focused on physical systems and security (e.g., people, airports, government buildings, petrochemical pipelines, refineries, water reservoirs, etc.). But, while the Office of Homeland Defense takes shape, both government and private technology experts are urging that cybersecurity be included as a key to national security. A NIPC official stated that protection coordination between physical and cyber systems is absolutely essential. He emphasized that given the degradation of telecommunications after the 11 September attacks, "the Internet was the most reliable way to communicate." Therefore, leaders of the fire and emergency services community are reminded to give adequate attention to the protection of their cyber systems as well as the physical ones.

Effective Cybersecurity Layers

In an article seen at FederalComputerWeek.com, Maggie Biggs wrote that some technology managers assume an intrusion detection system will solve their security woes. She insisted that "nothing could be further from the truth." However, she wrote, "when intrusion detection solutions are deployed along with the other six security layers, they form a security system that leave agencies well prepared to combat cyberattacks." Ms. Biggs reported that the most effective cybersecurity models combine the following layers:

• A regularly updated security policy.
• Security tools tailored to user devices and servers.
• Scheduled security audits.
• Router-based security measures.
• Firewalls.
• Intrusion detection in real or near-real time.
• A strategy for responding to incidents.

USFACIPC Weekly Lexicon: Network

An information system implemented with a collection of two or more interconnected nodes for the purpose of data transfer.