June 8, 2006 InfoGram

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Protection versus Resiliency

The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) studies the current threat environment and reports about new trends and developments in the discipline of critical infrastructure protection (CIP). As all-hazard threats proliferate, the EMR-ISAC comprehends the imperative reasons to justify an investment in CIP to protect only those people, things, and systems absolutely essential for organizational survivability, continuity, and response-ability.

Several months ago, the EMR-ISAC reported that The Infrastructure Security Partnership (TISP), a consortium of public and private professional agencies, advocates critical infrastructure resiliency (CIR). TISP asserts that CIR is a cost-effective alternative to CIP, particularly when critical infrastructures cannot be adequately protected because of insufficient resources. At its core, CIR refers to the ability of an organization to expeditiously recover and reconstitute critical services with minimum disruption to personnel, processes, procedures, information, and facilities. In other words, CIR facilitates a quicker recovery from man-made and natural disasters, and an earlier return to normal operations.

CIP focuses on using available resources to protect truly indispensable infrastructure from degradation or destruction prior to a deliberate or accidental catastrophe. Simply stated, CIP is all about preventing the loss of vital services by protecting the critical assets that provide those services. However, CIR complements CIP by addressing and resolving the "protection gaps" in critical infrastructures. Recognizing that scarce resources limit protective (CIP) measures, CIR actions provide redundancy for that which cannot be protected. CIR strategies ensure that unprotected infrastructures can restore crucial operations and services shortly after an all-hazards attack.

Having closely examined this matter, the EMR-ISAC recommends a combined CIP and CIR approach to critical infrastructures, considering how both are complementary and together provide a comprehensive approach to sustaining vital services during and after a calamity. Collective CIP and CIR activities have greater potential to acquire continuity of emergency operations and mission success in a resource-restrained community.

Cyber Security Importance

Recently, the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) reported that cyber threats are growing more dangerous. In a previous InfoGram, the EMR-ISAC wrote: "Attacks on computer networks could escalate from mere inconveniences to disasters that ruin companies or even kill people." This possibility must be seriously considered because computers and cyber networks are an integral part of the critical infrastructures of the emergency services that cannot be interrupted or destroyed. Therefore, the EMR-ISAC shares the following information provided by the Multi-State ISAC for use by the nation's public and private sector organizations.

What is Cyber Security?

The majority of personal and professional critical information relies on computers and the Internet. Cyber security involves the deliberate protection of that information by preventing, detecting, and responding to cyber attacks.

What are the Risks?

There are many risks. Among them are viruses that steal information, make unauthorized purchases, erase entire systems, alter files, use computers to attack other computers, etc. The dangers are always present and require alertness and active steps to minimize the risks. Unfortunately, there is no guarantee that the best cyber security will not be penetrated eventually.

What can be done?

Become familiar with the terminology and risks. Understand that some people seek to exploit weaknesses in software and systems for their pleasure, gain or destructive purposes. Commit to protect computers and networks from viruses, worms, and Trojan horses. Contact the US-CERT for cyber security expertise.

Review of Chemistry for Emergency Response

The U.S. Fire Administration (USFA), a component of the U.S. Department of Homeland Security's Preparedness Directorate, released last week a self-study refresher on CD-ROM titled: Review of Chemistry for Emergency Response.

This CD-ROM is a refresher opportunity to enhance and support the National Fire Academy (NFA) course, Chemistry for Emergency Response (R233). This course of study is conducted at off-campus training sites throughout the nation as well as at the National Emergency Training Center (NETC). Chemistry for Emergency Response (R233) is a two-week program that includes extensive discussion and intensive problem-solving applications of "street" chemistry for students serving as emergency responders with technical and tactical responsibilities for operations during hazardous materials incidents within their jurisdictions.

The Review of Chemistry for Emergency Response self-study refresher allows graduates to review the course content periodically at their job sites or homes to reinforce their classroom experience. As with the two-week course, the self-study refresher includes interactive content presentations, practical applications, and test items. It will refresh and review information delivered in a classroom setting by a competent instructor.

The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) advises graduates at off-campus sites, resident deliveries, and other interested persons to order a copy through the USFA Publications Center at 800-561-3356.

DHS Lessons-Learned Website

Do you need to know about terrorist incidents, natural catastrophes, plans to cope with man-made and natural disasters, training exercises, after-action reports, congressional testimony, academic research papers, federal plans for the avian influenza, etc.? The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) presumes that you can probably find what you are looking for on the Department of Homeland Security (DHS) Lessons Learned Information Sharing Website.

Lessons Learned Information Sharing (LLIS.gov) is the national network of lessons learned and best practices for emergency response providers and homeland security officials. It is a database of theory and practice documents including events and conferences, a directory of responders and homeland security officials by functional expertise, and secure email and message boards. The site recently added hurricane preparedness content and should be a valuable learning and planning tool for emergency services personnel and organizations.