InfoGram 10-07: March 15, 2007

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Red Teaming: A Vulnerability Analysis Methodology

The critical infrastructures of the Emergency Services Sector (ESS) are commonly threatened by and vulnerable to a multitude of hazards, any of which can degrade operations and response-ability according to the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC). If ESS departments and agencies know the threats to their personnel, physical assets, and communication/cyber systems (i.e., internal critical infrastructures), do they also comprehend the vulnerabilities of these critical infrastructures to man-made and natural disasters?

A vulnerability is the weakness in a critical infrastructure that renders the infrastructure susceptible to degradation or destruction by the source of the threat. An effective vulnerability analysis will examine each threatened infrastructure from the "threat point of view." In other words, the analysis will seek to understand the ways by which each threat might disrupt or destroy each particular infrastructure because of existing vulnerabilities. The eventual elimination or mitigation of present weaknesses cannot be accomplished without knowing what or where they are. Moreover, removing vulnerabilities will significantly increase the survivability, continuity of operations, and mission success of ESS organizations.

Because of the necessity to comprehend and eliminate or mitigate existing vulnerabilities, the EMR-ISAC recommends ESS leaders, owners, and operators consider using "Red Teaming" as an effective vulnerability analysis methodology. This form of "team analysis" is borrowed from the Cold War when the American military would create an "opposing force" to simulate a Russian (i.e., "the Reds") attack as a way of evaluating their vulnerabilities. When applied to ESS organizations, "Red Teaming" attempts to grasp a complete picture of threat (i.e., all hazards) capabilities to better understand how the source of the threat can exploit and capitalize on the weaknesses in critical infrastructures.

"Red Teaming" thoroughly examines the likely threats to an organization's critical infrastructures to fully comprehend "how and where" each infrastructure can be degraded or destroyed. The "how and where" typically provide essential information regarding existing vulnerabilities that must be eliminated or mitigated within every internal infrastructure. Therefore, this team approach to vulnerability analysis has the probability to successfully promote the critical infrastructure protection of the Emergency Services in a time-efficient and resource-restrained manner.

Precautionary Checklist for Suspicious Activities

In the "Precautionary Checklist for Suspicious Persons" seen in last week's InfoGram 9-07 (March 8, 2007), the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) recommended continued "situation awareness" and unabated scrutiny for suspicious persons and activities involving national critical infrastructures. To encourage effective attentiveness by Emergency Services Sector (ESS) personnel, the EMR-ISAC provides the following additional checklist (gleaned from multiple sources) to help identify suspicious activities in their jurisdictions:

• Loitering by unidentified persons near or in a facility for an extended period of time.
• The appearance and work by contractors or service technicians without prior notification or clearance.
• An unscheduled package delivery for an office within a facility by unidentified individuals.
• Uncooperativeness by persons who are challenged by an appropriate authority.
• Property removal from a facility or office by unidentified individuals without proper authorization.
• Surveillance by unidentified persons who may be taking photos, videotaping or sketching the exterior or interior of a facility.
• Objects or packages that are situated inside or outside a facility by unknown individuals.
• Unattended backpacks, boxes, containers, luggage, etc., in a hallway, lobby, restroom, stairwell, or elevator of a facility.
• Any item that could be an improvised explosive device (e.g., items with visible wires, antennas, batteries, timing devices, metal or plastic pipes with both ends covered).
• Rental vehicles or trailers parked near a facility or in an unusual location without prior authorization.

NOTE: This checklist as well as the previous one (at INFORGRAM 9-07) contains only a partial listing of suspicious activities or persons. Nevertheless, ESS personnel observing one or more of the items on this checklist should immediately call their local law enforcement agency and attempt to convey specific details. If confirmed by police authorities to be suspicious, the matter should be reported to the local FBI office for additional investigation and reporting.

Mold Detrimental to ESS Organizations

After considerable research on the topic of mold in Emergency Services Sector (ESS) facilities, the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) understands that the presence of mold commonly degrades operations, endangers the health of sector members, and creates substantial financial burdens for affected emergency departments and agencies.

In the many cases where mold infected ESS stations across the U.S., those organizations experienced the same three outcomes: workers sickened a on short- and long-term basis, employees displaced from quarters for periods of weeks to months, and costs that ranged from $15,000 to $75,000 and more.

Mold thrives in warm, moist areas (e.g., bathrooms, kitchens, laundry rooms, and damp basements) where humidity is 50 per cent or greater and where moisture is allowed to remain for 48 or more hours. Sources of moisture include leaks from roofs, gutters, foundations, plumbing, sewage, drains, furnace filters, improperly vented clothes dryers, unemptied HVAC or refrigerator drip pans, and condensation at window and pipe interfaces. In such conditions, mold grows on virtually any organic substance such as wood, paper, carpet, food, insulation, etc. Standing water, water-damaged materials, and surfaces that remain wet are virtually certain to promote mold growth. If undiscovered or unaddressed, mold gradually destroys the things it grows on. Often, mold is apparent upon visible inspection, but just as often, grows in inaccessible or hard-to-view locations.

All types of mold have the potential to cause health effects. The allergens they produce can trigger asthma, and set off myriad allergic reactions: skin rashes, chronic headaches, bronchitis, rhinitis, sinusitis, fevers, respiratory infections, nose bleeds, allergic conjunctivitis, and hypersensitivity pneumonitis, among others. Exposure occurs through skin contact, inhalation, and ingestion.

A mold assessment is essential if responders experience these types of health effects or if mold growth is evident. In 2005, the U.S. Department of Health and Human Services, Centers for Disease Control and Prevention, released a National Institute of Occupational Safety and Health (NIOSH) Hazard Evaluation Report (PDF, 1.0 Mb).

The 17-page report resulted from an investigation of a fire station that had mold growth. NIOSH's Respiratory Disease Hazard Evaluations and Technical Assistance Program conducts field investigations of possible health hazards in the workplace, following a written request from employers or authorized employee representatives. The report includes methods, recommendations, photographs, employee symptoms, and other information. The U.S. Environmental Protection Agency offers many free resources and guidance documents regarding mold in commercial buildings at http://www.epa.gov/mold/ and http://www.epa.gov/iaq/biologic.html. Documents outline building testing, inspection, assessment, and prevention and mitigation techniques. Because injurious mold growth has occurred across the U.S., and not merely in flood/hurricane-prone areas, the EMR-ISAC suggests that inspections followed by prevention measures when necessary will yield vital protection for the personnel and physical critical infrastructures of emergency organizations.

PSAP Critical Infrastructure Resiliency

The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) examined a recent article on the need for contingency planning by Public Safety Answering Points (PSAPs) or 9-1-1 call centers. The report by Jim McKay for EmergencyManagement.com indicated the necessity for redundant systems to ensure continuity of emergency call service. He further stated: "It's becoming more common for PSAPs to either create redundancy in the form of backup 9-1-1 centers or cultivate relationships with neighboring PSAPs to share resources should one PSAP become disabled."

On the matter of redundancy, the EMR-ISAC clarifies that redundant systems guarantee the restoration of essential operations in the shortest period of time after those systems have been degraded by a disaster, according to current literature regarding critical infrastructure resiliency (CIR). For example, call center administrators can arrange to have employees from one center cross-trained to work at another. Cross-trained staff can substitute at other centers. In some cases, skeleton crews of cross-trained workers could be combined to create one fully staffed call center as an alternative to attempting to maintain two undermanned and struggling centers.

Some emergency communications specialists believe a backup PSAP may not be necessary for every jurisdiction. In smaller jurisdictions, 9-1-1 calls might be handled reasonably by sending them to an intact center in a neighboring jurisdiction. Agreements for these arrangements should be worked out during planning sessions.

The EMR-ISAC suggests it would be prudent for call centers in areas affected by hurricanes to address these agreements before the approaching hurricane season. Additionally, to maintain operations and care for their personnel, 9-1-1 centers should stock basic supplies (food, water, hygiene and cleaning products, etc.) and institute resting, eating, and sleeping provisions for staff that could be on site for extended periods of time.

The National Emergency Number Association (NENA) offers a disaster planning course for PSAPs and another on disaster mitigation for communication centers. The courses also include instruction about additional infrastructure protection issues such as safeguarding communication and cyber resources.