Select Page

Write an essay of at least 500 words analyzing a subject you find in this article related to a threat to confidentiality, integrity, or availability of data. Use an example from the news.Include at least one quote from each of 3 different articles, place the words you copied (do not alter or paraphrase the words) in quotation marks and cite in-line (as all work copied from another should be handled). The quotes should be full sentences (no more, less) and should be incorporated in your discussion (they do not replace your discussion) to illustrate or emphasize your ideas.Cite your sources in a clickable reference list at the end. Do not copy without providing proper attribution (quotation marks and in-line citations). Write in essay format not in bulleted, numbered or other list format. Reply to two classmates’ posting in a paragraph of at least five sentences by asking questions, reflecting on your own experience, challenging assumptions, pointing out something new you learned, offering suggestions. These peer responses are not ‘attaboys’. You should make your initial post by Thursday evening so your classmates have an opportunity to respond before Sunday.at midnight when all three posts are due. It is important that you use your own words, that you cite your sources, that you comply with the instructions regarding length of your post and that you reply to two classmates in a substantive way (not ‘nice post’ or the like). Your goal is to help your colleagues write better. Do not use spinbot or other word replacement software. It usually results in nonsense and is not a good way to learn anything. . I will not spend a lot of my time trying to decipher nonsense. Proof read your work or have it edited. Find something interesting and/or relevant to your work to write about. Please do not submit attachments unless requested
oec_fact_sheet_cyber_risks_ng911.pdf

Unformatted Attachment Preview

Cyber Risks to Next Generation 911
The advent of Next Generation 911 (NG911) systems, which operate on an Internet Protocol (IP)
platform, enables interconnection on with a wide range of public and private networks, such as wireless
networks, the Internet, and regular phone networks. NG911 systems will enhance the current capabilities
of today’s 911 networks, allowing
compatibility
with
more
types
of
Benefits
Risks
communication, providing greater situational
NG911 will enhance
NG911 is different from
awareness to dispatchers and emergency
response capabilities:
traditional systems:
responders, and establishing a level of
 Enables receipt of data
 Requires standardized
(e.g., video, text) from
identity management and
resilience not previously possible. NG911
the public over a variety
credentialing across
will allow Public Safety Answering Points
of networks
systems
 Enables data sharing
 Allows for potential attacks
(PSAPs) to accept and process a range of
between PSAPs
to quickly escalate or
information from responders and the public
 Improves location data
proliferate across systems
alike, including real-time text, images, video,
 Allows for virtual
 Introduces new attack
PSAPs for survivability
vectors
and voice calls. In addition, NG911 will
provide PSAPs with supplemental location
Figure 1: NG911 Benefits and Risks
data, which may enable more effective
response.
Traditional 911 services typically operate over standard voice-based telephone networks and use
software, such as computer-aided dispatch systems, that operate on closed, internal networks with little
to no interconnections with other systems. The limited means of entry into the traditional 911 network
significantly limited potential attack vectors, and what little cyber risk existed could be easily managed.
NG911’s interconnections enable new response capabilities, as shown in Figure 1. However, they also
represent new vectors for attack that can disrupt or disable PSAP operations, broadening the concerns
of―and complicating the mitigation and management of―cyber risks across all levels of government.
The potential cyber risks to a NG911 system do not undermine its tremendous benefits. Nevertheless,
cyber risks do present a new level of exposure that PSAPs must understand and actively manage as a part
of a comprehensive risk management program. Past events have proven 911 systems are attractive targets
for cyber-attacks. For example, attackers have disrupted availability of traditional 911 systems by using
auto-dialers to overwhelm PSAP phone lines and cause congestion, preventing legitimate 911 calls from
going through [commonly called Telephone Denial of Service (TDoS) attacks] and location-based
records and databases that support NG911 are of interest to cyber criminals, data miners, and even nationstates wanting to access and exploit that information.
As cyber threats grow in complexity and sophistication, attacks could be more severe against an NG911
system as attackers can launch multiple distributed attacks with greater automation from a broader
geography against more targets. This issue paper provides an overview of NG911 cyber infrastructure,
conveys the cyber risk landscape associated with NG911, offers an approach for assessing and managing
risks, and provides additional NG911 resources.
1
Cyber Infrastructure
The National Emergency Number Association (NENA) describes NG911 systems as an IP-based system
comprised of hardware, software, data, and operational policies and procedures that:






Provides standardized interfaces from emergency call and message services;
Processes all types of emergency calls, including voice, data, and multimedia information;
Acquires and integrates additional emergency call data useful to call routing and handling;
Delivers emergency calls, messages, and data to the appropriate PSAP and other entities;
Supports data and communications needs for coordinated incident response and management; and
Provides broadband service to PSAPs or other first responder entities. 1
NENA defines several basic building blocks of NG911 systems, as described below:
• Emergency Services IP Networks
(ESInets). ESInets are at the center
of NG911 systems. These broadband
networks are engineered and managed
to use Internet protocols and standards
to carry voice and data traffic (e.g.,
text, pictures, videos) in support of
local, regional, state, and national
emergency management authorities.
• Applications and Databases. NG911
Figure 2: Simplified ESInet Diagram
uses a wide range of internal and
external databases to support its services. Internal databases validate and route data, record call details,
and enforce policy and business rules. External databases host many of the datasets that call takers
and dispatchers rely on to provide improved accuracy and shortened response time, including location
data, government records, law enforcement records, healthcare information, and infrastructure data.
• Standards and Security. NG911 uses functions and protocols that are compliant with international
IP standards, as well as standards developed within the emergency response community. NENA
defines NG911 standards based on Internet Engineering Task Force (IETF) IP standards. 2 In addition
to NENA, there are a number of other entities that establish standards for NG911 systems, including
the Association of Public-Safety Communications Officials (APCO), the Alliance for
Telecommunications Industry Solutions (ATIS), and the IETF. 3
1
“What is NG911?”.NENA. http://c.ymcdn.com/sites/www.nena.org/resource/resmgr/ng9-1-1_project/whatisng911.pdf.
The full list of NG911 functions, called the “i3” architecture, are defined in NENA 08-003, “Detailed Functional and
Interface Standards for NG911.” NENA has also defined security standard 75-001, “NENA Security for Next Generation
9-1-1 Standard (NG-SEC).” The i3 functions and standards, NG-SEC, and the full suite of other NG911 standards can
be found at https://www.nena.org/?page=Standards.
2
A full review of NG911 standards can be found on the National 911 Program’s website at
http://www.911.gov/pdf/NG911-Standards-Identification-and-Analysis-March2015.pdf.
3
2
“Cyber infrastructure includes electronic information and communication systems, and the information contained in these systems.
…Information and communications systems are composed of hardware and software that process, store, and communicate
data of all types. Processing includes the creation, access, modification, and destruction of information. Storage includes paper,
magnetic, electronic, and all other media types. Communications include sharing and distribution of information.”
National Infrastructure Protection Plan (2009, Revised and Updated 2013)
Per the definition above, cyber infrastructure for NG911 systems includes the IP-based networks, assets,
databases, and services, as they are involved in the processing, storage, and transport of data.
Specifically, an NG911 system’s cyber infrastructure includes:
• Assets that are part of, or interconnect with, ESInets
• Service provider networks and applications that interconnect with ESInets
• Government applications and services that connect to ESInets
• Dispatch systems and components that connect to ESInets
Traditionally, the term “cyber” has been applied to only information technology (IT) systems and assets,
while communications infrastructure was considered separate. However, defining cyber infrastructure as
including both IT and communications systems accounts for the many ways in which these systems have
converged. NG911 administrators should recognize this convergence in order to more effectively counter
risks. Risks to any component of these systems could threaten an entire NG911 system or its data, so it
is important to consider systems holistically.
The NG911 Cybersecurity Risk Landscape
Cybersecurity4 risks occur when a threat exploits a vulnerability, leading to an undesired event that has
a negative consequence on the desired state of the network. The three attributes most necessary for a
secure system are often referred to as the C-I-A Triad:



Confidentiality: Ensures that data is only accessed by those authorized to see it.
Integrity: Ensures that data is trustworthy and is not altered through transmittal, storage, or retrieval.
Availability: Ensures that the infrastructure—either components of the network or the network as
a whole—is operational and committable to its intended purpose.
The CIA Triad is used as a benchmark for evaluating information system security by the National Institute
of Standards and Technology (NIST), the International Telecommunications Union (ITU), and others.
Loss of confidentiality, integrity, or availability has especially severe impacts in the emergency response
domain. For example, loss of confidentiality within NG911 systems could expose information to identity
thefts or disrupt ongoing investigations; loss of integrity could disrupt response to 911 calls; and loss of
availability could prevent urgent requests from reaching a PSAP.
4 Cybersecurity is “the prevention of damage to, unauthorized use of, exploitation of, and, if needed, the restoration of
electronic information and communications systems and services (and the information contained therein) to ensure
confidentiality, integrity, and availability”, Department of Homeland Security (DHS) National Infrastructure Protection Plan,
2009. http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf.
3
Cybersecurity risks to NG911 systems,
such as those shown in Figure 3, have
severe potential impacts, including loss
of life or property because of hampered
response operations; job disruption for
affected network users; substantial
financial costs from the unauthorized
use of data and subsequent resolution;
and potential lawsuits from those
whose data is breached or whose lives
are adversely affected. To understand
the significance of different risks to the
confidentiality, integrity, or availabity
of a NG911 system, the terms threat,
vulnerability,
likelihood,
and
consequence must be understood.
Figure 3: Potential Risks to NG911 System Components
Threats. Threats are anything that has
the potential to harm the system and
are produced by “threat actors.” There are a variety of potential actors, each with different intent and
capabilities to carry out an attack. By understanding the motivations and capabilities of those responsible
for launching attacks, system administrators can better anticipate the types of attacks they might face and
better protect data and assets that are likely targets. Threat actors who have caused real-world damage
include, but are not limited to, those in Figure 4:






Figure 4: 
Threat Actors 

Anarchist………………..Someone who rejects all forms of structure, private or public, and acts with few constraints
Cyber Criminal/Crime Ring……………………….Manager of organized crime organization with significant resources
Cyber Vandal…………………………………..Derives thrills from intrusion or destruction of property, without agenda
Data Miner……………………………..Professional data gatherer external to the company (includes cyber methods)
Government Agent/Spy ……Foreign state-sponsored spy or agent as a trusted insider, supporting idealistic goals
Government Cyberwarrior……Foreign state-sponsored attacker with significant resources to affect major disruption
Nation-state……………………………………………….A sovereign territory with significant resources to cause harm
Radical Activist………………………………………………Highly motivated, potentially destructive supporter of cause
Terrorist………………………….Person who relies on the use of violence to support personal socio-political agenda
In addition to attacks, unintentional threats can disrupt the confidentiality, integrity, or availability of
NG911 systems. Unintentional threat actors include employees, vendors, contractors, or subcontractors.
For example, one of these actors could:
• Improperly safeguard data when sending or storing (for example, not using proper encryption, sending
data to unauthorized individuals, putting weak protection on databases)
• Enter typing mistakes that result in loss of data integrity
• Accidentally make a data resource unavailable when performing maintenance or upgrade operations
• Not follow physical or cyber protection procedures
• Improperly test or maintain back-up systems and power sources
4
Vulnerabilities. Vulnerabilities are weaknesses
Example Vulnerabilities
in a system, network, or asset that could enable an
Old Systems: Systems that are out of date or past their
undesired outcome, such as a network outage or
lifecycle that lack modern security measures
security breach. Vulnerabilities take two forms,
Shared Systems: Shared systems/databases with other
those that are vulnerable to external threats and
entities that have not employed security measures
those that are vulnerable to internal threats. One
Lack of Diversity and Redundancy: Lack of diverse routing
of the key tactics of an attacker is to gain credentials
for communications or redundancy for electric power
decreases resilience
and access to a network, and then exploit
Lack of Security Policies: Ad hoc or non-existent security
vulnerabilities within the network as a seemingly
policies enable insiders to accidently or intentionally disrupt
“trusted entity.” Vulnerabilities can also be within
operations and/or security
a network and available to malicious threat actors
who gain access to the internal system, either
improperly (through hacking) or by misusing their current position (insider threats). These actors
typically take advantage of databases or system applications with bad encryption, poor authorization
and access control measures or policies, and interconnections or interfaces with an external network or
entity. With vast interconnection possibilities, PSAPs may suffer from vulnerabilities associated with
systems for which they have not contributed funds, hold no direct authority, or provide other resources
to support beyond network access and perhaps mutual-aid agreements—even if they share redundancies,
databases, or other resources. In addition, different vendor implementations using proprietary
technologies can lead to varying degrees of protection and interoperability, even when addressing
the same standards and system requirements. NG911 developments have focused primarily on
deployment or modernization projects, but rarely on the governance and oversight of cyber risk
management that are critical to cybersecurity.
Likelihood. Likelihood refers to the possibility that a risk scenario could occur. Determining the
likelihood of a risk depends on the level of both the threat and the vulnerability and is the probability that
a given threat type will exploit a set of vulnerabilities, resulting in the occurrence of a risk. For example,
if a system has no vulnerabilities, the likelihood of risk is low even if there is a significant threat because
the threat would have nothing to exploit. On the other hand, if the system contains a significant
vulnerability but there is no threat to exploit it, the likelihood of a risk will be equally low. A risk with
both a greater threat and greater vulnerability level is much more likely to occur than one with a low
threat and low vulnerability level.
Consequences. While the potential consequences of cybersecurity breaches depend in large part on
the type of breach, the severity of the breach is determined by its ability to impact and degrade NG911
systems and PSAP operations, or its ability to harm the citizens they serve and the public’s confidence in
911 systems. Additional consequences include loss of sensitive records, including personal information
about citizens, law enforcement data, critical infrastructure information, healthcare data, dispatch
information, and possible legal liability for parties responsible for protecting the systems. When
evaluating potential consequences, it is important for administrators to assume the worst possible
outcome. For example, a particular type of data breach could be small and insignificant, but
5
administrators should account for the greatest reasonable consequence if that data breach were to occur.
Because it is impossible to address every risk, it is helpful to look at which risks are more likely to occur
to make more informed decisions about where to best allocate resources to ensure the most risk reduction.
However, likelihood is only one part of the equation—the consequences of risks must also be assessed.
Risk = the likelihood of a threat exploiting a vulnerability
and the potential consequence or impact of that event
Improving NG911 Cybersecurity Posture
Given the dynamic nature of technology and the evolving cyber risk landscape, organizations should
adopt a cybersecurity framework. An effective framework enables response organizations to:





Identify new and evolving risks
Assess and prioritize risks
Develop and prioritize mitigation stategies based
on cost-benefit analysis and other factors
Evaluate the impacts of mitigation
implementation
Develop an approach to detection and effective
response and recovery procedures
The Department of Homeland Security (DHS)
strongly
recommends
adopting
the
NIST
Cybersecurity Framework, which is a flexible, riskbased approach to improving the security of critical
infrastructure.5 Collaboratively developed between
government and the private sector, the framework is
Figure 5: NIST Framework Core Structure
based on industry standards and best practices and can
be used for NG911 systems. The NIST Cybersecurity
Framework is designed to complement an existing cybersecurity risk management process or to develop
a credible program if one does not exist. Figure 5 demonstrates the five core tenets of the NIST
Framework: identify, protect, detect, respond, and recover. More information, including informative
reference for addressing each tenet can be found in the Framework.
5
The most recent NIST Cybersecurity Framework and related newsletters are available at
http://www.nist.gov/cyberframework/.
6
Identifying and Assessing Risks
Regardless of the cybersecurity framework chosen, administrators will need to identify, evaluate
and prioritize risks for their organization. Figure 6 provides a sample risk assessment process.
Figure 6: Sample Risk Assessment Plan (to be followed with mitigation and response/recovery)
7
Mitigating Risks: Protect and Detect
While no single mitigation strategy can comprehensively address all the risk scenarios identified, the
individual evaluation of mitigation techniques may identify complementary mitigation strategies for
creation of a broad-reaching, holistic approach. In general, mitigation strategies aim to either prevent
and protect against an identified risk being exploited, or seek to ensure timely awareness of a
cybersecurity breach or occurrence. Mitigation strategies should employ safeguards that decrease the
impact of a risk, if exploited, on the organization and its ability to deliver critical services.
Table 1 describes sample mitigation strategies for NG911 cybersecurity. This list is not exhaustive and
should not replace a comprehensive requirements analysis; however, it is intended to provide a starting
point for requirements, planning, and implementation. Some elements may be addressed through
nationwide standards, industry best practices, or policy guidance, while others may be developed and
practiced by PSAP administrators.
Table 1: Sample NG911 Security Mitigation Strategies (non-comprehensive)
SAMPLE Strategy
Protect
Detect
Description
Ensure access privi …
Purchase answer to see full
attachment