Looks like some amendments have been issued to the RFP for the Nationwide Public Safety Broadband Network. However, so far it does not look like there has been much change to the section on cybersecurity. There appears to be only a line or two changed in the document between the versions.
Feb
21
The big news this week seems to be Apple butting heads with the FBI regarding accessing the information on an iPhone, and will likely be in the news for the forseeable future. For some reason the article I am linking to interviews a bunch of Australian officials on the topic.
http://www.zdnet.com/article/for-simplicity-and-security-apple-needs-to-draw-a-line-now-to-prevent-further-ones/
Feb
14
Most of the time I spend discussing radio communications with others, its within the context of usage for voice traffic. However, in addition to voice Project 25 standard also includes the use of a radio to transmit IP data from both mobile and fixed hosts. Since the radios support encryption presumably any data traffic transmitted should be able to be encrypted just as voice traffic is, provided the encryption portion of the radios are configured properly I would think.
Feb
8
I did not come across anything of note to write about this week, and I set my digging into the P25 specifications from last week on the back burner and have not got around to picking it back up yet.
Jan
31
During discussions on embedded systems for a different class, I started thinking about the new radio systems going in for a lot of jurisdictions. Since most, if not all of these systems use IP for their networking I wondered how security is handled. In the case of P25 the requirements include the use of FIPS-approved encryption for the over-the-air programming messages for those systems using that option. The trunking control channel will also have security provided through encryption as an option. I’m still sorting through the standard for details on other aspects. As to other digital radio formats, its hard to say what is used since most of those are proprietary.
Jan
17
This last week saw the release of the RFP for the National Public Safety Broadband Network (NPSBN) by the First Responder Network Authority (FirstNet). One whole section of the RFP package was dedicated to cybersecurity.
The RFP laid out a number of concepts that are to be considered critical to the design of the security solution:
- Public Safety Needs
- Dedicated Cybersecurity Program
- Federal Requirements (i.e. FISMA)
- Architecture
- Life-Cycle Process
- Guidance (i.e. Standards Organizations, Industry)
- Systems Engineering
- Risk Management
- Incident Response and Security Operations Center
- Continuous Monitoring and Mitigation Methodology
- Testing and Certification Plan
- Network Management and Configuration Management Policy
- Environmental and Physical Security
- Information Security and Data Sensitivity
Given the nature of the network’s primary user base (public safety), security is an important requirement. The network will be carrying sensitive information subject to a variety of laws including HIPAA. The RFP document does seem to cover requirements to cover most every aspect of the network.
Resources:
First Responder Network Authority. “Solicitation No. D15PS00295 – Section J, Attachment J-10
Cybersecurity” Retrieved from: https://www.fbo.gov/utils/view?id=7d9982dba8e87f697802f846f08601b8
Dec
18
Normally when a NFPA catalog shows up in my mailbox I toss it aside without much thought, a couple months ago however I happened to flip through it when I came across NFPA 1221: Standard for the Installation, Maintenance, and Use of Emergency Services Communications Systems. So I logged in to the website so I could check it out and see what it entailed. Many of the chapters are not relevant to this discussion, however the entirety of Chapter 13 is devoted to data security. The majority of the requirements are directed towards communications (dispatch) centers however many items are applicable to all agencies.
The chapter starts out mandating the development, implementation, and utilization of a comprehensive security plan. The plan must encompass people, technology, and operations as well as providing a framework for safeguarding vital systems including CAD and IP-based NG9-1-1 systems, as well as wireless networks and devices used by first responders either on public safety or public wireless carrier networks. Most of these items are pretty basic in nature.
The rest of section 13.1 spells out the items that are to be included in the plan:
- Policy statement from the AHJ (authority having jurisdiction) detailing the requirements and goals of the plan
- Assignment of responsibilities for the performance of security functions
- Training and education requirements for employees including a continuing education component
- Control provisions for access to physical premises, radio subscriber units into the radio system, and personnel access to various portions of the networks and computers
- Network security provisions to prevent unauthorized access to the public safety IP network, public safety phone network, land mobile radio network, and any other networks that operate within or under the control of the communications center that are required to receive or process alarms
- Network security provisions to prevent unauthorized use of public safety handheld IP-enabled devices on either a public safety network or a public wireless carrier network
- Computer security provisions to prevent attacks on the center’s computers and servers
- Implement software patch management provisions to ensure all software is periodically updated
- Data disaster recovery procedures to ensure rapid recovery of databases, servers, and similar equipment used in the communications center, public safety wireless network, and for local storage of important information
- Implement logging and auditing provisions to allow investigation of security or operational problems
- Implement a vulnerability management process to assess periodically the ability of the public safety communications systems, including communications centers, wireless networks, and wired IT networks
- Implement environmental and physical security provisions to ensure that it can monitor physical aspects of the public safety communications system at all locations such as physical entry, fire, smoke, power supply performance, base radio performances and other parameters as judged necessary by the AHJ
The remaining two sections cover testing and records of the tests. The plan is to include methods, procedures, and schedules for testing for security breaches or failures, with the frequency to be determined by the AHJ.
References:
National Fire Protection Association. (2015). Standard for the installation, maintenance, and use of emergency services communications systems. (2016 ed.) [PDF] Retrieved from http://www.nfpa.org/
The use of body cameras by police officers has become an increasing topic in the news recently and I came across a link last month on Twitter to an article on if security breaches could result from the use of things like body cameras. While they have not seen as much attention I have seen a few videos from the fire service involving the use of helmet mounted cameras at incidents, and anything that applies to the body cameras could potentially extend to those as well.
In one case cameras were found to be shipped infected with the Conficker worm. Should an agency have systems without antivirus software or software that is outdated, those systems would quickly become infected. When the infection was brought to the attention of the manufacturer, they did not even think there was software in the camera. (Robinson)
Just as in the private sector, technology continues to play an ever increasing role in public safety. Film-based still cameras have long been replaced with digital cameras and video cameras that record to VHS are, if they havent already, been replaced with DVR type systems. If proper security precautions are not taken any of these could become a hole as the storage could contain viruses. Even communications continue to become increasingly digital both in the voice through P25 radios and Next Generation 911 and data through things like instant messaging & vehicle location (AVL).
Robinson, B. “The internet of malware-infected things” GCN https://gcn.com/blogs/cybereye/2015/11/malware-in-body-camera.aspx?s=gcntech_231115
Dec
6
My name is Daniel and I am starting on pursuing a Masters degree in Cybersecurity from Bellevue University. For one of my classes this term I have to do a weekly post on some theme of our choice related to cybersecurity. Given part of my employment history in IT thus far has involved the fire service in some way, I have chosen to blog on items pertaining to cybersecurity and how it affects the fire service and to a lesser extent public safety in general.
No Comments