1. June 9, 2003 Updated July 2004 Slide 1 Critical Infrastructure Assurance: The US Experience

2. June 9, 2003 Updated July 2004 Slide 2 Overview Critical Infrastructure Protection (CIP) History National Security Telecommunications Advisory Committee (NSTAC) National Infrastructure Advisory Council (NIAC) Partnership for Critical Infrastructure Security  Relationships in transition  Accomplishments  Information Sharing & Analysis Centers CIP Sector Lead Agencies  Historical Roles  Transitions to Dept. of Homeland Security CIP Challenges

3. June 9, 2003 Updated July 2004 Slide 3 www.pcis.org PDD-63 Critical Infrastructures PDD-63 Critical Infrastructures Water Transportation Oil & Gas Banking & Finance Electric Power Emergency Services Government Services Telecommunications Critical Infrastructures

4. June 9, 2003 Updated July 2004 Slide 4 www.pcis.org Critical Infrastructures Added Critical Infrastructures Chemical Industry and Hazardous Materials Agriculture Key National Assets* Public Health Postal and Shipping Food Defense Industrial Base

5. June 9, 2003 Updated July 2004 Slide 5 www.pcis.org National Security Interest are critical to safety, security, our way of life depend on commercial networks are interdependent are largely owned and operated by private companies cannot entirely depend on the Federal government for defense against cyber attacks Infrastructures… Government needs industry in a true public-private partnership

6. June 9, 2003 Updated July 2004 Slide 6 www.pcis.org The Business Case Businesses dependent on the Internet for survival Vulnerabilities threaten economic survivability/competitiveness Interdependency  Supply chain  Partners  Customers  Infrastructure industries Companies are on the front lines of defense Industry needs government in true public-private partnership

7. June 9, 2003 Updated July 2004 Slide 7 www.pcis.org Critical Infrastructure Assurance Partnership for Critical Infrastructure Security “Efforts to promote and assure reliable provision of critical infrastructure services in the face of emerging risks to economic and national security”

8. June 9, 2003 Updated July 2004 Slide 8 www.pcis.org History 1982 National Coordination Center for Telecommunications / National Security Telecommunications Advisory Committee 1997 President’s Commission on Critical Infrastructure Protection 1998 Presidential Decision Directive 63  Critical Infrastructure Assurance Office (CIAO)  National Infrastructure Protection Center (NIPC)  Office of National Coordinator 1999 Partnership for Critical Infrastructure Security; Financial Services Information Sharing and Analysis Center (ISAC) 2000 Telecom ISAC 2001 IT-ISAC; Worldwide- ISAC; ES-ISAC; Special Advisor to the President for Cyberspace Security 2002 Surface Transportation ISAC; Energy ISAC; more 2003 Department of Homeland Security

9. June 9, 2003 Updated July 2004 Slide 9 www.pcis.org National Security Telecommunications Advisory Committee (NSTAC) Provides industry-based advice and expertise to the President on issues and problems related to implementing national security and emergency preparedness (NS/EP) communications policy Information Sharing Education, Training, & Awareness Network Convergence R&D Exchange Information Assurance Infrastructure Protection Cyber Security & Crime Network Security Widespread Telecommunications Service Outages Intrusion Detection National Coordinating Mechanism Telecommunications Legislation and Regulation Telecom ISAC

10. June 9, 2003 Updated July 2004 Slide 10 www.pcis.org National Infrastructure Advisory Council (NIAC) Enhance public and private partnership in protecting information systems for critical infrastructures Propose and develop ways to encourage private industry to perform periodic risk assessments Monitor development of private sector ISAC’s (Information Sharing and Analysis Centers) Foster improved cooperation among ISAC’s Advise the President through the Secretary of Homeland Security as well as lead agencies with critical infrastructure responsibilities, sector coordinators, and the ISACs

11. June 9, 2003 Updated July 2004 Slide 11 www.pcis.org Cross-sector Collaboration Partnership for Critical Infrastructure Security (PCIS) http://www.pcis.org Participation by leaders from government, industry & academia Coordinates cross-sector initiatives and compliments public-private efforts Board of Directors majority always critical infrastructure “sector coordinators”

12. June 9, 2003 Updated July 2004 Slide 12 www.pcis.org PCIS Mission cross-sector initiatives and public-private efforts to promote and assure reliable provision of critical infrastructure services in the face of emerging risks to economic and national security. Coordinate cross-sector initiatives and complement public-private efforts to promote and assure reliable provision of critical infrastructure services in the face of emerging risks to economic and national security.

13. June 9, 2003 Updated July 2004 Slide 13 www.pcis.org Pre-DHS PCIS Relationships State and Local Governments State and Local Governments Critical Infrastructure Industry Sectors Law Enforcement FBI NIPC Federal Departments and Agencies CIAO President of the United States Advisory Committees PCISPCIS

14. June 9, 2003 Updated July 2004 Slide 14 www.pcis.org Key PCIS Accomplishments Brought together critical infrastructure sector leaders Identified public policy needs Three white papers Congress drafted new legislation after attending PCIS meeting Coordinated industry input to National Strategy to Secure Cyberspace Developed cross-sector information sharing taxonomy Published Critical Infrastructure Protection awareness resource repository Stay Safe Online campaign

15. June 9, 2003 Updated July 2004 Slide 15 www.pcis.org National Strategy to Secure Cyberspace Five National Priorities  National Cyberspace Response System  National Cyberspace Threat and Vulnerability Reduction Program  National Cyberspace Awareness & Education  Securing Government Cyber Systems Public-private partnership Primarily market-based approach Multi-level risk assessments National Security and International Cooperation

16. June 9, 2003 Updated July 2004 Slide 16 www.pcis.org Stay Safe Online Campaign Security education for homes, small businesses “Top Ten” tips, Tech Talks, security guides, links 105 companies; 15 Federal agencies 6+ million page views since Feb 7 rollout (2 million per month) National Cyber Security Alliance (NCSA)— educational foundation of PCIS Poster contest winners meet Tom Ridge in West Wing Apr 18, 2002 www.staysafeonline.info

17. June 9, 2003 Updated July 2004 Slide 17 www.pcis.org PCIS Current Priorities Cross-sector information exchange Outreach to new sectors Risk Assessment Guidebook Effective Practices Compendium Digital control systems security R&D

18. June 9, 2003 Updated July 2004 Slide 18 www.pcis.org Information Sharing and Analysis Centers (ISACs) Vital part of Critical Infrastructure Protection (CIP) Gather, analyze, and disseminate information on security threats, vulnerabilities, incidents, countermeasures, and best practices Early and trusted advance notification of member threats and attacks Organized by industry: cross-sector awareness, outreach, response and recovery

19. June 9, 2003 Updated July 2004 Slide 19 www.pcis.org The ISACs (Cont.) ISAC Benefits: Early notification Relevant information Industry-wide vigilance Subject matter expertise Anonymous information sharing Trending, metrics, benchmark data

20. June 9, 2003 Updated July 2004 Slide 20 www.pcis.org CIP Relationship Transitions

21. June 9, 2003 Updated July 2004 Slide 21 www.ntia.doc.gov U.S. CIP Effort: Sector Lead Agencies Commerce Information and Communications Treasury Banking and Finance EPA Water Supply Transportation Aviation Highways (including trucking and intelligent transportation systems) Mass Transit Pipelines Rail Waterborne Commerce Justice/FBI Emergency Law Enforcement Services FEMA Emergency Fire Service Continuity of Government Service HHS Lab ServicesPublic Health Services, including Prevention, Surveillance and Personal Health Services Energy Electric Power Oil and Gas Production and Storage ------------------------------------------------------------------------------ CIAOCritical Infrastructure Assurance Office NIPCNational Infrastructure Protection Center

22. June 9, 2003 Updated July 2004 Slide 22 www.ntia.doc.gov New Sector Lead Agencies DHS Information & Communications Transportation (aviation, rail, mass transit, waterborne commerce, pipelines, and highways (incl. Trucking & intelligent transportation systems) Postal and Shipping Emergency Services Continuity of Government Treasury Banking and Finance HHS Public Health Food (all except for meat and poultry) Energy Electric power, oil & gas production and storage EPA Water Chemical Industry and Hazardous Materials USDA Agriculture Food (meat and poultry) DOD Defense Industrial Base

23. June 9, 2003 Updated July 2004 Slide 23 www.pcis.org Critical Infrastructure Protection Challenges Government in transition/turmoil New sectors Physical and cyber strategies to merge War on terrorism Balancing budgets/priorities

24. 24 www.pcis.org