Cybersecurity : Optimal Approach for PSAPs High level overview FCC Task Force on Optimal PSAP Architecture Working Group 1 Update September 29, 2015

Presentation Outline: Status Report FCC Task Force on Optimal PSAP Architecture Presentation Outline: Status Report Draft Report Structure Executive Summary PSAP Overview Federal Role and existing work in Cyber PSAPs: Cybersecurity Plan For The Future Use Cases Best Practices Questions or Discussion High-level overview for the FCC update Include approach to the: Analysis and Findings that will lead to Conclusions & Recommendations; Additional Notes: High level strategy recommendations  based on: Best practices Proposed architectures developed by WG2, Manageable and scalable core network elements distributed to the PSAP level, or if so desired implemented at the PSAP level. New EC3 concept takes advantage of economies of scale, allows for local, State and Federal participation along with information and cost sharing Anticipate both architecture recommendation and cost estimates in final report

Section 1: Overview of PSAP Environment FCC Task Force on Optimal PSAP Architecture Section 1: Overview of PSAP Environment PSAP– CyberSecurity Today Governance Access Control Security Controls Internal network security and monitoring Network entry point security Executive Summary PSAP Overview In this section, WG1 provides information on the current cybersecurity practices taken to protect Legacy and Next Generation PSAPs by existing commercial providers Governance With the convergence of communications capabilities, it is clear that communications interoperability and security cannot be solved by any one entity, but requires a partnership among response entities across all levels of government and functions to ensure the right information is delivered securely to the right people at the right time. Governance is pivotal to secure operable and interoperable emergency communications.  Robust governance establishes and maintains a central coordination point (or body) for efforts across the broad spectrum of public safety stakeholders, and can help to address challenges in a unified manner.  The presence of an active and transparent governance body fosters relationships, collaboration, and information sharing to better balance fiscal, technological, and policy-driven public safety needs.  Access Control - Policy - identifies proper approval based on access gates and ratings; Physical Security – Limited access and based on need to know Human Resources- HR procedures should be developed to include preventative measures such as background checks. Security Controls - Business Continuity Plan/Disaster Recovery ; Geo-diverse in Active/Active or N+1 computing element configurations; Media Handling; Incident Management ; Testing ; Vulnerability Management Internal Network Security and Monitoring - Private DNS (internal facing only); External network connections Network entry point security SS7 messaging management/filtering (protects call control components) IP data entry points (SIP for NextGen) - use Border Control Functions (BCFs), including Session Border Controllers, Firewalls, packet filtering, message type limitations, encryption and secured authenticated external interfaces. All ingress and egress paths are secured, communication occurs only between pre-authenticated entities.  All communication of sensitive data is encrypted. Transport Layer Security (TLS) must be used for transmission between network elements to encrypt the message. In addition IPSEC may be used to manage internetwork connections. Subnetworks for publicly accessible system components are implemented.

Section 2: Federal Role and Existing Work FCC Task Force on Optimal PSAP Architecture Section 2: Federal Role and Existing Work U.S. Department of Commerce NIST: Cybersecurity Framework NIST: Cyber Physical Systems- Public Work Group Report Relationship To PSAPs: Identify, Protect, Detect, Respond, Recover NIST/NICE Workforce Framework Relationship of occupational specialties to PSAPs Define any new/missing occupational specialties Consider Cyber Professional Best Practices for PSAP workforce Role of Federal Agencies / Reports NIST Framework - Identify, Protect, Detect, Respond, Recover- Discussion of NIST Framework and how to relate it directly to public safety communication. Map out the “functions” identified in the Framework to specific “levels” within public safety environment. Cyber Physical systems - A draft framework to guide the development of cyber-physical systems (CPS) has been issued for public comment by the National Institute of Standards and Technology. “Certainly, many of the cybersecurity challenges that apply to IT systems also apply to CPS.  However, some challenges may not have the same criticality in the CPS space as they do in IT systems, and CPS may pose additional challenges not present in the IT space,” Given enough time, WG1 can review and incorporate recommendations that relate to public safety. Absent additional time, this would be a recommendation for the next iteration of TFOPA should there be one. NICE Framework - Working Group members reviewed job titles to assess NICE Framework labor categories, scope of work, and Information Technology skills most closely associated with each. While PSAPs generally do not have a single consistent model for job titles, a generalized set of job titles were mapped to labor categories with identification of required skills and recommended training based on the NICE Workfroce Framework. DHS – No data provided to date

Section 2: Federal Role and Existing Work FCC Task Force on Optimal PSAP Architecture Section 2: Federal Role and Existing Work Department of Homeland Security Critical Infrastructure Cyber Community Voluntary Program (C3VP) Critical Infrastructure Cyber Information Sharing and Collaboration Program (CISCP) Cyber Reports & Recommendations Cybersecurity Products & Solutions: Continuous Diagnostics and Mitigation (CDM) Intrusion detection sensors (IDS) Intrusion prevention sensors (IPS) Trusted Internet Connection (TIC) National Cybersecurity and Communications Integration Center (NCCIC) NCCIC/National Coordinating Center for Communications (NCC) NCCIC/United States Computer Emergency Readiness Team (US-CERT) Role of Federal Agencies / Reports DHS

Section 2: Federal Role and Existing Work FCC Task Force on Optimal PSAP Architecture Section 2: Federal Role and Existing Work General Services Administration Identity Credentialing Access Management (ICAM) NIST Special Publication 800-63-2 FICAM Roadmap and Implementation Guidance Identity Management Credential Management Access Management ICAM Intersection ICAM Goals and Objectives Role of Federal Agencies / Reports ICAM - The ICAM segment architecture establishes the foundation for trust and interoperability in conducting electronic transactions both within the Federal Government and with external organizations. It encompasses the core capabilities to be able to identify, authenticate, and authorize individuals to provide appropriate access to resources, which is the lynchpin to the success of the national Cybersecurity initiative.

Section 3 PSAP: Cybersecurity Plan For The Future FCC Task Force on Optimal PSAP Architecture Section 3 PSAP: Cybersecurity Plan For The Future Evaluation and Recommendations on: Emergency Communications Cybersecurity Center (EC3) Intrusion Detection and Prevention Systems (IDPS) IDPS in NG9-1-1 environment PSAPs: CyberSecurity Plan For The Future In addition to incorporating current best practices, NIST recommendations, and current work from DHS, APCO and NENA the working group has determined that an additional layer should be introduced into the recommended future architecture.   The intent of this logical architecture recommendation is to create a centralized function, and location, for securing NG networks and systems. By centralizing certain features, including cybersecurity in general, and intrusion detection and prevention services (IDPS) specifically, public safety can take advantage of economies of scale, multiple resources, and systems and best practices which may already be in place or at a minimum readily available for deployment and use.

FCC Task Force on Optimal PSAP Architecture

FCC Task Force on Optimal PSAP Architecture

Section 3 PSAP: Cybersecurity Plan For The Future FCC Task Force on Optimal PSAP Architecture Section 3 PSAP: Cybersecurity Plan For The Future PSAPs: Funding The Cybersecurity Plan Federal Funding Opportunities Partnerships PSAP Cybersecurity Checklist PSAP Cybersecurity Roadmap PSAPs: CyberSecurity Plan For The Future In the proposed architecture for NG9-1-1 Cybersecurity, the Emergency Communications Cybersecurity Center (EC3) will take on the role of providing IDPS services to PSAPs and any other emergency communications service or system that would consider utilizing the centralized, core services architecture proposed. For example, not only PSAPs but Emergency Operations Centers (EOCs) and potentially the Nationwide Public Safety Broadband Network operated and maintained by FirstNet, could also interconnect to the EC3 service. This approach would allow public safety to build one infrastructure and use it for many clients. This provides significant economies of scale, puts multiple Federal, State, Local and Tribal resources into the same protection scheme, and allows for sharing of data, mitigation strategies, and recovery efforts across enterprise. Funding opportunities may exist and are being explored by the WG. Recommendations for consideration will be included in the final report. Potential partnerships will also be noted along with (hopefully) cost estimates at a high level for the core architecture piece.

Appendix A- PSAP: Cybersecurity Use Cases FCC Task Force on Optimal PSAP Architecture Appendix A- PSAP: Cybersecurity Use Cases Specific Use Cases Addressing: TDoS DDoS SWATTING Single PSAP Compromised, Need exists to protect Interconnected PSAPs Data Hijacked PSAP Network Compromised Use Cases

Appendix B: Cybersecurity Best Practices for PSAPs FCC Task Force on Optimal PSAP Architecture Appendix B: Cybersecurity Best Practices for PSAPs Analysis & Findings of FCC CSRIC Best Practices Recommendations for development of 911/PSAP specific Cybersecurity Best Practices Best Practices

FCC Task Force on Optimal PSAP Architecture Questions / Discussion