1. Cybersecurity : Optimal Approach for PSAPs
High level overview
FCC Task Force on Optimal PSAP Architecture
Working Group 1 Update
September 29, 2015

2. Presentation Outline: Status Report
FCC Task Force on Optimal PSAP Architecture
Presentation Outline: Status Report
Draft Report Structure
Executive Summary
PSAP Overview
Federal Role and existing work in Cyber
PSAPs: Cybersecurity Plan For The Future
Use Cases
Best Practices
Questions or Discussion
High-level overview for the FCC update
Include approach to the: Analysis and Findings that will lead to Conclusions & Recommendations;
Additional Notes: High level strategy recommendations  based on:
Best practices
Proposed architectures developed by WG2,
Manageable and scalable core network elements distributed to the PSAP level, or if so desired implemented at the PSAP level.
New EC3 concept takes advantage of economies of scale, allows for local, State and Federal participation along with information and cost sharing
Anticipate both architecture recommendation and cost estimates in final report

3. Section 1: Overview of PSAP Environment
FCC Task Force on Optimal PSAP Architecture
Section 1: Overview of PSAP Environment
PSAP– CyberSecurity Today
Governance
Access Control
Security Controls
Internal network security and monitoring
Network entry point security
Executive Summary
PSAP Overview
In this section, WG1 provides information on the current cybersecurity practices taken to protect Legacy and Next Generation PSAPs by existing commercial providers
Governance
With the convergence of communications capabilities, it is clear that communications interoperability and security cannot be solved by any one entity, but requires a partnership among response entities across all levels of government and functions to ensure the right information is delivered securely to the right people at the right time. Governance is pivotal to secure operable and interoperable emergency communications.  Robust governance establishes and maintains a central coordination point (or body) for efforts across the broad spectrum of public safety stakeholders, and can help to address challenges in a unified manner.  The presence of an active and transparent governance body fosters relationships, collaboration, and information sharing to better balance fiscal, technological, and policy-driven public safety needs. 
Access Control - Policy - identifies proper approval based on access gates and ratings; Physical Security – Limited access and based on need to know
Human Resources- HR procedures should be developed to include preventative measures such as background checks.
Security Controls - Business Continuity Plan/Disaster Recovery ; Geo-diverse in Active/Active or N+1 computing element configurations;
Media Handling; Incident Management ; Testing ; Vulnerability Management
Internal Network Security and Monitoring - Private DNS (internal facing only); External network connections
Network entry point security
SS7 messaging management/filtering (protects call control components)
IP data entry points (SIP for NextGen) - use Border Control Functions (BCFs), including Session Border Controllers, Firewalls, packet filtering, message type limitations, encryption and secured authenticated external interfaces.
All ingress and egress paths are secured, communication occurs only between pre-authenticated entities. 
All communication of sensitive data is encrypted. Transport Layer Security (TLS) must be used for transmission between network elements to encrypt the message. In addition IPSEC may be used to manage internetwork connections.
Subnetworks for publicly accessible system components are implemented.

4. Section 2: Federal Role and Existing Work
FCC Task Force on Optimal PSAP Architecture
Section 2: Federal Role and Existing Work
U.S. Department of Commerce
NIST: Cybersecurity Framework
NIST: Cyber Physical Systems- Public Work Group Report
Relationship To PSAPs: Identify, Protect, Detect, Respond, Recover
NIST/NICE Workforce Framework
Relationship of occupational specialties to PSAPs
Define any new/missing occupational specialties
Consider Cyber Professional Best Practices for PSAP workforce
Role of Federal Agencies / Reports
NIST Framework - Identify, Protect, Detect, Respond, Recover- Discussion of NIST Framework and how to relate it directly to public safety communication. Map out the “functions” identified in the Framework to specific “levels” within public safety environment.
Cyber Physical systems - A draft framework to guide the development of cyber-physical systems (CPS) has been issued for public comment by the National Institute of Standards and Technology. “Certainly, many of the cybersecurity challenges that apply to IT systems also apply to CPS.  However, some challenges may not have the same criticality in the CPS space as they do in IT systems, and CPS may pose additional challenges not present in the IT space,” Given enough time, WG1 can review and incorporate recommendations that relate to public safety. Absent additional time, this would be a recommendation for the next iteration of TFOPA should there be one.
NICE Framework - Working Group members reviewed job titles to assess NICE Framework labor categories, scope of work, and Information Technology skills most closely associated with each. While PSAPs generally do not have a single consistent model for job titles, a generalized set of job titles were mapped to labor categories with identification of required skills and recommended training based on the NICE Workfroce Framework.
DHS – No data provided to date

5. Section 2: Federal Role and Existing Work
FCC Task Force on Optimal PSAP Architecture
Section 2: Federal Role and Existing Work
Department of Homeland Security
Critical Infrastructure Cyber Community Voluntary Program (C3VP)
Critical Infrastructure Cyber Information Sharing and Collaboration Program (CISCP)
Cyber Reports & Recommendations
Cybersecurity Products & Solutions:
Continuous Diagnostics and Mitigation (CDM)
Intrusion detection sensors (IDS)
Intrusion prevention sensors (IPS)
Trusted Internet Connection (TIC)
National Cybersecurity and Communications Integration Center (NCCIC)
NCCIC/National Coordinating Center for Communications (NCC)
NCCIC/United States Computer Emergency Readiness Team (US-CERT)
Role of Federal Agencies / Reports
DHS

6. Section 2: Federal Role and Existing Work
FCC Task Force on Optimal PSAP Architecture
Section 2: Federal Role and Existing Work
General Services Administration
Identity Credentialing Access Management (ICAM)
NIST Special Publication
FICAM Roadmap and Implementation Guidance
Identity Management
Credential Management
Access Management
ICAM Intersection
ICAM Goals and Objectives
Role of Federal Agencies / Reports
ICAM - The ICAM segment architecture establishes the foundation for trust and interoperability in conducting electronic transactions both within the Federal Government and with external organizations. It encompasses the core capabilities to be able to identify, authenticate, and authorize individuals to provide appropriate access to resources, which is the lynchpin to the success of the national Cybersecurity initiative.

7. Section 3 PSAP: Cybersecurity Plan For The Future
FCC Task Force on Optimal PSAP Architecture
Section 3 PSAP: Cybersecurity Plan For The Future
Evaluation and Recommendations on:
Emergency Communications Cybersecurity Center (EC3)
Intrusion Detection and Prevention Systems (IDPS)
IDPS in NG9-1-1 environment
PSAPs: CyberSecurity Plan For The Future
In addition to incorporating current best practices, NIST recommendations, and current work from DHS, APCO and NENA the working group has determined that an additional layer should be introduced into the recommended future architecture.
The intent of this logical architecture recommendation is to create a centralized function, and location, for securing NG networks and systems. By centralizing certain features, including cybersecurity in general, and intrusion detection and prevention services (IDPS) specifically, public safety can take advantage of economies of scale, multiple resources, and systems and best practices which may already be in place or at a minimum readily available for deployment and use.

8. FCC Task Force on Optimal PSAP Architecture

9. FCC Task Force on Optimal PSAP Architecture

10. Section 3 PSAP: Cybersecurity Plan For The Future
FCC Task Force on Optimal PSAP Architecture
Section 3 PSAP: Cybersecurity Plan For The Future
PSAPs: Funding The Cybersecurity Plan
Federal Funding Opportunities
Partnerships
PSAP Cybersecurity Checklist
PSAP Cybersecurity Roadmap
PSAPs: CyberSecurity Plan For The Future
In the proposed architecture for NG9-1-1 Cybersecurity, the Emergency Communications Cybersecurity Center (EC3) will take on the role of providing IDPS services to PSAPs and any other emergency communications service or system that would consider utilizing the centralized, core services architecture proposed. For example, not only PSAPs but Emergency Operations Centers (EOCs) and potentially the Nationwide Public Safety Broadband Network operated and maintained by FirstNet, could also interconnect to the EC3 service. This approach would allow public safety to build one infrastructure and use it for many clients. This provides significant economies of scale, puts multiple Federal, State, Local and Tribal resources into the same protection scheme, and allows for sharing of data, mitigation strategies, and recovery efforts across enterprise.
Funding opportunities may exist and are being explored by the WG. Recommendations for consideration will be included in the final report. Potential partnerships will also be noted along with (hopefully) cost estimates at a high level for the core architecture piece.

11. Appendix A- PSAP: Cybersecurity Use Cases
FCC Task Force on Optimal PSAP Architecture
Appendix A- PSAP: Cybersecurity Use Cases
Specific Use Cases Addressing:
TDoS
DDoS
SWATTING
Single PSAP Compromised, Need exists to protect Interconnected PSAPs
Data Hijacked
PSAP Network Compromised
Use Cases

12. Appendix B: Cybersecurity Best Practices for PSAPs
FCC Task Force on Optimal PSAP Architecture
Appendix B: Cybersecurity Best Practices for PSAPs
Analysis & Findings of FCC CSRIC Best Practices
Recommendations for development of 911/PSAP specific Cybersecurity Best Practices
Best Practices

13. FCC Task Force on Optimal PSAP Architecture
Questions / Discussion