70RSAT19RB00000001_-_5_CISA_S&T_EC3_Brief_5-16-2019.pdf

DHS SCIENCE AND TECHNOLOGY

Emergency Communications Cybersecurity Center (EC3)

Sridhar Kowdley

Program Manager First Responders & Detection Science and Technology Directorate

May 16, 2019

C I S A | C Y B E R S E C U R I T Y A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y

EMERGENCY

COMMUNICATIONS

CYBERSECURITY CENTER

(EC3)

Improving Next Generation 911 (NG911) cybersecurity posture

TLP:WHITE

EC3 Concept & Refinement Strategy May 16, 2019

Originating Service Provider

Selective Router

Public Safety Answering Point (PSAP)

Legacy 911:

Security through control and isolation

Circuit-switched, voice

NG911:

No defined end-to-end security strategy…yet

IP-based, multimedia

Ongoing transition to IP-based architectures is increasing exposure to cyber threats and vulnerabilities that did not exist in the legacy environments

May 16, 2019

NG911 Core Services and Emergency Services IP Networks (ESInets) are operational and experiencing an increasing rate of adoption nationwide

ESInet

• Provides the foundation for NG911 services*

• Based on NENA i3 or ATIS IMS-based standards

• Enables increasing interconnection

Number of ESInet-connected PSAPs by state

2017 National 9-1-1 Progress Report

*End state NG9-1-1 will not be available until there are IP call handling capabilities at the

ECC/PSAPs and end-to-end IP call delivery available from the originating service provider(s) to the

ECC/PSAPs 2017 National 9-1-1 Progress Report

May 16, 2019

Though ESInet adoption continues, a comprehensive end-to-end NG911 security architecture is absent, and the threats are perilous

Typical Cyber Attacks Against PSAPs

Ransomware

Use of software to block computer systems for the purpose of extorting a ransom

• Maine, Arkansas, Tennessee law enforcement agencies

• California Health Care

• Licking County, OH PSAP

• Washington, DC CCTV

Telephony Denial of Service (TDoS)

Use of Voice over Internet Protocol (VOIP) systems to overwhelm the answering point’s phone system, rendering the center incapable of placing or receiving calls

• 300+ TDoS vs Public Safety (911, Law Enforcement, Fire, EMS, Emergency Management)

• 12 State TDoS event

Swatting Manipulation of IP-based 911 calls to indicate the call is originating from a location at which a most serious criminal act has taken or is taking place (e.g., armed and violent hostage takers) or similar situations so significant that the local PSAP dispatches a Special Weapons and Tactics (SWAT) team to the address

• Known incidents Nationwide

• Commercial-Off-the-Shelf (COTS) products

• Impact expanding

May 16, 2019

FCC’s Task Force on Optimal Public Safety Answering Point Architecture (TFOPA) recommended Emergency Communication Cybersecurity Centers (EC3s)

The EC3 layer represents the opportunity to create a manageable core infrastructure to support cybersecurity for distributed emergency communications network elements.

Source: TFOPA Adopted Final Report, 29 Jan 2016

May 16, 2019

TFOPA also recommended a near-term “funded pilot for the development and deployment of an EC3”. CISA is in the process of refining the EC3 concept for pilot efforts

Need for Pilot:

• Necessary to improve the cybersecurity of the Nation’s 9-1-1 system

• Agreed to by government, industry, and academia

• Requires federal leadership

CISA – ECC/PSAP coordination, subject matter expertise, outcome management S&T – Vendor coordination, pilot funding, and test plans

Objectives:

• Proof-of-concept

• Defined implementation challenges for the community

Desired Outcomes:

• Mission-based system designed for user (PSAP/system administrator) experience and value at the forefront

• Documented system requirements and capability limitations

• Cybersecurity outputs that can be correlated into actionable data and integrated into mitigations

May 16, 2019

Next steps include continued refinement of the concept with stakeholders throughout the ecosystem

Federal leadership

• Ensure the cohesive and collective planning, designing, and piloting of

EC3s into the emergency communications landscape

Industry and academia

• Demonstrations of existing cybersecurity solutions

• Innovation in emerging cybersecurity solutions

• Collection of service provider and vendor insights on current cybersecurity capabilities, demarcation points, and best practices

Public safety stakeholders

• Define current way of operating from a user’s perspective

• Contrast to future methods (considering new threats/conditions)

• Document mission capability gaps

May 16, 2019 9

For more information:

cisa.gov