Jim Lockard, ENP Brian Knueppel C. A. Patrick Voigt, ENP Cybersecurity & Resiliency in Core Services & the NG9-1-1 PSAP & Network Jim Lockard, ENP Brian Knueppel C. A. Patrick Voigt, ENP

Introduction Overview of NG9-1-1 and Security Cyber security landscape Risk management Threats and Vulnerabilities Penetration testing Operations Considerations

9-1-1 9-1-1”Gotchas” 240M 9-1-1 calls annually 6,000 PSAPs 18,700 Law Enforcement Agencies 2,900 Fire Departments 12,200 Emergency Medical Agencies

How secure are you? What’s wrong with this picture? What level of security is being offered? The gate is locked, properly installed and configured to do what it is supposed to…… But….

Axioms to keep in mind Security and complexity are often inversely proportional Security and usability are often inversely proportional Good security now is better than perfect security never A false sense of security is worse than a true sense of security Your security is only as strong as your weakest link It is best to concentrate on known, probable threats Security is an investment, not an expense

NG9-1-1 NG9-1-1 is comprised of an interconnected framework of hardware, software, data, operational policies and procedures. ESInets IP Standards Data Human Processes SECURITY

NG9-1-1 Ecosystem / Simplified Data CAD SOP Mapping GIS CSP Networks (TDM) CSP Networks (IP) Extended Emergency Networks Radio Networks PSAP Networks NG Core Services

What kinds of threats can happen? SOURCE: The 2014 Cyber Security Intelligence Index by IBM 

Where are we headed? Today Future Common user trust level (and clearances) across the system environment User trust level by transaction Privileges gained by access to rudimentary roles Privilege assigned to user/DEVICE based upon operational role that can be changed Information "authority" determines required level of protection for the most sensitive information Information "authority" determines the required level of end-to-end protection required to information Manual reviews for releasing information Automated mechanisms allow information to be shared "released" when users/devices have proper privileges Manual analysis of procedures to determine connections

Who is against us Espionage and Sabotage Disasters and accidents Passive intercept attacks Malicious outsider attacks Insider attacks Hardware / Software distribution attacks

Threat Vectors Source Intentional Natural Unintentional Outsider Poorly trained staff Accidents Fires Floods Power Etc Outsider Insider Foreign intelligence hacks Terrorists Criminals Corporate raiders Hackers Disgruntled Employee Service providers Contractors Poor SOP’s

NG9-1-1 Security, ESInet Design SIP & apps Operating systems Support services Network protocols Physical Policies & Procedures Risk Attack, overload, outages Intrusion Privacy Internal threats Follow standards Enryption TLS, SRTP How to Design Encrypt Detect Prepare

Points of attack Interfaces Routers Functional Elements Protocols

Complex stuff Basic call flow example from NENA 08-003v2 Perform extensive tests or calls will fail One weak stick breaks it down What about deployment?

Industry Collaboration Event (ICE) Value of ICE IP Multimedia around for years new to 9-1-1 Solidifying NG9-1-1 starts here

Some additional considerations Internet of Things (IoT) Applications FirstNet Complexity

Suspicion and Bad Actor Do we take calls from the bad guys? INVITE sip:911@host:5060;transport=tcp SIP/2.0 Via: SIP/2.0/TCP host:5060;branch=z9hG4bKk1u8v200do10fl0ij7u1.1;NENA-CallSuspicion=100 From: "3145551212" <sip:3145551212@host;transport=udp>;tag=SDnj5j101-2728010a-13c4-4dceadbd-29a568-740ea291 To: <sip:911@host;transport=udp> User-Agent: friendly-scanner Call-Info: urn:nena:uid:incidentid:CXC257631acb70270515162805566Z:ibcf.charlotte.nc.us;purpose=nena-IncidentId x-NENA-CallSuspicion: 100 SIP/2.0 600 Your call is suspicious and has been rejected From: "3145551212" <sip:3145551212@172.17.1.62;transport=udp>;tag=SDiu0eb01-2728010a-13c4-4dcf3f4d-2623fec-26287d21 To: <sip:911@host;transport=udp>;tag=3f0111ac-13c4-53757cd3-22b6252-7710c623 Via: SIP/2.0/TCP host:5060;branch=z9hG4bK74fmbc1048n03och1020.1;NENA-CallSuspicion=100

Hacking is easy and fun Search: https://video.search.yahoo.com/search/video?fr=yfp-t&p=how+to+hack+sip+network#id=3&vid=2fa852ec2dc170eb8ad0bce744fc9c39&action=click

Penetration Testing Very few do this You should do it State XX did it Here is how you do it Understanding the results

Operations You ‘will’ be attacked Biggest failures were when there was failure to cover the basics Patch/security updates Access controls Default credentials User authorization levels Constantly evolving risk Not One Size Fits All. Everyone is different Security is mindset not just a checklist NIST, DHS, and NENA

Operations – How to Encrypt vs not Authentication Pros Additional security Cons Troubleshooting Where to employ? Authentication What will be attacked By whom

Questions/Collaboration Ecosystem New apps/connectivity Lifecycle Testing Policy