2. Jim Lockard, ENP Brian Knueppel C. A. Patrick Voigt, ENP
Cybersecurity & Resiliency in Core Services & the NG9-1-1 PSAP & Network
Jim Lockard, ENP
Brian Knueppel
C. A. Patrick Voigt, ENP

3. Introduction Overview of NG9-1-1 and Security Cyber security landscape
Risk management
Threats and Vulnerabilities
Penetration testing
Operations
Considerations

4. 9-1-1 9-1-1”Gotchas” 240M 9-1-1 calls annually 6,000 PSAPs
18,700 Law Enforcement Agencies
2,900 Fire Departments
12,200 Emergency Medical Agencies

5. How secure are you? What’s wrong with this picture?
What level of security is being offered? The gate is locked, properly installed and configured to do what it is supposed to…… But….

6. Axioms to keep in mind
Security and complexity are often inversely proportional
Security and usability are often inversely proportional
Good security now is better than perfect security never
A false sense of security is worse than a true sense of security
Your security is only as strong as your weakest link
It is best to concentrate on known, probable threats
Security is an investment, not an expense

7. NG9-1-1
NG9-1-1 is comprised of an interconnected framework of hardware, software, data, operational policies and procedures.
ESInets
IP Standards
Data
Human Processes
SECURITY

8. NG9-1-1 Ecosystem / Simplified
Data
CAD
SOP
Mapping
GIS
CSP Networks
(TDM)
CSP Networks
(IP)
Extended Emergency Networks
Radio Networks
PSAP Networks
NG Core Services

11. What kinds of threats can happen?
SOURCE: The 2014 Cyber Security Intelligence Index by IBM 

12. Where are we headed? Today Future
Common user trust level (and clearances) across the system environment
User trust level by transaction
Privileges gained by access to rudimentary roles
Privilege assigned to user/DEVICE based upon operational role that can be changed
Information "authority" determines required level of protection for the most sensitive information
Information "authority" determines the required level of end-to-end protection required to information
Manual reviews for releasing information
Automated mechanisms allow information to be shared "released" when users/devices have proper privileges
Manual analysis of procedures to determine connections

13. Who is against us Espionage and Sabotage Disasters and accidents
Passive intercept attacks
Malicious outsider attacks
Insider attacks
Hardware / Software distribution attacks

14. Threat Vectors Source Intentional Natural Unintentional Outsider
Poorly trained staff
Accidents
Fires
Floods
Power
Etc
Outsider
Insider
Foreign intelligence hacks
Terrorists
Criminals
Corporate raiders
Hackers
Disgruntled Employee
Service providers
Contractors
Poor SOP’s

15. NG9-1-1 Security, ESInet Design
SIP & apps
Operating systems
Support services
Network protocols
Physical
Policies & Procedures
Risk
Attack, overload, outages
Intrusion
Privacy
Internal threats
Follow standards
Enryption
TLS, SRTP
How to
Design
Encrypt
Detect
Prepare

16. Points of attack
Interfaces
Routers
Functional Elements
Protocols

17. Complex stuff Basic call flow example from NENA 08-003v2
Perform extensive tests
or calls will fail
One weak stick breaks it down
What about deployment?

18. Industry Collaboration Event (ICE)
Value of ICE
IP Multimedia around for years new to 9-1-1
Solidifying NG9-1-1 starts here

19. Some additional considerations
Internet of Things (IoT)
Applications
FirstNet
Complexity

20. Suspicion and Bad Actor
Do we take calls from the bad guys?
INVITE SIP/2.0
Via: SIP/2.0/TCP host:5060;branch=z9hG4bKk1u8v200do10fl0ij7u1.1;NENA-CallSuspicion=100
From: " "
To:
User-Agent: friendly-scanner
Call-Info: urn:nena:uid:incidentid:CXC257631acb Z:ibcf.charlotte.nc.us;purpose=nena-IncidentId
x-NENA-CallSuspicion: 100
SIP/ Your call is suspicious and has been rejected
From: " "
To:
Via: SIP/2.0/TCP host:5060;branch=z9hG4bK74fmbc1048n03och1020.1;NENA-CallSuspicion=100

21. Hacking is easy and fun
Search:

22. Penetration Testing Very few do this You should do it State XX did it
Here is how you do it
Understanding the results

23. Operations You ‘will’ be attacked
Biggest failures were when there was failure to cover the basics
Patch/security updates
Access controls
Default credentials
User authorization levels
Constantly evolving risk
Not One Size Fits All. Everyone is different
Security is mindset not just a checklist
NIST, DHS, and NENA

24. Operations – How to Encrypt vs not Authentication
Pros
Additional security
Cons
Troubleshooting
Where to employ?
Authentication
What will be attacked
By whom

25. Questions/Collaboration
Ecosystem
New apps/connectivity
Lifecycle
Testing
Policy