1. Homeland Security Cyber Strategies & Resources for Resiliency Spring Directors Conference 2013 UNCLASSIFIED/FOR OFFICIAL USE ONLY Richard C. Baron Executive Director Ohio Homeland Security Homeland Security Advisor to Ohio

3. What Does Cyber Threat Mean UNCLASSIFIED/FOR OFFICIAL USE ONLY Risk = Threat X Vulnerability X Consequence Vulnerability= What is the vulnerability Consequence = What is the consequence Threat = What is the threat Risk = What is at risk

4. Cyber Space UNCLASSIFIED/FOR OFFICIAL USE ONLY.com/.net/.org.mobi/…. Public/Corpoate Domain.mil Military Domain.gov/.us Governmental Domain

5. Cyber Environment UNCLASSIFIED/FOR OFFICIAL USE ONLY Cyberspace is where the Nation stores its treasure (intellectual property) and its wealth (money) Benefits: National securityNational security Economic competivenessEconomic competiveness Public safetyPublic safety Civil liberties & privacyCivil liberties & privacy Information Layer Physical Infrastructure Geographic Layer People Cyber Identity Source U.S Cyber Command

6. Changing Environment UNCLASSIFIED/FOR OFFICIAL USE ONLY Source U.S Cyber Command Unprecedented rate of change - Consumerization of IT technology Mobile Computing Rapidly expanding environment with companies not focused on the threats BYOD – Bring your own device (to work) Adoption of the “cloud computing” model Social Networks Geographical Information Systems (GIS) Integrated real time sensors, telemetry and resource tasking Multiple sources of data Deliberate attacks from Viruses/malware exploiting the changing landscape

7. Threat Actors UNCLASSIFIED/FOR OFFICIAL USE ONLY Source U.S Cyber Command TERRORIST ACTS CRIMINALELEMENTS HACKTIVISTS FOREIGNINTELLIGENCE SUPPLY CHAIN VULNERABILITY WIRELESS ACCESS POINTS REMOVABLE MEDIA NEGLIGENT USERS INSIDER THREATS

8. Focus of CYBER Security UNCLASSIFIED/FOR OFFICIAL USE ONLY People Systems

9. 9 Rick’s Rules #1 UNCLASSIFIED/FOR OFFICIAL USE ONLY Source U.S Cyber Command The time to plan is not at the time of crisis!

10. 10 Rick’s Rules #2 UNCLASSIFIED/FOR OFFICIAL USE ONLY The event causing the crisis de jour was most likely not an event that could or was not anticipated!

11. 11 Gordon Graham’s Rule of Risk Management UNCLASSIFIED/FOR OFFICIAL USE ONLY If it is predictable its preventable!

12. Significant Trends ( Targets – U.S. “vital services ”) Source U.S Cyber Command UNCLASSIFIED (U//FOUO) Operation Black Summer (#OpBlackSummer) – Orchestrated by hacktivists groups Tunisian Cyber Army (TCA) and the Al Qaeda Electronic Cyber Army. The premise of the operation is to hack into varied U.S. systems, steal information, and release the information in a large data release on 11 September 2013. Main start-date is 31 May 2013. Examples of the areas already targeted and hacked – U.S. State Department, Army National Guard, Custom and Border Protection, etc.) Tactic used – SQL injection vulnerabilities Sub-operation for #OpBlackSummer is called #FridayOfHorror, and usually targets one area following Friday prayer (ex: aviation systems, financial sector, etc.) TCA infiltrated a State of Ohio agency workstation in Chillicothe, OH 19 April 2013. This is currently being investigated by OSP. UNCLASSIFIED/FOR OFFICIAL USE ONLY

13. Significant Trends (VOIP) Source U.S Cyber Command UNCLASSIFIED (U//FOUO) Telephony Denial of Service (TDoS) – An international issue that involves the flooding of telephone systems from digitalized calls, usually targeting Voice over IP (VoIP) systems. The caller uses a spoofed number, and is usually located overseas in areas such as India. Result of intentional generation of illegitimate computer-generated phone traffic targeting a victim’s phone systems Some leverage Voice Over Internet Protocol (VOIP) telephone equipment Has the potential to significantly disrupt legitimate telephone call volume and impact continuity of operations Scheme: Payday loan scam or employee debt Targets: Public sector entities, including PSAPs, emergency communication centers, and businesses targeted

14. Significant Trends (VOIP) Source U.S Cyber Command UNCLASSIFIED Ohio Incidents: Ohio: Nov 2011 – 3 hospital lines flooded, Reported in February from Mentor Police Department (Cleveland) – Payday scamLE involved in business call, victim called local PD Then flooded police and fire emergency lines – 5 minutes February: Dublin local business received harassing phone calls of employee debt, threatening legal action called 40 times in 2 days. Brunswick city school system, Feb 2013 Payday loan scam “lit up all their phones” – VOIP for 2 days, hit off and on. UNCLASSIFIED/FOR OFFICIAL USE ONLY

15. Presidential Executive Order 21 Policy It is the policy of the United States to strengthen the security and resilience of its critical infrastructure against both physical and cyber threats. The Federal Government shall work with critical infrastructure owners and operators and SLTT entities to take proactive steps to manage risk and strengthen the security and resilience of the Nation's critical infrastructure, considering all hazards that could have a debilitating impact on national security, economic stability, public health and safety, or any combination thereof. These efforts shall seek to reduce vulnerabilities, minimize consequences, identify and disrupt threats, and hasten response and recovery efforts related to critical infrastructure.

16. UNCLASSIFIED/FOR OFFICIAL USE ONLY 1. Develop a State Cybersecurity Strategy, 2. Appoint a Cybersecurity Committee 3. Request and receive regular security briefings 4. Practice cyber incident response 5. Request attorneys review current IT contracts with vendors for security provisions. 6. Ensure that hardware and software are being procured in a “secure manner.” 7. Request attorneys review contractual relationships with third party service providers 8. Use Multistate Information Sharing and Analysis Centers (ISACs) for intrusion detection and prevention, vulnerability scanning, penetration testing, and training and education services. 9. Ensure that security and procurement/acquisition staff receive training and resources 10. Identify business continuity and disaster recovery initiatives 11. Work with law enforcement to prioritize cybersecurity. 12. Use convening authority to raise statewide awareness. Twelve Steps Governors Can Take to Improve Cybersecurity

17. Cybersecurity, Education, & Economic Development Council 121.92 Cybersecurity, education, and economic development council. (A)There is hereby created the cybersecurity, education, and economic development council. (G) The council shall conduct a study and make recommendations regarding both of the following: (1) Improving the infrastructure of the state's cybersecurity operations with existing resources and through partnerships between government, business, and institutions of higher education; (2) Specific actions that would accelerate growth of the cybersecurity industry in the state.

18. OHS Strategic Plan Protection Goal 3: Reduce risk to statewide infrastructure by implementing the National Infrastructure Protection Plan and each of the supporting Sector Specific Plans where applicable. Risk reduction programs will address cyber, human, and physical security. Cyber attacks often occur unnoticed, disrupting commerce and costing an estimated total of $46–70 billion in losses across the U.S.

19. OHS Cyber-Security Strategy Initiative 1: Share cyber security threat information across the homeland security enterprise. Initiative 2: Create a cyber security culture in state and local government. Initiative 3: Partner with the public and private sectors to support their cyber security efforts. Initiative 4: Identify cyber resources (human and equipment) to leverage for creating cyber incident response teams. Initiative 5: Raise cyber security awareness across Ohio.

20. Resources Personal & Business Information

21. Resources Public Sector Monitoring UNCLASSIFIED/FOR OFFICIAL USE ONLY Source U.S Cyber Command 21 IT-ISAC members participate in national and homeland security efforts to strengthen the IT infrastructure through cyber information sharing and analysis. Information Technology ISAC (IT-ISAC) In February 2010, the Department of Defense (DoD), DHS, and the FS-ISAC launched a pilot designed to improve the sharing of sensitive, actionable information. Financial Services ISAC (FS-ISAC) The MS-ISAC provides a common mechanism for raising the level of cybersecurity readiness and response in state, local, tribal, and territorial (SLTT) governments. Multi-State ISAC (MS-ISAC)

22. 22 Resources – SAIC Daily Briefing UNCLASSIFIED/FOR OFFICIAL USE ONLY

23. UNCLASSIFIEDFOR OFFICIAL USE ONLY Source U.S Cyber Command UNCLASSIFIED UNCLASSIFIED/FOR OFFICIAL USE ONLY

24. 24 Resources – SAIC Daily Briefing UNCLASSIFIED/FOR OFFICIAL USE ONLY

25. Questions & Discussion UNCLASSIFIED/FOR OFFICIAL USE ONLY

26. Contact Information UNCLASSIFIED/FOR OFFICIAL USE ONLY