1. H OMELAND S ECURITY P HYSICAL S ECURITY (Focus Group 1A) Update to Council December 5, 2003 K ARL F. R AUSCHER Chair Homeland Security Physical Security Focus Group (1A) Director Network Reliability, Lucent Technologies Bell Labs Chair NRIC V Best Practices Subcommittee Vice Chair ATIS Network Reliability Steering Committee (NRSC) Founder & President Wireless Emergency Response Team (WERT) Representative National Coordinating Center (NCC) for Telecommunications Chair-Elect IEEE Technical Committee on Communications Quality & Reliability (CQR) Federal Communications Commission Network Reliability and Interoperability Council VI

2. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 2 Mission Summary of Accomplishments –Best Practices (~ 200 Prevention; ~ 100 Restoration) –Areas for Attention (31) –Recommendations (12) –Blended Attacks Discussions with Focus Group 1B 2 New Recommendations Suggestions for NRIC VII Actions for Council Members Outline

3. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 3 Focus Group Mission The Focus Group will assess physical vulnerabilities in the public telecommunications networks and the Internet and determine how best to address those vulnerabilities to prevent disruptions that would otherwise result from terrorist activities, natural disasters, or similar types of occurrences. The Focus Group will conduct a survey of current practices by wireless, wireline, satellite, and cable telecommunications and Internet services providers, network operators and equipment suppliers that address Homeland Defense. By December 31, 2002 the Focus Group will issue a report identifying areas for attention and describing best practices, with checklists, that should be followed to prevent disruptions of public telecommunications services and the Internet from terrorist activities, natural disasters, or similar types of occurrences. The Focus Group will report on current disaster recovery mechanisms, techniques, and best practices and develop any additional best practices, mechanisms, and techniques that are necessary, or desirable, to more effectively restore telecommunications services and Internet services from disruptions arising from terrorist activities, natural disasters, or similar types of occurrences. The Focus Group will issue a report containing best practices recommendations, and recommended mechanisms and techniques (including checklists), for disaster recovery and service restoration. The Focus Group will issue this report within twelve (12) months of the first Council meeting. The Focus Group will coordinate with the Homeland Security Cyber Security Focus Group (1B) to assure that vulnerabilities in the public telecommunications networks and the Internet are assessed, and to determine how best to address those vulnerabilities to prevent disruptions that would otherwise result from terrorist activities, natural disasters, or similar types of occurrences. The Focus Group will also coordinate with other Focus Groups, as appropriate.

4. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 4 NRIC FGs Stakeholders Big Picture of Process Flow Focus Group 1A VulnerabilitiesVulnerabilities ThreatsThreats Existing BPs P & R Reports RecommendationsRecommendations Council Areas for Attention Checklists Best Practices Mechanisms Techniques SMEs $ Broader Industry AssembleVulnerabilities AssembleThreats assess determine conduct issue report develop Coordination Council Charter Steering Committee FCC & Industry AssembleBPs Survey CouncilCouncil CouncilCouncil INPUTS OUTPUTS SUPPORT OVERSIGHT

5. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 5 Hardware Software Environment Payload NetworksPolicy HumanPower Systematic Assessment of Communications Infrastructure Vulnerabilities C OMMUNICATIONS I NFRASTRUCTURE TRANSPORTATION ENERGY FINANCIAL PUBLIC HEALTH LAW ENFORCEMENT Other Infrastructures

6. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 6 Integrated Framework for Vulnerabilities – Threats – Best Practices Vulnerabilities Threats Environment accessible identifiable physical damageHardware vibration / shock temperature extremes electromagnetic radiationPolicy foreign national ownership electromagnetic weapons thermal nuclear war hijacking of a network X-111 X-999 X-555 X-123 X-789 Best Practices Best Practices that a)Vulnerabilities a) address Vulnerabilities b)Threats b) address Threats by preventing the exercise of vulnerabilities, and/or mitigating the impact should a vulnerability be exercised X-222

7. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 7 Systematic Assessment of Communications Infrastructure Vulnerabilities NCS

8. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 8 Development of Best Practices ~ 200 Applicable to Prevention ~ 100 Applicable to Restoration

9. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 9 Best Practices in My Company Throughout Lifecycle Planning & Design Provisioning & Installation Operation & Administration Repair & Decommission All Elements Throughout Organization Functions & Levels Across Network Types User-Friendly Access with Keywords

10. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 10 Hardware Software Environment Payload NetworksPolicy HumanPower 31 Areas for Attention C OMMUNICATIONS I NFRASTRUCTURE 5 4 2 10 4 2 1 3

11. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 11 Hardware Software Environment Payload NetworksPolicy HumanPower Areas for Attention C OMMUNICATIONS I NFRASTRUCTURE 1.Need for Periodic Re-Assessment 2.Any Environment Can Be Destroyed 3.Unique Circumstances Require Special Consideration 4.Overall Security Plan 5.Research Needed for Methodologies to Protect Air within Critical Facilities 1.Internal Power Infrastructure Is Often Overlooked 2.Rules Permitting Access to Internal Power Systems Increase Risk 3.Priorities for Good Power Systems Management Compete with Environmental Concerns 4.Power System Competencies Need to Be Maintained

12. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 12 Hardware Software Environment Payload NetworksPolicy HumanPower Areas for Attention C OMMUNICATIONS I NFRASTRUCTURE 1.Nuclear Attack 2.Hardness to Radiation 3.Solar Flares and Coronal Mass Ejection 4.Control of Hardware Development 1. Physical Security of Software 2. Control of Software Development 1. Physical Aspects of Securing Network Payload 1. Network Redundancy and Diversity 2. Existing NRIC Best Practices Effectively Address Network Vulnerabilities

13. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 13 Hardware Software Environment Payload NetworksPolicy HumanPower Areas for Attention C OMMUNICATIONS I NFRASTRUCTURE 1.Complex Interactions 2.Commitment of Senior Management to Corporate Security 3.Voluntary National Background Checks for Access to Critical Sites 1. Inadvertent Negative Impact of Government Regulations 2.FCC Effects on Vulnerabilities and Best Practices 3.Federal Review for Infrastructure-Related Mergers & Acquisitions 4.Mutual Trust is Vital to Industry-Government Information Sharing 5.Single Focal Point Needed for Disaster Coordination 6.Awareness of Emergency Preparedness Priority Services 7.Implications of Evolving Technologies on Emergency Restoration 8.Protecting the Character of NRIC Best Practices 9.Protecting Critical Infrastructure Information 10.Future Processes for CII Protection

14. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 14 12 Recommendations 1.Industry Recommendation of Physical Security Prevention Best Practices 2.Industry Recommendation of Physical Security Restoration Best Practices 3.Research Needed for Methodologies to Protect Air within Critical Facilities 4.Voluntary National Background Checks for Access to Critical Sites 5.Federal Review for Infrastructure-Related Mergers & Acquisitions 6.Continue NCC and Telecom-ISAC Coordination Capabilities 7.NCC as Single Focal Point Needed for Industry Disaster Coordination 8.Awareness of Emergency Preparedness Priority Services 9.Review Implications of Evolving Technologies on Emergency Restoration 10.Commitment of Senior Management to Corporate Security 11.Industry Recommendation of Physical Security Additional Best Practices 12.Protecting Critical Infrastructure Information

15. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 15 Blended Attacks * Communications Infrastructure Dependencies on other Infrastructure are deferred to future NRIC consideration PHYSICAL CYBER Scope –Physical dependencies on Cyber –Cyber dependencies on Physical –Communications infrastructure dependencies on other critical infrastructures * Systematic Vulnerability-based Approach 1.Outlining P/C, C/P and CI dependencies * 2.Identifying vulnerabilities associated with dependencies 3.Develop Best Practices to address above 4.Evaluate coverage

16. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 16 New Recommendation Additional Homeland Security Best Practices RECOMMENDATION NRIC VI-1A-11 The Council recommends that the additional NRIC VI Physical Security Best Practices be implemented, as appropriate, by Service Providers, Network Operators and Equipment Suppliers, in order to promote the reliability, robustness, adequate capacity, security and sustainability of the public communications infrastructure throughout the United States during events or periods of exceptional stress and to more effectively restore from disruptions of public communications services and Internet services due to terrorist activities, natural disasters, or similar types of occurrences. (8 new Best Practices)

17. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 17 New Recommendation Protecting Critical Infrastructure Information BACKGROUND Government entities - at all levels - are systematically gathering information about critical infrastructures within their jurisdictions Security requires strict protection of critical information by means of very controlled access and distribution The number of lists of critical communications infrastructure facilities can be nearly impossible to protect

18. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 18 New Recommendation Protecting Critical Infrastructure Information RECOMMENDATION NRIC VI-1A-12 As a general practice, government entities should not aggregate sensitive information critical to the communications infrastructure. Exceptions should be limited to information needed to address specific concerns in support of federal Homeland or National Security objectives. Federal, state or local government requests for industry information should be handled in accordance with, and given the protections provided by, the Homeland Security Act of 2002, Section 214.

19. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 19 Enhance systematic framework of vulnerabilities Ongoing maintenance of Best Practices Consider communications infrastructure dependencies on other infrastructures Industry survey Insights for FCC & Industry for NRIC VII

20. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 20 Consider and Support 2 Proposed Recommendations Continue internal review and implementation of Best Practices, as appropriate Reference Homeland Security Physical Security Final Report (Issue 3, December 2003) Recognize your representatives “Take Aways” for Council Members

21. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 21 Additional Information

22. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 22 Focus Group 1A - Team Membership Karl Rauscher - Chair Equipment & Software Suppliers Steve McOwen Chris Miller Art Reilly Jim Runyon Rick Krock Ted Lach Anil Macwan Cathy Purvis Mike Kennedy Virgil Long Fred Tompkins Richard Biby Steven Warwick Service Providers & Network Operators RalphWhitlark Shawn Cochran RalphWhitlark Shawn Cochran P.J.Aduskevicz RickCanaday Frank Maguire P.J.Aduskevicz RickCanaday Frank Maguire Steve Michalecki Michael Clements Jayne McCullough Thomas Priore, Jr. Daniel Jenkins David F. Phillips Loye Manning John Morovich Percy Kimbrough John Cholewa Wayne Chiles Dick Craft Liz Geddes Roger Kochman David Porte Government & Other Entities Bill Klein Capt. J. Kathy Burton Perry Fergus Larry Stark Hank Kluepfel Chao-Ming Liu Tom Soroka, Jr Molly Schwarz Schwarz Consulting George Caldwell I.B.S.S. Jennifer Meredith Scott Jones Everett Dennison Delgie Jones Craig McQuate Government & Other Entities Service Providers & Network Operators Rick Kemper Ken Buckley Federal Reserve System Ed Bickel Donovan Dillon Keith Hopkins Bob Postovit Ted Abrams Craig Swenson John L. Clarke III

23. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 23 Salute to the Task Group Leaders Hardware Software Environment Payload NetworksPolicy HumanPower C OMMUNICATIONS I NFRASTRUCTURE Craig Swenson, MCI & Molly Schwarz, Schwarz Consulting Chao-Ming Liu, Telcordia Technologies & Ted Lach, Lucent Bell Labs Rick Canaday, AT&T Larry Stark, NCS Perry Fergus, NCS (BAH) Anil Macwan, Lucent Technologies & Michael Kennedy, Nortel Networks Ralph Whitlark, BellSouth Craig McQuate, Genuity

24. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 24 Team Members –organizational and individual commitments –professional excellence and personal commitment to the mission –teamwork Pam Stegora-Axberg, Steering Committee Chair –expanding industry participation –improving the NRIC outreach program Jeff Goldthorp, NRIC VI Designated Federal Officer –care and diligence, supporting outreach program ATIS –hosting numerous meetings at their Washington, D.C. facilities Acknowledgements

25. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 25 Definitions Vulnerability A characteristic of any aspect of the communications infrastructure that renders it, or some portion of it, susceptible to damage or compromise. Threat Anything with the potential to damage or compromise the communications infrastructure or some portion of it

26. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 26 Seven Principles in Developing Best Practices 1. 1.“People Implement Best Practices" 2. 2.Do not endorse commercial or specific "pay for" documents, products or services 3. 3.Address classes of problems 4. 4.Already implemented 5. 5.Developed by industry consensus 6. 6.Best Practices are verified by a broader set of industry members 7. 7.Sufficient rigor and deliberation NRIC Best Practices bring the industry’s best minds & experience together to provide guidance that could not be achieved by companies on their own

27. H OMELAND S ECURITY P HYSICAL S ECURITY F OCUS G ROUP 1A 11/13/2015 K. F. Rauscher 27 1.Work Is Critical and Urgent... Successful completion of our mission is vital to national security 2.High Quality, On-Time Deliverables that Are Trustworthy and Thorough... Fulfill applicable Charter requirements and meet the needs of the Nation 3.Clear Objectives... For team, and individual participants and organizations 4.Leadership Will Pursue Consensus of Team... Also needs to set pace & guide fulfillment of charter 5.Follow a Scientific Approach, Not Merely Collect Subjective Opinions... Be objective and practice a disciplined methodology 6.Capture Every Good Idea... Welcome new and different perspectives for consideration 7.Respect for Individuals... Open and honest interactions Guiding Principles