1. SECR 5140-FL Critical Infrastructure Protection Dr. Barry S. Hess Spring 2 Semester Week 2: 25 March 2006

2. 2 Class Website Class Info http://home.covad.net/~bshess/ Contact info barry.hess@gmail.com 571.237.3418

3. 3 Agenda My Presentation Student Presentations Risk Analysis Lecture Discussion

4. Presentations

5. Risk Analysis

6. 6 Risk Assessment Risk assessment is about foreseeing the future Used to predict harmful or unwanted events Predictions are not 100%, but can assist us to avoid or reduce risk A risk assessment can tell us about: Probability - how likely are harmful events? Severity - how bad will they be? Rate - how often will they happen? Drivers - what are the key factors causing harmful events? Risk assessment is a best management practice in government and business

7. 7 Risk Management Cycle Source: MI5 – UK’s Security Service http://www.mi5.gov.uk/output/Page261.html

8. 8 Risk Assessment Example Crossing a busy street

9. 9 Step One: Identify the threats Getting hit by a car Causing an accident Causing traffic to slow down Other pedestrians Jaywalking ticket

10. 10 Step Two: Establish protection scheme & your vulnerabilities Protection schemes Identify traffic pattern Find a crosswalk Wait for the light to change Vulnerabilities Car not stopping Light change before you get across Wet pavement and roads Drunk driver

11. 11 Step Three: Identify measures to reduce risk Only cross at intersections Wear a reflective vest Carry a flashlight

12. 12 Step Four: Review security measures and security plans Look both ways Wait until “WALK” light is on Only cross at intersections

13. Lecture

14. 14 Security vs. Functionality Open Secure Open Secure OpenSecure Attributes Balanced approach Moderate access Burden is on sysadmin Attributes Totally safe Difficult to do business Easy to manage Attributes Extremely vulnerable Easy access to outside Impossible to control

15. 15 Discussion Question Do you have a computer at home? Is it connected to the Internet? Do you have a broadband connection? Do you have a firewall? Do you run anti-virus software?

16. 16 Reference Websites Shields up! https://grc.com/x/ne.dll?bh0bkyd2 Broadband reports http://www.dslreports.com/tools WinGuides Network for Windows http://www.winguides.com/

17. Discussion

18. 18 Discussion Questions What can the government do to protect the critical infrastructure? What can’t it do? What is the private sector doing to protect the critical infrastructure? Where are the government and the private sector cooperating?

19. Assignment for Week 3

20. 20 Briefing Assignment Prepare and present a ten minute discussion on what your chosen government agency has done for its designated infrastructure sector Cite sources

21. 21 Topics Commerce: Information & communications Treasury: Banking & Finance EPA: Water supply Transportation: Aviation; Highways; Mass transit; Pipelines; Rail; Waterborne commerce Justice/FBI: Emergency law enforcement services FEMA: Emergency fire enforcement services and COOP HHS: Public health service Energy: Electric power, oil, and gas production Justice/FBI: Internal security State: Foreign affairs Defense: National defense

22. 22 Additional Readings for Week 3 National Strategy to Secure Cyberspace Office of Homeland Security http://www.whitehouse.gov/pcipb/cyberspace_str ategy.pdf http://www.whitehouse.gov/pcipb/cyberspace_str ategy.pdf Assessing the Risks of Cyber Terrorism, Cyber War and Other Cyber Threats Center for Strategic and International Studies http://www.csis.org/tech/0211_lewis.pdfwww.csis.org/tech/0211_lewis.pdf

23. 23 Reminder Research topics due One page summary