Don’t make a bad situation worse: Cybersecurity for emergency operations

Well-run organizations across the globe create contingency plans for emergency situations -- creating and reviewing protocols, conducting emergency drills and coordinating with first responders, just in case they are ever needed.

Today, with the physical and cyber infrastructures increasingly connected , the effects of disasters can linger long beyond the physical damage. Government agencies must also ready cybersecurity plans for natural emergencies like earthquakes, fires or hurricanes.  Beyond damage to physical infrastructure, the controlled chaos of an emergency is rife with opportunity for accidental exposure of sensitive data and/or the resources that govern industrial control systems. Out of necessity, employees are unlikely to place the highest priority on communications security, yet these are precisely the moments adversaries may choose to test cybersecurity defenses. These can be nation state or organized crime attacks, terrorist activities or amateurish nuisance hacks.  

While the United States has not yet had any cyberattacks explicitly timed to take advantage of natural disasters, there have been instances that hint at the repercussions such an attack might create.  Take, for example, an April 2013 incident in which hackers compromised the Associated Press' Twitter feed and sent a message that explosions in the White House had injured President Barack Obama. Immediately the Dow Jones Average dropped more than 100 points before quickly rebounding.

Other scenarios are frighteningly common. For example, during the 2014 unrest in Ferguson Missouri, a DDOS attack was launched on the police department’s website and email. In the aftermath of the 2010 Chilean earthquake, search engine poisoning caused phony, malware-carrying pages to rise to the top of search results.

Even seemingly innocent mistakes can potentially cause chaos. During the wildfires in Northern California this past summer, a member of the public inadvertently posted incorrect information to Napa County’s Facebook page. For a short time people were told to go in one direction, when they should have been sent in the opposite direction to escape the fire. Today, when technology rules the world, those who rule technology can have power over institutions and governments.

Fortunately, there are a number of steps organizations and government agencies can take to prepare for cyberattacks prior to a physical emergency.

Develop a security baseline. Security analytics tools allow IT managers to have full visibility into all network traffic. They can help agencies determine if anything happened, what systems and data were affected and if the attack has been contained.

Define security ‘for the cloud’ and ‘in the cloud.’ During an emergency, buildings may be flooded or damaged and roads may be impassable, keeping staff out of the office and making cloud services a key alternative. Cloud technology can give first responders access to information from mobile devices and help authorities quickly deploy emergency operation centers. Agencies will still need protection within the cloud applications themselves, however. To avoid ‘shadow cloud’ access, IT managers must control access and acceptable use. Cloud Access Security Brokerage technologies can restrict workers from creating accounts on services such as Box or DropBox on an ad-hoc basis. And, more important, the information residing in cloud applications can be encrypted and tokenized.

Establish policies for emergency web access and bandwidth management. Prioritizing access to the network becomes critical in emergencies. Bandwidth will be tight. Restrict web access to only the most critical sites and resources. Set up a more restrictive web access policy prior to an emergency and be ready to deploy it when needed. Do the same for bandwidth management. Be ready to prioritize applications such as VoIP and cache critical information such as official communications and videos for viewing from a local cache.

Protect your public web pages and social media. The general public will be looking to government agencies for information during and after the emergency. During these times it will be critical to protect the agency’s public information resources. Web application firewalls can protect the website from common attacks, control input/output and access as well as detect unfamiliar traffic patterns. Facebook and Twitter are critical communication resources, but they also can be used to promote malicious information. Deploy security features such as two-factor authentication and verification codes for government social media accounts.

Following a few steps to protect an agency’s IT infrastructure from hackers after a physical emergency will ensure that both public and private resources will not fall victim to cyberlooting, and that the general public will not be endangered further.