How to secure 911 systems

As cyberattacks against computer systems, databases and personal devices has risen in recent years, so too have assaults aimed at the 911 emergency response systems that connect the public to first responders.  With these attacks against public safety answering points (PSAPs) becoming more widespread, regulators and practitioners at both the federal and state level are looking to harden these systems.

The threats facing emergency response systems depend on what type of infrastructure jurisdictions possess.  For older, legacy systems, telephony denial of service attacks that aim to overwhelm a center by flooding it with calls can pose a real danger, as can radio frequency jamming.  More modern IP-based systems can be disrupted with denial of service attacks or by viruses, worms or Trojan horses.

The goals of attackers vary.  In recent ransomware attacks against hospitals, police departments and corporations, hackers have held data hostage until their payment demands were met. Other attackers could be part of a much larger assault by a nation state. When Russia invaded Georgia in 2008, “DDoS and website defacements began three weeks before the physical hostilities and continued throughout the war,” Antonia Chayes, professor at Tufts University, wrote last year in the Harvard National Security Journal. 

“The next generation of 911, a fully digital, IP-based, multimedia-capable network of networks, will open the doors to multiple attack methods and vectors that PSAPs have never had to plan for, or deal with,” warned the authors of a Federal Communications Commission task force report, which advised public safety agencies to begin planning for cyberdefense. 

“We’re right in the middle of a transformation of new systems as [PSAPs] migrate from legacy, hardwired network infrastructures to IP networks with full-up computer and analytics capabilities,”  David Gagliano, CTO in the Global Solutions Division at General Dynamics Information Technology, told GCN. 

While the vector for executing attacks depends on the sophistication of the target infrastructure, Gagliano said, the effect is essentially the same because threats continue to evolve with the technology.  “Across the country, you’ve got folks who are [running] state of the art 1960s systems, and then you’ve got folks who [have] state of the art 2020 systems,”  he said. The new IP-based networks “bring significant new functionality capabilities and … new vulnerabilities.”

One of the ways jurisdictions can protect their systems is by segregating computer-aided dispatch systems and 911 systems from the outside world. This tactic minimizes “the ability of outsiders to compromise our systems through the Internet,” Chief Sam Greif of the Plano, Texas, Fire-Rescue Department wrote in prepared testimony before the House Homeland Security Subcommittee on Cybersecurity, Infrastructure, Protection and Security Technologies in April.  The downside, he said, was that software upgrades had to be installed on the server manually.  “We wanted to make sure that we took all reasonable means even though that added some complexities to day-to-day life,” he said.  “The more you secure something, the harder it is sometimes to operate it or update it, but we felt it was worth the trouble to keep it segregated from the outside world.”

Segregating these systems is “certainly a good idea,” though it is not widely practiced, Stephen Ashurkoff, director of public safety solutions at General Dynamics Information Technology, told GCN.  In a smaller sheriff’s office or a fire department, PSAPs may be a few workstations that need “access to other systems to function within their environments. So although [segregating PSAPs] is best practice in some of – many of -- the larger centers… it’s not common,” he said. 

Nor is it inexpensive. “To truly segregate a network -- to have separate fiber buildouts and completely separate equipment” -- is beyond the existing budgets of  many of these public safety jurisdictions,  he said.

The real world is complicated, Gagliano agreed. In a perfect world, it’s ideal to isolate these systems, “but the reality is…both the resources are constrained and the community … outreach actually adds a lot of utility for having some control connectivity.  And I think the key word there is ‘control;’ being able to have a system implementation that provides roles, responsibilities, checks and internal protections against isolating traffic.”

Retired Rear Adm. David Simpson, chief of the FCC's Public Safety and Homeland Security Bureau, offered additional steps jurisdictions can take to better secure their 911 call centers.  These measures include assessing risk and adopting cybersecurity risk management policies using the Cybersecurity Framework created by the National Institute of Standards and Technology. Additionally officials can deploy solid identity credentialing programs to ensure authorized users are who they say they are and increase automation for monitoring internal and external communications to ensure sensitive information is not disclosed to the public that can be exploited by adversaries.

Other recommendations coming from the FCC’s task force include adding layers into the next generation of PSAP architecture.  “By centralizing certain features, including cybersecurity in general, and Intrusion Detection and Prevention Services (IDPS) specifically, public safety can take advantage of economies of scale, multiple resources and systems and best practices,” the report noted. 

Minnesota’s 911 program manager, Dana Wahlberg, who also served as the FCC Task Force’s vice chair, said having a dedicated IT workforce that understands these complex problems is imperative.  “Technology is becoming more and more complex as we continue migrating to an IP environment (with IP networks being used for both voice and data elements,” she said.  Although the PSAPs understand the need protecting the 911 infrastructure, Wahlberg said, “many do not have dedicated IT staff and may even have limited access to IT support, making it difficult to accomplish.” 

Essentially, security “really starts with the people,” Ashurkoff said, and the biggest weakness in a network is the uneducated user that does not understand the vulnerabilities.  Effective user training will “eliminate a lot of the easy attack vectors … the letters from Nigerian princes and the malware that might be embedded” in an email link, he said.