Private Sector Role in PPD 8

Transcription

1 Private Sector Role in PPD 8 Brian Tishuk Executive Director ChicagoFIRST September 19, 2012

2 Agenda Background on ChicagoFIRST Describe financial sector experience identifying threat Note public/private collaboration on threat Identify avenues for improving collaboration

3 The ChicagoFIRST Approach Nationally Connected Regionally Focused Uniquely Resilient

4 Original Goals: 2003 Situation Awareness Access to timely, accurate, and actionable data Institutionalized public sector relationships Affiliation Access (a.k.a. credentialing) Institutionalized process for access Interoperable technology across the nation Evacuation Planning Fold public sector plans into private response plans Develop proper training for employees

5 ChicagoFIRST Structure Members from the private sector. 501(c)(6) nonprofit corporation. Funded entirely through member dues. Two employees. Executive Director spent nearly 20 years at the U.S. Treasury Department Deputy Director spent 8 years with the City, including the Office of Emergency Management

6 Major Initiatives Tabletops and Workshops: Transportation disruptions Water (suburbs and backup capabilities) Cyber (extortion and law enforcement contacts) RDDs and INDs (BCP and local/federal response) Working Groups: Security (physical and IT) Business Continuity Security Content Automation Protocols (SCAP) Member surveys on numerous topics.

7 Financial Sector Threat Analysis

8 Financial Sector Threat Matrix The financial sector organizes itself at the national level through the Financial Services Sector Coordinating Council (FSSCC) Financial firms are heavily regulated, so identifying threats is integral to resilience ChicagoFIRST led the development and pilot of a threat matrix in 2011 The following slides illustrate the path taken

9 Financial Services Sector Coordinating Council (FSSCC) Threat Matrix Overview & Timeline The FSSCC Threat Matrix was developed by the Cybersecurity Committee as a tool to identify threat areas where members of the Financial Services community felt additional focus and energy was needed. The Long Range Vision Committee formed Published Threat Matrix Version 3 Defined 2011 project to Operationalize the Threat Matrix input to the 3-5 year strategy. Pilot Threat Vulnerability Assessment Using Threat Matrix v4.0 which is: Designed to support assessments at the Institution, Region, and Sector level Intended to supplement, not replace, tools already deployed by firms May be used by smaller firms that do not have threat/vulnerability processes The FSSCC Executive Steering Committee recommended expanding scope of the Threat Matrix to address All Hazards Formed Long Range Vision WG to coordinate Threat Matrix Version 2 Threat Matrix Version 4.0 available on the FSSCC Portal; provides a common framework (catalog and ratings) to be Used in conducting assessments. Preliminary results are presented to the survey participants and stakeholders Page 2

10 Financial Services Sector Coordinating Council (FSSCC) Threat Matrix Version Critical Infrastructure Power Interuption 7 Civil Unrest National, soverign 12 Radiological Agent Covert Deposit, Sprayed 17 Insider Threat Disgruntled Employee Loss of Communications Geopolitical, protests Munitions, Dirty Bomb Consultants Impared Transportation Civil disobedience Power Plant Third Party Services Water Availability Labor disputes Aging Infrastucture 2 Natural Disasters Earthquake, tsunami Volcano Flood Landslide 3 Health Crisis Pandemic Ependemic Virus Outbreak 4 Severe Weather Tornado, hurricanes Snow, ice storms Heat wave, drought 8 Improvised Explosive Devices (IED) Stationary Vehicle Moving Vehicle Mail Supply Thrown Placed Personnel 9 Biological Agent Anthrax Botulism Plague Smallpox Toxins 10 Agriterrorism 13 Chemical Agent Blister Blood Choking/Lung/Pulmonary Incapacitating Nerve Riot Control/Tear Gas Vomiting 14 Hazardous Material Fixed Site Transported 15 Critical Operations Bank Failure Liquidity Counterparty Risk 18 Terrorism Physical Cyber 19 Supply Chain Risk Hardware Software Services 20 Cybersecurity Data Availability, Confidentiality, Intergrity Advanced, persistient Threat Proliferation of exploit tools Phishing Logic Bombs Denial of Service Sniffer 5 Arson/Incendary Attack 6 Armed Attack Small Arms Stand-off Weapons (rocket propelled, grenades, mortars, etc.) 11 Nuclear Device detonation underground, surface, air, High altitude Power Plant Currency Crisis Fraud Loss of Key Staff 16 Corporate Espionage/Surveillance Acoustic Electronic Eavsesdropping Zero-day exploit Virus Trojan Horse Vishing Worm War driving Visual Page 4

11 Financial Services Sector Coordinating Council (FSSCC) Threat Vulnerability Assessment Worksheet Page 5

12 Likelihood Priority Rating = Likelihood x Severity of Impact Financial Services Sector Coordinating Council (FSSCC) Threat Assessment: Determining Priority Definition Priority is determined by considering Likelihood and Severity of Impact. 5 M/5 H/10 H/15 H/20 H/25 Sector Priority L/4 M/8 H/12 H/16 H/20 L/3 L/6 M/9 M/12 H/15 L/2 L/4 L/6 M/8 H/10 = H M >10 HIGH Unacceptable, Major disruption likely. Different approach required. Priority management attention required. 5-9 MEDIUM Some disruption. Different approach may be required. Additional management attention may be needed. 1 L/1 L/2 L/3 H/4 L/4 M/5 L < 5 LOW Minimum impact. Minimum oversight needed to ensure risk remains low Severity Page 6

13 Financial Services Sector Coordinating Council (FSSCC) 2011 Financial Services Threat Vulnerability Assessment Participant Demographics Title Participants Here by Critical Function Critical Functions Thirty firms participated in this pilot assessment representing six critical functions Participants by Region Regions Assessments conducted in sixteen cities with a concentration in the NYC and Chicago regions Page 7

14 Financial Services Sector Coordinating Council (FSSCC) 2011 Financial Services Threat Vulnerability Assessment Preliminary Observations and Sample Reports When severity and likelihood were both considered, the threat of terrorism stands out by a wide margin The pandemic threat (health crisis) is perceived as a higher risk than nuclear and espionage Largest Threat Categories Across Functions and Geography Terrorism Cybersecurity Insider Threat Critical Operations Health Crisis Critical Infrastructure Nuclear Armed Attack Corporate Espionage/Surveillance Severe Weather Improvised Explosive Devices (IED) Supply Chain Risk Radiological Agent Hazardous Material Release Arson/Incendiary Attack Biological Agent Civil Unrest Natural Disasters Chemical Agent Agriterrorism Priority (Likelihood * Severity) Page 8

15 Financial Services Sector Coordinating Council (FSSCC) 2011 Financial Services Threat Vulnerability Assessment Preliminary Observations and Sample Reports Geography is also a key differentiator in priority of threat categories The threat of terrorism was slightly more prominent in Chicago then New York, however health crisis was deemed a lower risk in Chicago than in New York Priority of Top 10 Threat Categories by Geography Page 10

16 Financial Services Sector Coordinating Council (FSSCC) 2011 Financial Services Threat Vulnerability Assessment Recommendations and Next Steps Next Steps Complete Analysis.Participant Reports Recommendations Transition Threat Matrix and Assessment to FS-ISAC - Extend reach, resources, and expertise - Consider continuous assessment model smaller, more frequent surveys - Leverage Threat Intelligence Committee Threat Viewpoints Better utilize FSSCC/FBIIC member relationships Input to DHS-IP: PPD-8: Strategic National Risk Assessment Framework - The national preparedness goal shall be informed by the risk of specific threat and vulnerabilities taking into account regional variations and include concrete measurable, and prioritized objectives to mitigate risk Input to DHS-IA: Standing Information Needs (SINs) Page 11

17 Financial Services Sector Coordinating Council (FSSCC) National Presidential Preparedness Policy Directive Goal September, 8 (March 30, 2011) Assistant to the President for Homeland Security and Counterterrorism shall coordinate the development of plan for completing the national preparedness goal and national preparedness system. The national preparedness goal shall be informed by the risk of specific threats and vulnerabilities taking into account regional variations and include concrete, measurable, and prioritized objectives to mitigate risk. Includes all hazards (e.g., acts of terrorism, cyber attacks, pandemics, and catastrophic natural disasters) Identifies shared responsibility of all levels of government, the private and nonprofit sectors, and individual citizens. Strategic National Risk Assessment Conducted. Results indicate that a wide range of threats and hazards pose a significant risk to the Nation, affirming the need for an allhazards, capability-based approach to preparedness planning. Page A2

18 Financial Services Sector Coordinating Council (FSSCC) Strategic National Risk Assessment Key findings include Natural hazards, including hurricanes, earthquakes, tornados, wildfires, and floods, present a significant and varied risk across the country. A virulent strain of pandemic influenza could kill hundreds thousands of Americans, affect millions more, and result in economic loss. Additional human and animal infectious diseases, including those previously undiscovered, may present significant risks. Technological and accidental hazards, such as dam failures or chemical substance spills or releases, have the potential to cause extensive fatalities and severe economic impacts, and the likelihood of occurrence may increase due to aging infrastructure. Terrorist organizations or affiliates may seek to acquire, build, and use weapons of mass destruction (WMD). Conventional terrorist attacks, including those by lone actors employing explosives and armed attacks, present a continued risk to the Nation. Cyber attacks can have their own catastrophic consequences and can also initiate other hazards, such as power grid failures or financial system failures, which magnify the potential impact of cyber incidents. Page A3

19 Collaboration with Public Sector on Threat The financial sector has collaborated with the federal government on threat BZPP (ChicagoFIRST) SAVs (ChicagoFIRST) RRAPs (ChicagoFIRST) FS-ISAC on DHS Intelligence Plan for 2012 (IA) DHS on PPD 8 (IP) FEMA Region V on PPD 8 (ChicagoFIRST) Argonne National Lab (the heat map and resilience) Appreciate the opportunity presented today

20 Improving Collaboration The focus on deadlines is understandable, but hinders robust collaboration Not clear how PPD 8 will involve or affect the private sector It is sensible, however, because the public and private sectors must reach a common understanding of risk Tendency to focus on greatest needs, but financial sector have insights

21 Questions?