Introduction to Homeland Security

Transcription

1 Introduction to Homeland Security Chapter 5 Part V Safety & Security Utilities and Industrial Facilities Utilities Lifelines of American society Water Electricity Energy Sewerage Telecommunications All are important terrorist targets and their protection is a critical national security priority Utilities (cont.) Protection of US utilities is the responsibility of DHS Directorate of National Protection and Programs Extremely difficult task Almost 85% of all utility infrastructure in the US is privately owned/operated Thus, govt. and private sector relationships and cooperation are critical for successfully protecting these facilities 1

2 Water Consists of two components: 1) Freshwater supply 2) Wastewater collection and treatment 170, public water systems consisting of: Dams Reservoirs Wells/aquifers Treatment facilities Pumping stations Aqueducts Transmission pipelines Water Response to Potential Threats DHS and EPA has provided assistance to state and local governments to: Conduct threat assessments Develop emergency response plans Water-Info Sharing Analysis Center (ISAC) created in DEC 2002 Secure, Inter-net net based rapid notification and info resource Funded by: EPA Subscription fees Water Potential Threats 1) Physical damage or destruction of critical assets, including intentional release of toxic chemicals 2) Actual or threatened contamination of the water supply 3) Cyber attack on information management systems or other electronic systems 4) Interruption of service from another infrastructure 2

3 Water Protective Initiatives 1) Identify high-priority vulnerabilities and improve site security ID processes and technologies to better secure key points of storage and distribution 2) Improve sector monitoring and analytical capabilities Water Protective Initiatives (cont.) 3) Improve sector-wide info exchange and coordinate contingency planning Water-ISAC Standardize emergency response efforts and communications protocols 4) Work with other sectors to manage unique risks resulting from interdependence DHS and EPA will convene working groups to develop models for integrating priorities and emergency response plans (ERPs) Energy Forms the foundation of our economy Essential for economic growth, national defense, and all aspects of modern life Energy sector components Electricity Oil and natural gas 3

4 US Electricity Sector Services almost 130 million household/institutions Required by almost every form of productive activity Required to produce other forms of energy US Electricity Sector - Physical Components Generation Fossil fuel plants Hydroelectric dams Nuclear power plants Sources of Electricity in the US

5 US Electricity Sector - Physical Components Transmission and distribution Links areas of the national grid Control and communications Operate and monitor critical infrastructure components North American Electric System Interconnected, multinodal distribution system Accounts for virtually all electricity supplied to: US Canada Portion of Baja California Norte, Mexico Most reliable electric system in the world North American Electrical System 5

6 Challenges to Electric System Security Highly complex Numerous component assets spread across North America Diverse ownership Size Capabilities Security costs not always recoverable Challenges to Electric System Security (cont.) Lack of effective, sector-wide communications Industry associations serve as info clearing houses However, not all industry owners/operators belong to such associations Challenges to Electric System Security (cont.) Analysis of infrastructure interdependencies Data not readily available Prevents identification of dependencies and establishment t of protection ti priorities iti and strategies Obstacles to redundancy and increased generating capacity NIMBYism Lengthy application processes State and local regs 6

7 Initiatives to Improve Electric System Security Establishment of ES-ISAC Operated by North American Reliability Council (NERC) Indication, Analysis, and Warnings (IAW) program Guidelines for reporting operational and cyber incidents that adversely effect the ES IAW Standard Operating Procedure (SOP) Defines criteria/thresholds for reporting for event reporting Initiatives to Improve Electric System Security (cont.) NERC guidelines requiring backup systems and/or manual work-arounds Additional protective measures: ID equipment stockpile requirements Standardization and interchangeability Reevaluate and adjust nationwide protection planning, system restoration, and recovery in response to attacks Develop strategies to reduce vulnerabilities ID appropriate levels of redundancy Develop standardized guidelines for physical security programs Oil and Natural Gas Oil infrastructure Oil production Crude oil transport Refining Product transport and distribution Control and other support systems 7

8 Oil and Natural Gas (cont.) Oil production Exploration Field development On- and off-shore production Field collection systems and supporting infrastructure Oil and Natural Gas (cont.) Crude oil transport Pipelines (160,000 miles) Storage terminals Ports Ships Oil and Natural Gas (cont.) Refinement 150 refineries Capacity from 5,000 to over 500,000 barrels/day Transport and distribution Pipelines Trains Ships Ports Terminals and storage Trucks Retail stations 8

9 Oil and Natural Gas (cont.) Natural Gas Infrastructure Exploration and production Transmission 278,000 miles of pipeline Local distribution 1,119,000 miles of distribution pipeline LPG and LNG storage facilities US produces 20% of the world s natural gas supply Challenges to Oil and Natural Gas Security Lack of metrics to determine and justify corporate security expenditures Natural disasters: well-established established methods for determining risks and emplacing cost-effective measures to reduce/manage risk Terrorist threats: Not clear what levels of security and protection are appropriate and cost effective Challenges to Oil and Natural Gas Security (cont.) Not all first responders are properly trained/equipped to deal with oil/natural gas facility emergencies Most facilities have responded by developing substantial protection programs Product itself could be used in a terrorist attack Overall operations are distributed over very large areas Every node is vulnerable Multiple transportation nodes are vulnerable and require unique expertise 9

10 Challenges to Oil and Natural Gas Security (cont.) Many obstacles to repair damaged infrastructure in a timely manner Long lead times for: Federal/state/local construction permits/waivers Environmental review and impact statements Construction rights-of-way Lack of availability of unique materials/equipment Locating and distributing replacement parts inefficient Lack of industry standardization Initiatives to Improve Oil and Natural Gas System Security Plan and invest in research and development for the oil and gas industry to enhance robustness and reliability Protection, response, recovery Develop strategies to reduce vulnerabilities ID appropriate levels of redundancy of critical components and systems Enhance reliability Initiatives to Improve Oil and Natural Gas System Security (cont.) Develop standardized guidelines for physical security programs Vulnerability and risk assessment Physical security training Develop guidelines for measures to reconstitute capabilities of individual facilities and systems Develop a national system for locating and distributing critical components in support of response and recovery efforts 10

11 Telecommunications Typically robust and reliable Industry faces daily threats Weather Unintentional ti cable cuts Technology threat Cyber Physical Reliance on telecommunications by the govt. and infrastructure industries make it a priority for protection Challenges to Telecommunications Security Due to growing interdependency among various critical infrastructure components, an attack on any one could have a cascading effect Due to customer demand and economic conditions, companies have focused on basic network operations vice securing and enhancing infrastructure Initiatives to Improve Telecommunications Security Define an appropriate threshold for security Expand infrastructure diverse routing capability Understand the risks associated with vulnerabilities of the telecom infrastructure Coordinate with key allies and trading partners 11

12 Initiatives to Improve Telecommunications Security (cont.) Homeland Secure Data Network (HSDN) Classified data network between DHS and other federal agencies Telecom-ISAC Watch and Analysis Operations (WAO) Telecom Industry Association (TIA) Industry standards Public policy Interoperable comms for 1st responders Water Treatment Plants Take untreated water from a source and produce potable water Disinfection Chlorine Purification Filtration Water Treatment Threats Hazardous materials could be introduced at numerous points of the treatment process Chemicals Biological agents 12

13 Initiatives to Improve Water Treatment Plant Security EPA sponsored training to assist water utilities in: Conducting vulnerability assessments Implementing security improvements Responding to terrorist events Initiatives to Improve Water Treatment Plant Security (cont.) Solicit and review methods to: Prevent, detect, and respond to CBR contaminants Review methods and means by which terrorists could disrupt the supply of potable water Review methods and means by which alternative supplies of potable water could be provided in case of disruption Initiatives to Improve Water Treatment Plant Security (cont.) Implement security practices in ongoing water utility operations Establish formal communications mechanisms to facilitate timely and effective info exchange re: threats and incidents Foster coordination among federal, state, local, tribal, 1 st responders, labs, medical community, and law enforcement re: response to terrorist threats Understand and reduce the impact on water utilities of attacks against other infrastructure and vice versa 13

14 Wastewater Plants Wastewater: The spent (used) water from homes, businesses, farms and industry that contains harmful material Regulated by the Clean Water Act Wastewater treatment plants remove the harmful material Wastewater Plants (cont.) US wastewater infrastructure: 16,000 publicly owned plants 100,000 major pumping stations 600, miles of sanitary sewers 200,000 miles of storm sewers Sanitary and storm drains form a network that runs near or under every key building and road and into the heart of every financial and business district Often run adjacent to communications and transportation networks Wastewater Plants - Threats Use of wastewater as a biological/chemical weapon Attack on part of wastewater plant that collects/stores HAZMAT in order to disperse that material 14

15 Initiatives to Improve Wastewater Plant Security EPA sponsored vulnerability assessments and risk reduction programs in coordination with the Assoc. of Metropolitan Sewerage Agencies Vulnerability Self-Assessment Tool (VSAT) Contingency planning for WWT facilities Develop individual contingency plans in the event of an emergency Initiatives to Improve Wastewater Plant Security (cont.) Identify, screen, and treat contaminants in water/wastewater ID methods to screen for harmful contaminants Determine efficacy of removal Security measures for computerized and automated systems at wastewater treatment (WWT)facilities Detect and correct security breaches Landfills ~3000 landfills in US More than 40 millions tons of hazardous waste are produced each year in the US Radioactive waste Potential terrorist target Few initiatives to improve physical security 15

16 Private Sector Involvement in Homeland Security 9/11 attacks impacted thousands of private businesses across the US and the world Changes in private sector crisis management after 9/11 can be analyzed in two perspectives: 1) The changing expectations of the private sector of the new Federal role (DHS) in helping achieve greater homeland security 2) The self re-assessment of the private sector in terms of corporate crisis management and business continuity Private Sector Involvement in Homeland Security (cont.) The WTC attacks have led to a reassessment among the private sector relative to the value and necessity of investing in contingency planning and crisis and disaster management, especially relative to terrorism E.g. - ISACs Lessons Learned by the Private Sector Business continuity and crisis response are an integral part of the business management process The corporate world is more likely to be struck by terrorist attacks than the government or military Thus, businesses must consider the physical security of their personnel, facilities, data, and customers under existing security measures, and may even need to redesign current security systems based on threat assessment 16

17 Lessons Learned (cont.) Pre-planning of back-up sites to relocate employees and equipment adds value when disasters cause extensive physical workplace damage There are distinct Recoverers and Non- Recoverers following major disasters like the 9/11 attacks (though the causality is still under investigation) Communication of leaders with employees and their visibility and openness are important for the contribution of the staff to the crisis management process Lessons Learned (cont.) Building cross-company company relationships inside business sectors can reduce mitigation and preparedness costs and create an environment where expertise and creative ideas are shared Protecting the human resources of a company must be a priority Building redundancy into infrastructure, and considering the physical location of backup sites, are both crucial 17