Redundancy Alone Won't Make Networks More Secure, FCC Public Safety Chief Says

Some assume that redundancy in a network is automatically good, Simpson said. What is needed instead is “well designed redundancy,” he said. “Redundancy that has too many interdependencies with the primary system actually is a negative when it comes to resiliency in the cyber world.” The wrong kind of redundancy “increases the attack surface by which an adversary would get in without increasing the resistance to cyberattack,” Simpson said.

Simpson encouraged CSRIC to challenge the notion that network redundancy is automatically a positive. “Look at things like, how do I effectively employ redundancy in a segmented way so that if I’m going to bring redundant elements in, I’m not exposing what was intended to be my backup to the same infection,” he said.

The security by design working group starts with the assumption that security needs to be built into equipment used on a network as early as possible, said Joel Molinoff, chief information security officer at CBS, co-chairman of the working group. “Relying solely on patching” isn't the best way to make the network secure, he said. Next up for the working group is a set of recommendations for the security best practices that network equipment suppliers should follow, due to be completed in March, Molinoff said.

The CSRIC has eight working groups, which are just getting started on addressing their assignments from the FCC, based on reports at Monday’s meeting. The meeting was the second of the current iteration of the FCC advisory committee. The work of CSRIC as a whole is important, Simpson said. “What you are doing does have a positive impact on security, reliability and interoperability [in] communication systems and the infrastructure for our nation.”

Working group eight on “Priority Services” has yet to meet and is the only working group without chairpersons. But Simpson stressed the importance of the work it will undertake. The focus is on what happens when the demand for services exceeds the communications infrastructure that’s available, Simpson said.

Simpson cited a presentation at last week’s FCC meeting on the loss of the submarine cable serving the Northern Mariana Islands, which affected 30,000 Americans who lost more than 95 percent of their communications connections (see 1509170047). Communities should have the ability to make decisions about what communications should get out of an area that suffers that kind of network problem, he said. “We are looking for leadership on a really important problem, a problem that is important to our nation from a national security perspective, but also from a disaster response perspective.”

Working group one on “Evolving 911 Services” has two tasks -- making recommendations on public safety and industry best practices for rerouting 911 calls between public safety answering points (PSAPs) and studying and making recommendations on various aspects of location-based routing that use latitude and longitude information or other information such as dispatchable location when available, said Co-Chairwoman Susan Sherwood, Verizon senior manager, E-911.

“It all pretty much comes down to timing,” Sherwood said. “The timing of every component within a wireless 911 call flow is critical to understanding why the existing call routing and data delivery system is in place and the impacts of potential changes to that system.” But wireless call routing provides a number of challenges, Sherwood said. Among them is that more than one PSAP can fall within the coverage of a cell sector and RF propagation characteristics can result in a 911 call not originating in the nearest cell sector, she said. Each location-based method of call routing has advantages and disadvantages, she said.

Simpson said the work of the 911 group is critical. “There are times when lives are lost because of the misroute of calls, and there are significant PSAP resources that are regularly siphoned off to not handle the transfer of misrouted calls, so there is a real operational problem that we are trying to get at here,” he said. Simpson said the group should focus on alternatives for a better first-route decision.

Working group two is looking at “Emergency Alerting Platforms.” The working group will look at best practices the FCC should take to improve the security of wireless emergency alerts, including ways to protect the integrity of the interface between alert originators and carriers, said Co-Chairman Francisco Sanchez, public information officer with the Harris County, Texas, Office of Homeland Security & Emergency Management. The working group will also look at ways to encourage the use of emergency alerts by state and local officials at a local/geo-targeted level, he said.

CSRIC Chairman John Schanz, chief network officer at Comcast Cable, encouraged the working group to look at the role social media plays in alerts. “Obviously, today's alerting system has got great reach, but it's sort of unidirectional in most cases,” he said. “Combining that with social media and the things we can do with one to many and many to one … and trying to bring that together holistically will be great work.”

Working group three on the "Emergency Alert System" will also look at emergency alerts, but with an eye on making the broader emergency alert system work better, said co-Chairman Kelly Williams, a senior director at NAB. The group is to look at EAS security, the provision of EAS in languages other than English and the development of an operational handbook for the use of broadcasters, cable providers and other EAS participants, Williams said.