Securing Hastily Formed Networks              For Disaster Relief and Emergency              Response              BRKSEC-...
VIDEO
“We don’t just get involved in something and then leave…we get involved in ways nobody else does.” John Chambers President...
AgendaSecuring Hastily Formed Networks A bit about Cisco Tactical Operations The intersection of human needs and  networ...
Cisco Tactical Operationshumanitarian networks
Cisco TacOps Provides Crisis Support Cisco Tactical Operations (TacOps) is a dedicated crisis response team  that establi...
Cisco Learned Lessons from Hurricane Katrina Initially: TacOps supported “extreme risk” incidents Expanded mission: To h...
Today: All-hazards Response, Anywhere Famine, Horn of Africa                                  Plane Crash, Palo Alto CA...
US Relationships                                             Office of Emergency ServicesBRKSEC-1000   © 2012 Cisco and/or...
International RelationshipsBRKSEC-1000   © 2012 Cisco and/or its affiliates. All rights reserved.   Cisco Public   11
The Intersection of Human Needs andNetworks
All Crisis Responders Share the Same Problem        NGOs/VOADs/        International Orgs                                 ...
The Need for Technology in Disaster is Increasing                                                                         ...
Introducing Hastily Formed Networks
Typical ICT Challenges in DisasterInformation and Computing Technologies (ICT) are Needed but Overwhelmed Lack of power ...
Solution: Hastily Formed Networks (HFN)Instant Emergency Networks HFNs are portable, IP-based networks  that are deployed...
NPS/Cisco HFN Layered Model                                              HUMAN / COGNITIVE    Social/Cultural             ...
That Layer Model Assumes Something Important Security underlies every element of an HFN.    BRKSEC-1000      © 2012 Cisco...
HFNs: What They Are Portable: mobile, rolling kit, easily moved  with few personnel Rapidly deployable: pre-configured, ...
HFNs: What They Are Not A replacement for pre-emergency infrastructure. Designed for large numbers of users High bandwi...
The First Deployed HFN: Hurricane KatrinaBRKSEC-1000   © 2012 Cisco and/or its affiliates. All rights reserved.   Cisco Pu...
The First Deployed HFN: Hurricane KatrinaBRKSEC-1000   © 2012 Cisco and/or its affiliates. All rights reserved.   Cisco Pu...
More Recently: 2010 Haiti Quake                                                                                           ...
Mobile and Kit HFN SolutionsExample Units for Our Security Discussions Network Emergency Response Vehicle  (NERV)     ‒ I...
Securing Hastily Formed Networks
Security: What are We Really Trying to Do? Keep bad things out. Protect the mission Keep critical services running Kno...
Myth Busting: Information Security in aDisaster Assumption: “In a crisis network, I need to get deployed  quickly. I don’...
HFN Security Starts With the Physical You’re going into a disaster zone! “Force Protection” Physical security of equipm...
Basic Information Security Concepts via HFN Confidentiality: secure voice, video. Patient data. Security sensitive info....
IP Traffic Planes (a Reminder) Data plane traffic: end-station, user generated traffic. Control plane traffic: network d...
HFNs Use the Same Basic InfosecAssumptions Least-privilege access: Users, devices, systems are given minimal  access give...
Cisco NERV ArchitectureInternet                                                                                           ...
Use Strong Passwords, Restricted Privileges For system/network devices, strong passwords are enforced.        - No dictio...
DoS is the Primary Security Concernwith Satellite Satellite is often the only way to get  broadband data in a disaster. ...
A Real World Security Incident… Once upon a time… the NERV had a  flat, open network. Evans Road Fire in North Carolina....
…Had Us Reevaluate Access. Designed for differentiated access in a  easy-to-deploy fashion. “Untrusted” VLANs: open WiFi...
BRKSEC-1000   © 2012 Cisco and/or its affiliates. All rights reserved.   Cisco Public   38
Our HFN Firewall Strategy – One Policy,Everywhere            Field Units Each “unit” is responsible                      ...
Dynamic Multipoint VPN Increases Resiliency 3DES / SHA1 IPSEC DMVPN                                                      ...
Remote Access VPN Brings in Remote Users                                                                                 R...
Intrusion Monitoring for Malicious Traffic Monitor network traffic using NM-IPS Monitor the VLAN between core router  an...
Security Features for 802.11 Mesh Networks Mesh networks support 802.11i – WPA2 But do your clients? Old devices  may no...
802.16e WiMax Security – Proceed with Caution WiMax provides a wireless bridge  technology (4G) Range: dozens of kilomet...
Host Security…When You Don’t Controlthe Host! All TacOps server hosts are hardened. PCs have a/v, CSA, etc. But what abo...
Network Monitoring – Know Your NetworkHealth (Don’t Just Assume!) You need to know what’s going on  before your users do....
Q&A
Wrapping it all up The need for technology in disasters is increasing. Hastily Formed Networks provide IP in austere env...
Connect with us OnlineWeb. Email. Social Media.    On Cisco.com: http://www.cisco.com/go/tacops/    Email: tacops-info@c...
Complete Your OnlineSession Evaluation Give us your feedback and you  could win fabulous prizes.  Winners announced daily...
Final Thoughts Get hands-on experience with the Walk-in Labs located in World of  Solutions, booth 1042 Come see demos o...
BRKSEC-1000   © 2012 Cisco and/or its affiliates. All rights reserved.   Cisco Public
Securing Hastily Formed Networks For Disaster Relief & Emergency Response
Upcoming SlideShare
Loading in …5
×

Securing Hastily Formed Networks For Disaster Relief & Emergency Response

830 views

Published on

Discusses an architectural approach towards security for Hastily Formed Networks (HFNs) and other crisis support technology for rescue teams, law enforcement, NGOs, etc in the immediate aftermath of a disaster.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
830
On SlideShare
0
From Embeds
0
Number of Embeds
39
Actions
Shares
0
Downloads
4
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Securing Hastily Formed Networks For Disaster Relief & Emergency Response

  1. 1. Securing Hastily Formed Networks For Disaster Relief and Emergency Response BRKSEC-1000BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 2
  2. 2. VIDEO
  3. 3. “We don’t just get involved in something and then leave…we get involved in ways nobody else does.” John Chambers President & CEO – Cisco Systems
  4. 4. AgendaSecuring Hastily Formed Networks A bit about Cisco Tactical Operations The intersection of human needs and networks Introducing the “Hastily Formed Network” (HFN) Security considerations of HFNs Q&A Wrap-upBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
  5. 5. Cisco Tactical Operationshumanitarian networks
  6. 6. Cisco TacOps Provides Crisis Support Cisco Tactical Operations (TacOps) is a dedicated crisis response team that establishes emergency networks after a disaster. TacOps personnel skills include technical, operational, first responder, military and logistics Promotes innovative technology solutions for disaster response and other hardship situations. Emergency response funded by Cisco Corporate Philanthropy.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
  7. 7. Cisco Learned Lessons from Hurricane Katrina Initially: TacOps supported “extreme risk” incidents Expanded mission: To have a scalable, coordinated, response to disasters (2005) … because: Hurricane Katrina - what Cisco did: ‒ Cisco sent hundreds of volunteers and tons of equipment to Gulf region. ‒ We were successful, but… Hurricane Katrina - lessons learned: ‒ There were many willing engineers but few trained for the environment. ‒ Less effective due to the Cisco-wide uncoordinated response. ‒ No standardized Cisco mobile platform for disaster response.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
  8. 8. Today: All-hazards Response, Anywhere Famine, Horn of Africa  Plane Crash, Palo Alto CA Tornadoes, AL, NC, MO  Earthquake, Port-Au-Prince Earthquake/Tsunami, Japan Haiti Earthquakes, Christchurch  Fiber-Optic Cut, SF Bay Area New Zealand CA Flooding, Brazil  Flooding, Cedar Rapids IA Flooding, Queensland  Evans Road Fire, NC Australia  Harris Fire, San Diego CA Fourmile Canyon Fire, Boulder  Hurricanes Katrina, Gustav, CO Ike Gas Pipeline Explosion, San Bruno CABRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
  9. 9. US Relationships Office of Emergency ServicesBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
  10. 10. International RelationshipsBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
  11. 11. The Intersection of Human Needs andNetworks
  12. 12. All Crisis Responders Share the Same Problem NGOs/VOADs/ International Orgs Public Safety Transportation How to deliver the right National, State & Local Government information in the right format to the right person at the right time? Critical Infrastructure Healthcare Defense 13BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
  13. 13. The Need for Technology in Disaster is Increasing Goal: Mission workflow and productivity benefits to save lives Radio, phone Radio + Integrated Data and speed recovery. Single device Any Device (BYOD) Voice only Voice, Video, Data Closed teams Open collaboration Command centric In the field, social media, everyone Fixed locations Deployable anywhere BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
  14. 14. Introducing Hastily Formed Networks
  15. 15. Typical ICT Challenges in DisasterInformation and Computing Technologies (ICT) are Needed but Overwhelmed Lack of power Degraded telephony infrastructure Degraded Push-to-Talk Radio, Lack of interoperability Oversubscribed services Limited Internet access Few IT resources Lack of trained staffBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
  16. 16. Solution: Hastily Formed Networks (HFN)Instant Emergency Networks HFNs are portable, IP-based networks that are deployed in emergencies when normal communications has been disabled or destroyed. Enable on-scene and remote responders to share situational awareness, coordinate operations, establish command and control. Communicate within the affected area as well as to the outside world.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
  17. 17. NPS/Cisco HFN Layered Model HUMAN / COGNITIVE Social/Cultural Organizational Political Economic TEXT VOICE VIDEO/IMAGERY SPECIALIZED - email - Push-to-talk - VTC - CollaborationAPPLICATION - chat - Cellular - GIS - Sit Awareness - SMS - VoIP - Layered Maps - Cmd/Control - Sat Phone/PSTN - Fusion WIRED WIRELESS WIRELESS SAT - DSL LOCAL LONG HAUL BROADBANDNETWORK - Cable - WiFi - WiMAX - VSAT - Other ISP WAN - PAN - Microwave - BGAN - MAN - IP over HF POWER HUMAN NEEDS PHYSICAL NET OP CENTER - Fossil Fuel - Shelter SECURITY - Network SecPHYSICAL - Renewable - Water - Force Protection -Cmd/Control - Fuel - Access - Leadership - Food Authorization BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 18
  18. 18. That Layer Model Assumes Something Important Security underlies every element of an HFN. BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
  19. 19. HFNs: What They Are Portable: mobile, rolling kit, easily moved with few personnel Rapidly deployable: pre-configured, set up with minimal training Interim: Once pre-event communications is restored typically decommissioned. Based on: WiFi/VSAT/WiMAX/etc.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
  20. 20. HFNs: What They Are Not A replacement for pre-emergency infrastructure. Designed for large numbers of users High bandwidth (if on VSAT). High latency, etc. needs to be considered. Typical NOC HFN NOC (Haiti)BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
  21. 21. The First Deployed HFN: Hurricane KatrinaBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
  22. 22. The First Deployed HFN: Hurricane KatrinaBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
  23. 23. More Recently: 2010 Haiti Quake Airport USNS COMFORTNPS HFN TEAM HAITI NETWORKVSAT/BGAN SatelliteWiMAX Point-to-PointWiFi MeshWiFi Access Point BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
  24. 24. Mobile and Kit HFN SolutionsExample Units for Our Security Discussions Network Emergency Response Vehicle (NERV) ‒ ISR G2 based platform/VSAT/Mesh ‒ Video surveillance, streaming, TelePresence Mobile Communicator Vehicle (MC2) ‒ ISR based platform. VSAT, Mesh Emergency Communications Kit (ECK) ‒ Rapidly deployable communications capability ‒ ISR 2811 / 3825 basedBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
  25. 25. Securing Hastily Formed Networks
  26. 26. Security: What are We Really Trying to Do? Keep bad things out. Protect the mission Keep critical services running Know what’s happening on the network and devices Inside Outside Balance security and access Get it right every time.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
  27. 27. Myth Busting: Information Security in aDisaster Assumption: “In a crisis network, I need to get deployed quickly. I don’t have time or the resources to secure the network!” Reality: All HFN networks should be pre-planned – plan and build your security into your infrastructure!BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
  28. 28. HFN Security Starts With the Physical You’re going into a disaster zone! “Force Protection” Physical security of equipment Logistics Intelligence Health and SafetyBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
  29. 29. Basic Information Security Concepts via HFN Confidentiality: secure voice, video. Patient data. Security sensitive info. Integrity: command and control channels Availability: Denial of Service, appropriate use of the network, VSAT Authenticity: User/admin verification, trusted endpoints.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
  30. 30. IP Traffic Planes (a Reminder) Data plane traffic: end-station, user generated traffic. Control plane traffic: network device generated or received traffic used to operate create the network itself. (ARP, EIGRP, OSPF, etc.) Management plane traffic: traffic designed to manage the network or devices on the network. (SSH, FTP, SNMP, NTP, etc.) Addressing can help keep things organized: All kits/vehicles have /16, and each vlan is a /24 with a specified role. We can identify traffic flows easily.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
  31. 31. HFNs Use the Same Basic InfosecAssumptions Least-privilege access: Users, devices, systems are given minimal access given the crisis environment (advanced AAA solutions, etc. may not be available!) Threats may come from anywhere in the network. Simplicity: Once initially configured, the security architecture should establish itself without requiring any additional work from personnel who already have too much to do. Defense-in-Depth: No single security feature or technology can mitigate the range of possible threats.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
  32. 32. Cisco NERV ArchitectureInternet VHF VSAT UHF Wireless DMVPN/FW Core IPICS IP Phone Router Router HF Inside Wireless 3925 3945 AP 1242 Satellite Modem Access Switch Wireless Controller Cisco Systems San Jose, CA Wireless Raleigh, NC Mesh AP Video 1524- Surveillance PS/1522 IP Phone Video 7970/9971 Conferencing (C40) Cameras BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
  33. 33. Use Strong Passwords, Restricted Privileges For system/network devices, strong passwords are enforced. - No dictionary words, mix of special chars, letters, numbers - Based on mnemonic/phrase that is easily remembered (no guesswork in a disaster) - No “cisco/cisco” or similar. Duh! Computers and other devices: “user” (non admin accounts), and administrative accounts. Use the least-access user needed for a task.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
  34. 34. DoS is the Primary Security Concernwith Satellite Satellite is often the only way to get broadband data in a disaster. The “thin sippy straw” – b/w from 128kbps – 5mbps (typical Ku VSAT system) Protect your satellite bandwidth at all costs! Malicious traffic ‒ Zombie, flooding traffic. Inappropriate use …? ‒ YouTube ‒ BitTorrent ‒ FarmVilleBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 35
  35. 35. A Real World Security Incident… Once upon a time… the NERV had a flat, open network. Evans Road Fire in North Carolina. Firefighter’s laptop came onto the NERV pre-infected – DDoS zombie w/spoofed SRC IP. Created DoS condition on the satellite uplink.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
  36. 36. …Had Us Reevaluate Access. Designed for differentiated access in a easy-to-deploy fashion. “Untrusted” VLANs: open WiFi, certain networks such as those external to the NERV or kits Optical & Copper (patch panel) – access to the patch panel allow only limited access Internet only. “Trusted” VLANs have open access to servers, vehicle-based resources, etc. Requires you to have physical access to vehicle/kitBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 37
  37. 37. BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
  38. 38. Our HFN Firewall Strategy – One Policy,Everywhere Field Units Each “unit” is responsible ASA Firewall for its own firewall Each policy is the same San Jose, CA Inbound IOS firewall, BOGON filters Internet Egress Internet-only from “untrusted” networks Egress “sanity checking” ASA Firewall filters for spoofed outbound traffic Raleigh, NCBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 39
  39. 39. Dynamic Multipoint VPN Increases Resiliency 3DES / SHA1 IPSEC DMVPN ASA Firewall protects all management plane control plane VoIP, TelePresence DMVPN Tunnel traffic. San Jose, CA IPSEC tunnels link both backend hubs in San Jose Internet IPSEC and RTP Each remote unit comes ASA Firewall up and establishes two tunnels DMVPN Tunnel DMVPN is NAT friendly & Raleigh, NC increases resiliency.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 40
  40. 40. Remote Access VPN Brings in Remote Users Remote user (Jabber Video) Cisco ASAs configured to support both ASA Firewall remote access IPSEC and AnyConnect SSL VPN AnyConnect Remote users are typically San Jose, CA trying to join the TelePresence environment, or Internet CTS C40 administer the infrastructure. Low volume. ASA Firewall Raleigh, NCBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
  41. 41. Intrusion Monitoring for Malicious Traffic Monitor network traffic using NM-IPS Monitor the VLAN between core router and gateway router (e.g. to/from Internet or VPN) Since our usage patterns change from deployment to deployment, we use them in IDS mode and rely upon on-scene engineers to investigate alarms. Consider which network segments you “care the most about”BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
  42. 42. Security Features for 802.11 Mesh Networks Mesh networks support 802.11i – WPA2 But do your clients? Old devices may not support it. Cisco LWAPP considered insecure – avoid it (it’s old anyway!) Since code 5.2 – CAPWAP [RFC 5415] interoperable … but don’t bet on it. Encryption + authentication required between AP and controller (which means you’ll have to do some pre-config, not plug and play) Segment traffic across multiple wireless VLANsBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
  43. 43. 802.16e WiMax Security – Proceed with Caution WiMax provides a wireless bridge technology (4G) Range: dozens of kilometers BUT … Security features variable from each vendor, no standardization Do your homework. ‒ Quality of security implementation is spotty. ‒ 3DES, AES 128, 192, 256 for encryption ‒ Don’t use MAC auth. Use vs X.509 EAP-TLSBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 44
  44. 44. Host Security…When You Don’t Controlthe Host! All TacOps server hosts are hardened. PCs have a/v, CSA, etc. But what about “untrusted” hosts on scene? American Red Cross ‒ maintains ghost master system images, keep them patched & up to date. ‒ When they’re deploying laptops, they will image the laptops immediately before shipping them out.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 45
  45. 45. Network Monitoring – Know Your NetworkHealth (Don’t Just Assume!) You need to know what’s going on before your users do. SNMP, Cisco NetFlow, ASDM ‒ Beware of “chatty” management plane protocols that might cause trouble over satellite. ‒ Consider what network elements really need to be monitored.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 46
  46. 46. Q&A
  47. 47. Wrapping it all up The need for technology in disasters is increasing. Hastily Formed Networks provide IP in austere environments SECURE Hastily Formed Networks can help save lives and speed recovery to affected communities. You can have ease of deployment and security – it takes an architectural approach.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 48
  48. 48. Connect with us OnlineWeb. Email. Social Media.  On Cisco.com: http://www.cisco.com/go/tacops/  Email: tacops-info@cisco.com  Facebook: http://www.facebook.com/cisco.tacops  Twitter: @SJ_NERV @RTP_NERVBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 49
  49. 49. Complete Your OnlineSession Evaluation Give us your feedback and you could win fabulous prizes. Winners announced daily. Receive 20 Passport points for each session evaluation you complete. Complete your session evaluation online now (open a browser through our wireless network to access our Don’t forget to activate your portal) or visit one of the Internet Cisco Live Virtual account for access to stations throughout the Convention all session material, communities, and on-demand and live activities throughout Center. the year. Activate your account at the Cisco booth in the World of Solutions or visit www.ciscolive.com.BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 50
  50. 50. Final Thoughts Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042 Come see demos of many key solutions and products in the main Cisco booth 2924 Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more! Follow Cisco Live! using social media: ‒ Facebook: https://www.facebook.com/ciscoliveus ‒ Twitter: https://twitter.com/#!/CiscoLive ‒ LinkedIn Group: http://linkd.in/CiscoLIBRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 51
  51. 51. BRKSEC-1000 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public

×