Wireless Emergency Alerts (WEA) Cybersecurity Risk Management Strategy for Alert Originators

The Wireless Emergency Alerts (WEA) service depends on computer systems and networks to convey potentially life-saving information to the public in a timely manner. However, like other cyber-enabled services, it is susceptible to risks that may enable attackers to disseminate unauthorized alerts or to delay, modify, or destroy valid alerts. Successful attacks may result in property destruction, financial loss, injury, or death and may damage WEA credibility to the extent that users ignore future alerts or disable alerting. This report describes a four-stage cybersecurity risk management (CSRM) strategy that alert originators can use throughout WEA adoption, operations, and sustainment, as well as a set of governance activities for developing a plan to execute the CSRM. In Stage 1, alert originators document mission threads, describing the process for generating WEA messages. In Stage 2, they examine the mission threads to identify threats and vulnerabilities. In Stage 3, they use the identified threats and vulnerabilities to assess and prioritize risks according to their likely impact on WEA operations. Finally, in Stage 4, they use the results of risk assessment to define cybersecurity roles and assign risk-mitigation actions. The four stages are repeated periodically and as procedures, threats, technology, and staff assignments change.
of 183
All materials on our website are shared by users. If you have any questions about copyright issues, please report us to resolve them. We are always happy to assist you.
Related Documents
   Wireless Emergency Alerts (WEA) Cybersecurity Risk Management Strategy for Alert Originators The WEA Project Team March 2014 SPECIAL REPORT CMU/SEI-2013-SR-018 CERT  ®   Division, Software Solutions Division    This material is based upon work funded and supported by Department of Homeland Security under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software En-gineering Institute, a federally funded research and development center sponsored by the United States Department of Defense. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, for government purposes pursuant to the copyright license under the clause at 252.227-7013 and 252.227-7013 Alternate I.  Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of Department of Homeland Security or the United States Department of Defense. THIS MATERIAL IS PROVIDED “AS IS” WITHOUT ANY WARRANTY OF ANY KIND, EITHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR FREEDOM FROM INFRINGEMENT. IN NO EVENT SHALL THE UNITED STATES GOVERNMENT OR ITS CONTRACTORS, INCLUDING CARNEGIE MELLON UNIVERSITY, OR SUBCONTRACTORS, BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM, OR IN ANY WAY CONNECTED WITH THIS MATERIAL OR ITS USE OR ANY PROVIDED DOCUMENTATION, WHETHER OR NOT BASED UPON WARRANTY, CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT OF THE RESULTS OF, OR USE OF, THIS MATERIAL. THE UNITED STATES GOVERNMENT AND CARNEGIE MELLON UNIVERSITY DISCLAIM ALL WARRANTIES AND LIABILITIES REGARDING THIRD PARTY CONTENT AND DISTRIBUTES IT “AS IS.” References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. Copyright 2013 Carnegie Mellon University. Carnegie Mellon®, CERT®, and OCTAVE® are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. Operationally Critical Threat, Asset, and Vulnerability Evaluation ℠  is a ser-vice mark of Carnegie Mellon University. DM-0000879    CMU/SEI-2013-SR-018  | i   Table of Contents Executive Summary ix   Abstract xi   1   Introduction 1   1.1   The WEA Alerting Pipeline and Cybersecurity Risk 1   1.2    About the Cybersecurity Risk Management Strategy 2   1.3    About This Report 2   1.3.1   Intended Audience 2   1.3.2   Relationship to Other Reports 3   1.3.3   Organization of This Report 3   2   WEA Cybersecurity Risk Management Strategy Overview 4   3   Prepare for Cybersecurity Analysis 6   3.1   Select the Life-Cycle Phase for Analysis 6   3.2   Identify Assets: Elements and Components of the WEA Service 7   3.3   Describe Environmental Context for the Operational Mission Thread 7   3.4   Document WEA Operational Mission Steps 9   4   Conduct Cybersecurity Analysis 11   4.1   Identify Cyber Threats and Vulnerabilities Using STRIDE 12   4.1.1   Example: Apply STRIDE to the Generic Mission Thread 12   4.2   Explore Mission Thread Variations 20   4.2.1   Example: Impact of a Mission Thread Variation on STRIDE Analysis 21   5   Assess and Prioritize Cybersecurity Risks 23   5.1   Document and Assess Cybersecurity Risks 23   5.1.1   Risk 1: Maliciously Sent CAP-Compliant Message 24   5.1.2   Risk 2: Denial of Service from Malicious Code 25   5.1.3   Risk 3: Insider Spoofing Colleague’s Identity 27   5.1.4   Risk 4: Unavailable Communication Channel 28   5.2   Prioritize Risks 29   5.3   Select Control Approach and Define Mitigation Requirements 31   5.3.1   Risk 1: Maliciously Sent CAP-Compliant Message 31   5.3.2   Risk 2: Denial of Service from Malicious Code 32   5.3.3   Risk 3: Insider Spoofing Colleague’s Identity 33   5.3.4   Risk 4: Unavailable Communication Channel 34   5.4   Use the Results of Risk Assessment and Prioritization 34   6   Mitigate Cybersecurity Risks Throughout the Life Cycle 36   6.1   Define Cybersecurity Risk-Mitigation Roles and Responsibilities for Alert Originators 38   6.1.1   Identify a Generic Set of Alert Originator Roles and Responsibilities 39   6.1.2    Assign Mitigation Requirements to Generic Roles: An Example 40   6.2   Identify Alert Originator Tasks for Each Life-Cycle Phase 43   6.2.1   Example of WEA Adoption Phase Tasks for Cybersecurity Risk Management 46   7   Plan and Sustain WEA Cybersecurity Risk Management 51   7.1    An Organizational Framework for Risk Management 51   7.2   Considerations for WEA CSRM Planning 52   7.3   Building the CSRM Plan 53      CMU/SEI-2013-SR-018  | ii   7.4   Sustaining the CSRM Plan 55   8   The Big Picture: A Resilient Alert Origination Capability 56   Appendix A   General Cybersecurity Observations from Stakeholder and Vendor Interviews 57    A.1 Introduction 57    A.2 Responses to Stakeholder Cybersecurity Questions 58    A.3 Responses to Vendor Cybersecurity Questions 70    A.4 Cybersecurity Question Sets 74    A.4.1 Stakeholder Cybersecurity Question Sets 74    A.4.2 Vendor Cybersecurity Question Set 75   Appendix B   WEA Mission Thread Analysis 76   B.1   Mission Thread Analysis Approach for Security 76   B.2   Structure of the Mission Thread Analysis Examples 77   B.3   Mission Thread Analysis: Imminent Threat Alert (Philadelphia Subway Bombing) 79   B.3.1   Imminent Threat Alert Operational Mission Thread 79   B.3.2   Imminent Threat Alert Mission Step Decomposition – Security 81   B.3.3   Imminent Threat Alert Mission Thread Analysis – Security 82   B.4   Mission Thread Analysis: Presidential Alert (Philadelphia Subway Bombing) 88   B.4.1   Presidential Alert Operational Mission Thread 88   B.4.2   Presidential Alert Mission Thread Analysis – Security 90   B.5   Mission Thread Analysis: AMBER Alert (Christiansburg Daycare Kidnapping) 97   B.5.1    AMBER Alert Operational Mission Thread 97   B.5.2    AMBER Alert Mission Step Decomposition – Security 99   B.5.3    AMBER Alert Mission Thread Analysis – Security 101   Appendix C   CWE/SANS Software Weakness Examples 108   Appendix D   Cybersecurity Risk Analysis Methodology 110   D.1   Risk Management Terms and Concepts 111   D.1.1   Cybersecurity Risk 111   D.1.2   Risk Measures 112   D.1.3   Risk Management 113   D.1.4   Controlling Cybersecurity Risks 113   D.2   CSRA Method Description 114   D.2.1   Establish Operational Context (Task 1) 115   D.2.2   Identify Risk (Task 2) 118   D.2.3    Analyze Risk (Task 3) 123   D.2.4   Determine Control Approach (Task 4) 129   D.2.5   Determine Control Plan (Task 5) 132   D.3   Summary of Risk Information 135   D.3.1   Risk 1: Maliciously Sent CAP-Compliant Message 136   D.3.2   Risk 2: Denial of Service from Malicious Code 138   D.3.3   Risk 3: Insider Spoofing Colleague’s Identity 141   D.3.4   Risk 4: Unavailable Communication Channel 143   Appendix E   Alert Originator Adoption, Operations, and Sustainment Decisions and Cybersecurity Risk 146   E.1    Adoption Decisions and Cybersecurity Risk 146   E.2   Operations Decisions and Cybersecurity Risks 149   E.3   Sustainment Decisions and Cybersecurity Risks 150   Appendix F   Cybersecurity Tasks for WEA Adoption 152   F.1    Adoption Example Step 1: Identify Requirements and Prepare for Acquisition 152  
Related Search
We Need Your Support
Thank you for visiting our website and your interest in our free products and services. We are nonprofit website to share and download documents. To the running of this website, we need your help to support us.

Thanks to everyone for your continued support.

No, Thanks