Developing a Physical and Cyber Security Primer for Transportation Agencies (2020) / Chapter Skim
Currently Skimming:
Pages 18-115
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 18... ...
17 Appendix A Literature Review Contents A Risk Management and Risk Assessment ................................................................................................
|
From page 19... ...
18 A Risk Management and Risk Assessment Railway Infrastructure Security (Setola et al, 2015, Springer)
|
From page 20... ...
19 is to: (1) provide an overview of the range of security threats and issues that may affect road infrastructure, operations and users; and (2)
|
From page 21... ...
20 Risk-Based Transportation Asset Management: Building Resilience into Transportation Assets: Report 5: Managing External Threats Through Risk-Based Asset Management Citation. "Report 5: Managing External Threats Through Risk-Based Asset Management", RiskBased Transportation Asset Management: Building Resilience into Transportation Assets, Federal Highway Administration (FHWA)
|
From page 22... ...
21 The report consists of 16 short chapters. After a one-paragraph Background and a one-page Introduction, the report describes, What is Risk and Risk Management.
|
From page 23... ...
22 exposes computer systems, and the essential services and critical infrastructure they support, to major security risks. If not properly controlled, the increased speed and accessibility that benefits intended users can also give unauthorized individuals and organizations access to operational information that is used for mischievous or malicious purposes, including fraud or sabotage." Following the executive summary (here, "Audit summary")
|
From page 24... ...
23 Supply Chain Security Guide Citation. Donner, Michel and Kruk, Cornelis, Supply Chain Security Guide_, World Bank, Washington, DC, 2009, [Online]
|
From page 25... ...
24 B Plans and Strategies National Disaster Recovery Framework, Second Edition – Information Sheet Citation.
|
From page 26... ...
25 National Mitigation Framework, Second Edition – Information Sheet Citation. "National Mitigation Framework, Second Edition – Information Sheet," Emergency Management Agency (FEMA)
|
From page 27... ...
26 Synopsis. The National Prevention Framework focuses on terrorism and addresses the capabilities necessary to avoid, prevent, or stop imminent threats or attacks.
|
From page 28... ...
27 NIPP 2013: Partnering for Critical Infrastructure Security and Resilience Citation. National Infrastructure Protection Plan (NIPP)
|
From page 29... ...
28 Synopsis. According to AASHTO's page on Bridge and Tunnel Security, this publication is an "AASHTO brochure providing an overview of the vital role that state DOTs – builders and operators of the nation's busiest roads, tunnels, and bridges – often play when emergency situations occur".
|
From page 30... ...
29 C Physical Security Countermeasures Leveraging Traffic and Surveillance Video Cameras for Urban Traffic Citation.
|
From page 31... ...
30 Synopsis. This Recommended Practice provides guidelines for the selection of cameras, digital recording equipment and digital high-speed trainlines for use in transit-related CCTV applications.
|
From page 32... ...
31 • Signage placement. While agencies seem to be taking full advantage of almost universal access to the Internet and high mobile phone ownership rates to provide their information through these media, providing information by means of electronic signs is seen to provide an added benefit to users.
|
From page 33... ...
32 Synopsis. This document includes physical security countermeasures for bridges against earthquakes such as restrainers, seat extensions, column jackets, footing overlays, and soil remediation.
|
From page 34... ...
33 approach roadways, extended wingwalls, enhanced scour protection and strengthened deck tiedowns. Additional flood countermeasures include floodplain culverts, hardening the slopes of approach roadways, adding/raising spans, and protecting coatings.
|
From page 35... ...
34 (GIS) , statistical techniques and combines several different data sources.
|
From page 36... ...
35 crashes. This project looked at a probability based approach to assess risk but this proved to be elusive due to limitations of existing data… The consequences of loss-of-service need to be considered on a bridge specific basis when making decisions about fire risk.
|
From page 37... ...
36 http://www.dot.ca.gov/newtech/researchreports/preliminary_investigations/docs/copper_theft_pi. pdf Synopsis.
|
From page 38... ...
37 includes a detailed Commentary with explanatory and supplementary information designed to assist building code committees and regulatory authorities." Ad-Hoc Sensor Networks for Maritime Interdiction Operations and Regional Security Citation. Kontogiannis, Theofanis, "Ad-Hoc Sensor Networks for Maritime Interdiction Operations and Regional Security," Masters Thesis, Naval Postgraduate School, Monterey, CA, September 2012, [Online]
|
From page 39... ...
38 DOTs, and universities. This fifth edition of HEC-18 also contains revisions obtained from further scour-related developments and the use of the 2001 edition by the highway community.
|
From page 40... ...
39 Texas Transportation Institute (TTI) "Guidelines for Designing Bridge Piers and Abutments for Vehicle Collisions." -- -Technical Reports 9-4973-1 and 9-4973-2 Citation.
|
From page 41... ...
40 Synopsis. From the Transport Research International Documentation (TRID)
|
From page 42... ...
41 are revising regulations to improve ferry operator training and developing guidance on screening. Ferry operators' security actions have included developing and implementing security plans and screening vehicles and passengers, among other things.
|
From page 43... ...
42 Transportation agencies are asked to provide special permits for these vehicles along a specified pathway. Because of the unusual configuration of the vehicles it is difficult for those agencies to evaluate the effect of the vehicles on highway bridges.
|
From page 44... ...
43 "Key Messages: The MUTCD contains the national standards governing all traffic control devices. All public agencies and owners of private roads open to public travel across the nation rely on the MUTCD to bring uniformity to the roadway.
|
From page 45... ...
44 Citation. Santi, P.M., Soule, N.C., Brock, R.J., Evaluation of Debris Flow Removal Protocol, Mitigation Methods, and Development of a Field Data Sheet, Report No.
|
From page 46... ...
45 more rigorous consideration and retrofitting as required. Various retrofit strategies are described and a range of related retrofit measures explained in detail, including restrainers, seat extensions, column jackets, footing overlays, and soil remediation." FHWA Seismic Retrofitting Manual for Highway Structures: Part 2 – Retaining Structures, Slopes, Tunnels, Culverts, and Roadways, 2004 Citation.
|
From page 47... ...
46 of the RHRS, the steps an agency should follow to implement the system, and discusses the level of commitment required. The benefits of implementation and the limitations of the system are also described.
|
From page 48... ...
47 and interviewed public and private sector officials for 8 of 9 SSAs with responsibility for 15 of 16 sectors. GAO recommends that certain SSAs collaborate with sector partners to develop performance metrics and determine how to overcome challenges to reporting the results of their cyber-risk mitigation activities.
|
From page 49... ...
48 and network devices are covered along with increasingly sophisticated and interconnected industrial control systems, such as baggage handling, temperature control, and airfield lighting systems. Accompanying this guidebook is a CD-ROM (CRP-CD-171)
|
From page 50... ...
49 Synopsis: U.S. maritime ports handle more than $1.3 trillion in cargo annually.
|
From page 51... ...
50 Citation. Critical Infrastructure Protection: More Comprehensive Planning Would Enhance the Cybersecurity of Public Safety Entities' Emerging Technology.
|
From page 52... ...
51 sector stakeholders to address the cybersecurity implications of implementing technology initiatives in related plans. The Critical Infrastructure Gap: U.S.
|
From page 53... ...
52 questions the feasibility, although it has not performed a feasibility analysis of the requirement. Rather, CBP has planned two new initiatives to further strengthen the security of container cargo, but these initiatives will not achieve 100 percent scanning.
|
From page 54... ...
53 completed a range of actions to assess risks to freight rail since September 2001, and TSA has developed a security strategy; however, TSA's efforts have primarily focused on one threat, and its strategy does not fully address federal guidance or key characteristics of a successful national strategy. Specifically, TSA's efforts to assess vulnerabilities and potential consequences to freight rail have focused almost exclusively on rail shipments of certain highly toxic materials, in part, because of concerns about their security in transit and limited resources.
|
From page 55... ...
54 This document directly concerns cyber security. The TRID entry continues: "Because of close spacing, computer-controlled platoons with inter-vehicular communication -- the concept of adaptive cruise control (ACC)
|
From page 56... ...
55 The National Institute of Standards and Technology (NIST) , the Federal Information Processing Standards (FIPS)
|
From page 57... ...
56 • Shares vulnerability information and threat analysis through information products and alerts • Provides security awareness training courses (see http://ics-cert.us-cert.gov/TrainingAvailable-Through-ICS-CERT) Transportation Security Administration (TSA)
|
From page 58... ...
57 Available: http://nvd.nist.gov NIST Computer Security Division's Computer Security Resource Center (CSRC) facilitates broad sharing of information security tools and practices, provides a resource for information security standards and guidelines, and identifies key security web resources to support users in industry, government, and academia.
|
From page 59... ...
58 Special Publication 800-82, Guide to Industrial Control Systems (ICS) Security (2014)
|
From page 60... ...
59 information/intelligence requirements for incidences, threats and vulnerabilities. Based on its sector-focused subject matter analytical expertise, the ISAC then collects, analyzes, and disseminates alerts and incident reports It provides to its membership and helps the government understand impacts for their sector.
|
From page 61... ...
60 National Cyber Investigative Joint Task Force – Analytical Group http://www.fbi.gov/about-us/investigate/cyber/ncijtf In 2008, the U.S. President mandated the National Cyber Investigative Joint Task Force (NCIJTF)
|
From page 62... ...
61 1406 of the Implementing Recommendations of the 9/11 Commission Act of 2007, (Pub.
|
From page 63... ...
62 Citation. "Fiscal Year (FY)
|
From page 64... ...
63 interoperability of emergency communications; and (5) inclusion of "whole community" concepts in the NIMS.
|
From page 65... ...
64 E/L 969: All-Hazards Position Specific Communications Unit Leader E/L 970: All-Hazards Position Specific Supply Unit Leader E/L 971: All-Hazards Position Specific Facilities Unit Leader E/L 973: All-Hazards Position Specific Finance/Admin. Section Chief E/L 975: All-Hazards Position Specific Finance/Admin.
|
From page 66... ...
65 3. An Instructor Guide and Student Evaluation 4.
|
From page 67... ...
66 Subrecipient personnel-related issues Subrecipient service requirements & restrictions Training & technical assistance Safety & Security In the description of the Safety & Security module, it is noted that Section 5329, MAP-21 (49 USC 5329) provides FTA with the authority to establish a national transit safety framework, requires DOT to establish a national transit safety plan which includes safety performance criteria and standards and a Safety Certification Training Program for federal and state workers, contractors who conduct oversight, and transit workers responsible for safety oversight, and requires FTA funding recipients to create an agency safety plan and certify it meets FTA requirements.
|
From page 68... ...
67 American Public Transportation Association (APTA) DHS Homeland Security Exercise and Evaluation Program (HSEEP)
|
From page 69... ...
68 Key elements of HSEEP's approach to exercise program management include: • Engaging Elected and Appointed Officials to Provide Intent and Direction. • Developing a Multi-year Training and Exercise Plan and Establishing Multi-year Exercise Program Priorities.
|
From page 70... ...
69 Regarding the planning teams and reporting structure, a sample planning team structure and recommendations regarding organizational structure are provided in HSEEP: Planning team structure: The team can be structured according to an ICS-type structure with the Exercise Planning Team Leader in the Commander position. Operations develops and evaluates the scenario.
|
From page 71... ...
70 NCHRP Synthesis 468: Interactive Training for All-Hazards Emergency Planning, Preparation, and Response for Maintenance and Operations Field Personnel Citation. Nakanishi, Yuko J
|
From page 72... ...
71 Additional findings included: Peer-to-Peer Training, Field Training, In-House Training, Professional Organizations and Certifications, and Other Training. Findings on Use of Exercises included: discussion-based exercises, operations-based exercises, exercise evaluation, exercise scenarios, training and exercises for PWs, training and exercises for contractors, and law enforcement and fire departments.
|
From page 73... ...
72 The report states that all transportation employees contribute to security by being vigilant and detecting suspicious activity, and by deterring unlawful acts simply by their presence. The report also notes that all employees should also understand the risks to transportation systems and assets, know how to recognize a security risk, what to do and what to do, and how to report a security threat.
|
From page 74... ...
73 Challenges: Experienced workers may be averse to provide on-the-job training due to liability concerns. Lack of qualified trainers.
|
From page 75... ...
74 Role-based learning objective profiles Prioritized list of potential TERA scenarios Phase 2 Developed storyboards and facilitator/user guides Developed a prototype module Performed field testing of the prototype module Phase 3 Developed the scenario-based training system Executed Test Plan Chapter 3 presents the project findings. Table 3, Scenarios with Task Function Differentiators, is included in this Chapter.
|
From page 76... ...
75 http://www.nap.edu/catalog/18574/advancing-workforce-health-at-the-department-of-homelandsecurity-protecting Synopsis. From the Transport Research International Documentation (TRID)
|
From page 77... ...
76 Workplace Violence in the Road Passenger Transport Sector in Maputo City, Mozambique: Extent, Causes, Consequences and Prevention Citation. Cuoto, Maria Tereza, Workplace violence in the road passenger transport sector in Maputo City, Mozambique: extent, causes, consequences and prevention, Karolinska Institutet, Stockholm, Sweden, 2011, [Online]
|
From page 78... ...
77 The report (1) evaluates the credentialing system to identify duplicative elements and redundant costs and (2)
|
From page 79... ...
78 Goal 1: Manage risks to transportation systems from terrorist attack and enhance system resilience. Goal 2: Enhance effective domain awareness of transportation systems and threats.
|
From page 80... ...
79 transport. These scenarios led to the risk-based priority of enhancing frontline employee security training and awareness.
|
From page 81... ...
80 Synopsis. A guide prepared to assist state DOTs understand the fundamentals of preventing incidents within their control, protect transportation users, supporting other responders, recover from incidents and evaluate responses.
|
From page 82... ...
81 Synopsis.This edition of TRB's Transportation Research Record includes 18 papers that examine resilience and climate change issues related to transportation: Roadmaps for Adaptation Measures of Transportation to Climate Change. Resilience Versus Risk: Assessing Cost of Climate Change Adaptation to California's Transportation System and the City of Sacramento, California.
|
From page 83... ...
82 Synopsis. The workshop emphasized the important relationship between land use planning and hazard mitigation, noting that how we design, build, and regulate our communities impacts their ability to withstand hazards.
|
From page 84... ...
83 Building Resilient States: A Framework for Agencies Citation. Building Resilient States: A Framework for Agencies, Smart Growth America.
|
From page 85... ...
84 Synopsis. The Infrastructure Resilience Analysis Methodology (IRAM)
|
From page 86... ...
85 Citation. Stephen Diarmuid Walsh MIPI AIED, Martina Madden, Stephen M
|
From page 87... ...
86 those plans and how the framework may be applied to increase resiliency. These plans are selected from three different states with diversity of locations and without any preconceived notions about their incorporation of resiliency in their planning process.
|
From page 88... ...
87 Citation. NCHRP Project 20-59(53)
|
From page 89... ...
88 its transportation assets, and outlines steps state DOTs can take to assess vulnerability and identify and implement changes to improve the system's resilience. The section reviews the effects of climate change and the impact extreme weather can have on a state's transportation assets.
|
From page 90... ...
89 Adaptation measures for critical components of the transportation system to accommodate variable and unexpected conditions without catastrophic failure; Greater resiliency of the regional supply chain by identifying options for goods movement during and after events; Cooperative partnerships with federal, state, local agencies, and other stakeholders to adapt the transportation system and improve recovery from disruptions. Transportation Sector Resilience, Final Report and Recommendations Citation.
|
From page 91... ...
90 • Chronic underinvestment in transportation infrastructure and the inability to monetize resilience for investment decisions have prevented resilience from being integrated into the built infrastructure. • There is no national consensus on the need for investment in resilient transportation infrastructure due in part to a limited understanding among the public, political leaders, and industry leaders about the role and value of resilience.
|
From page 92... ...
91 G Homeland Security Laws, Directives, and Guidance NCHRP Synthesis 472: FEMA and FHWA Emergency Relief Funds Reimbursements to State Departments of Transportation Citation.
|
From page 93... ...
92 reconstruction projects, leading to unique challenges and opportunities. Essential environmental and other regulatory requirements of resource agencies must be achieved on an expedited basis.
|
From page 94... ...
93 incorporate these areas into their assessments, ensure that assessment data are consistently collected, and work with other federal entities to develop guidance for what areas to include in vulnerability assessments, among other things. DHS concurred with these recommendations." Critical Infrastructures: Background, Policy, and Implementation Citation.
|
From page 95... ...
94 Citation. Emergency Transportation Relief: Agencies Could Improve Collaboration Begun during Hurricane Sandy Response.
|
From page 96... ...
95 programs to all sizes of transit systems and cost constraints; and 5) Providing an overview of legal issues pertinent to transit emergency management, including tort liability and immunities, understanding disaster public assistance programs, working with security-sensitive information, and developing memoranda of understanding.
|
From page 97... ...
96 systems. However, DHS has not always provided timely, comprehensive, or proactive guidance to help states implement provisions of the Act related to identity verification… Officials in some states indicated they needed direction from DHS in this area.
|
From page 98... ...
97 Prioritize private sector preparedness 9. Bolstering the Security of U.S.
|
From page 99... ...
98 National Incident Management System (NIMS) Citation.
|
From page 100... ...
99 H Space Weather Space-weather events are naturally occurring phenomena in the space environment that have the potential to disrupt technologies and systems in space and on Earth.
|
From page 101... ...
100 National Space Weather Strategy and National Space Weather Action Plan The newly released National Space Weather Strategy (Strategy) and Space Weather Action Plan (Action Plan)
|
From page 102... ...
101 and meetings will provide an opportunity for other countries to learn more about the purpose and goals of the National Space Weather Strategy and accompanying Action Plan; ensure that policymakers in and leaders of partner nations recognize space weather as a global challenge; and facilitate the sustained, coordinated participation of partner nations in relevant international spaceweather initiatives. Including Space Weather in Transportation "Fundamentals" Reports.
|
From page 103... ...
102 I Active Shooter Safety Guidelines for Armed Subjects, Active Shooter Situations Citation.
|
From page 104... ...
103 Active Shooter Preparedness, Department of Homeland Security Citation. "Active Shooter: What You Can Do," Department of Homeland Security, Washington, DC, December 2015 [Online]
|
From page 105... ...
104 Synopsis. The DHS webinar video on active shooter awareness is intended to assist the private and public sector understand the importance of developing an emergency response plan and the employee training for active shooter situations.
|
From page 106... ...
105 Tactical intervention is too late Transportation capabilities A lessons learned with respect to outdoor venues is that securing an open venue is difficult and presents opportunities for the perpetrator to use different weapons (e.g., guns and pre-planted explosive devices)
|
From page 107... ...
106 Options for Consideration Active Shooter Preparedness Video Citation. "Options for Consideration Active Shooter Preparedness Video," Department of Homeland Security, Washington, DC, 2015, [Online]
|
From page 108... ...
107 4) Agency representatives shall provide training, materials, and/or awareness discussions to inform employees of active shooter preparedness plans as they are updated.
|
From page 109... ...
108 Shots Fired: When Lightning Strikes (DVD/Online Video) Citation.
|
From page 110... ...
109 Additional courses of interest offered by the Center for Personal Protection and Safety (CPPS) include the following.
|
From page 111... ...
110 • Notification, warning, and communications procedures; • Means for locating family members in an emergency; • Emergency response procedures; • Evacuation, shelter, and accountability procedures; • Location and use of common emergency equipment; and • Emergency shutdown procedures. Additional topics may include first-aid procedures, including protection against blood borne pathogens; respiratory protection, including use of an escape-only respirator; and methods for preventing unauthorized site access.
|
From page 112... ...
111 Based on these criteria, the authors identified 110 active shooter events. Data sources included agency reports, FBI's supplemental homicide reports, and news items.
|
From page 113... ...
112 ISC Violence in the Federal Workplace: A Guide for Prevention and Response and Appendix, 1st Edition (April 2013) Citation.
|
From page 114... ...
113 ISC Occupant Emergency Programs Guide, 1st Edition (March 2013) Citation.
|
From page 115... ...
114 situations through the development of an Occupant Emergency Plan, and staff training and drills. Training content may include: "Reinforce the need to quickly react when gunshots are heard and/or when a shooting is witnessed, including one or more of the following: Evacuating the area Hiding out Acting against the shooter as a last resort Notifying FLETC Security Reacting when security force/law enforcement officers arrive Adopting the survival mindset during times of crisis Documenting the familiarization activity for your records" Managing the consequences of an incident and post-incident assessment activities are also noted in this document.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.