# Presentation: 064968

## National Communications System

***National Communications System***
***      ******National Coordinating Center***

***NCC Watch***

**Mr. John O’Connor **
**Operations Manager, NCC**
**703-235-5028**
**John.o’connor@hq.dhs.gov**

## NCC Mission:

***National Coordinating Center (NCC)***

**NCC Mission:**

## Communications ISAC

***Communications ISAC***

*The Communications ISAC, a function of the NCC, supports the NCC mission by facilitating voluntary collaboration and information sharing among its participants; gathering information on vulnerabilities, threats, intrusions, and anomalies from the telecommunications industry, government, and other sources; and analyzing data with the goal of averting or mitigating impact upon the telecommunication infrastructure.*

## 	WAO is composed of the following:

Senior analysts stand watch 24X7

Co-located with industry representatives
Close integration with Comm-ISAC industry members 
Operational procedures built on NCC trust relationships
Operational arm of both the NCC and Comm-ISAC

Situational Awareness/Alert/Warning functions
Manage the information sharing/warning process
Liaison/collaboration with ISACs, other industry and government organizations
Relationships and tools that provide assessment and awareness capabilities 

Linkages with the National Operations Center (NOC), NICC, DISA, and US-CERT 

**Senior analysts stand watch 24X7**
**Co-located with industry representatives**
- Close integration with Comm-ISAC industry members
- Operational procedures built on NCC trust relationships
- Operational arm of both the NCC and Comm-ISAC
**Situational Awareness/Alert/Warning functions**
- Manage the information sharing/warning process
- Liaison/collaboration with ISACs, other industry and government organizations
- Relationships and tools that provide assessment and awareness capabilities** **
**Linkages with the National Operations Center (NOC), NICC, DISA, and US-CERT **

***NCC Watch & Analysis Operation (WAO)***

## NCC Report Sharing Relationships

- NCC

- DoD NORTHCOM

- DHS NICC

- DHS IMC

- FEMA HQ
-  (NRCC)

## Telecommunications:
Incident handling and triage – Primary responsibility of the Watch

Request for Information (RFIs) and Request for Assistance (RFAs) from Comm-ISAC members

Operational and tactical – Normal operations vs. short-term incident/event support

Direct operational impact – Hierarchical approach to dealing with communication issues 

Intelligence Fusion – Information intelligence gathering and assimilation

Telecom Estimates – An estimate on the restoration and recovery requirements for communications

- Incident handling and triage – Primary responsibility of the Watch
- Request for Information (RFIs) and Request for Assistance (RFAs) from Comm-ISAC members
- Operational and tactical – Normal operations vs. short-term incident/event support
- Direct operational impact – Hierarchical approach to dealing with communication issues
- Intelligence Fusion – Information intelligence gathering and assimilation
- Telecom Estimates – An estimate on the restoration and recovery requirements for communications

***Incident Handling and Analysis****** ***

## IMT – The NCS Infrastructure Mapping Tool (IMT), supports ART critical analyses through advanced GIS capabilities for incident management, decision support, and status tracking

VeriSign - Provides real-time monitoring of Global Top-Level Domain (gTLD) and DNS Root servers.  This is VeriSign's internal view to provide better insight into network trends as well as provide performance statistics and traffic flow data regarding the current gTLD and DNS Root server constellation. This project is developed with the hopes that it will provide the NCC Watch with a better look at the current gTLD server configuration and its correlating performance statistics. This data can then be used to provide better understanding of network topology and help isolate problems concerning the current gTLD server configuration.

US-CERT Portal – Provides collaboration groups, incident related information, and access to a variety of on-line tools including Federal Vulnerability Knowledgebase (FVK), Einstein, and Internet Health and Status service

HSIN – The Homeland Security Information Network was designated by the Secretary of Homeland Security as the information sharing portal for DHS

NAWAS – National Warning System is a 24-hour continuous private line telephone system used to convey warnings to Federal, State and local governments, as well as the military and civilian population

**VeriSign **- Provides real-time monitoring of Global Top-Level Domain (gTLD) and DNS Root servers.  This is VeriSign's internal view to provide better insight into network trends as well as provide performance statistics and traffic flow data regarding the current gTLD and DNS Root server constellation. This project is developed with the hopes that it will provide the NCC Watch with a better look at the current gTLD server configuration and its correlating performance statistics. This data can then be used to provide better understanding of network topology and help isolate problems concerning the current gTLD server configuration.
**US-CERT Portal** – Provides collaboration groups, incident related information, and access to a variety of on-line tools including Federal Vulnerability Knowledgebase (FVK), Einstein, and Internet Health and Status service
**HSIN **–** **The Homeland Security Information Network was designated by the Secretary of Homeland Security as the information sharing portal for DHS
**NAWAS** – National Warning System is a 24-hour continuous private line telephone system used to convey warnings to Federal, State and local governments, as well as the military and civilian population

*** ******WAO Tools****** ***

## HURREVAC – Real-time data analysis tool allows state and local emergency management officials to make prudent and informed decisions based on information developed during the FEMA Hurricane Evacuation Studies process and real-time forecast data distributed by the National Weather Service (NWS) and the Tropical Prediction Center/National Hurricane Center (NHC)

HURRTRAK – Offers an advanced set of functions and capabilities related to the analysis of tropical systems as well as their potential impact to land/sea areas, on line real-time information from NHC

MSL – Master Station Log – online daily log of Watch activities, provides historical data, incident tracking, and task management

Battle Book – Online incident and triage management SOPs and CONOPS

Teleconferences – IT-ISAC, US-CERT, and NTOC CWIN

Information processing capabilities up to the TS/SCI level

**HURRTRAK** – Offers an advanced set of functions and capabilities related to the analysis of tropical systems as well as their potential impact to land/sea areas, on line real-time information from NHC
**MSL** – Master Station Log – online daily log of Watch activities, provides historical data, incident tracking, and task management
**Battle Book** – Online incident and triage management SOPs and CONOPS
**Teleconferences** – IT-ISAC, US-CERT, and NTOC CWIN
- Information processing capabilities up to the TS/SCI level

***WAO Tools****** ******Cont.***

## Slide 9

## Phone:
703-235-5080 			(Non-Secure)
703-235-5097 			(Secure Voice & Fax)
Fax:
703-235-5078 			(Unclassified)
Email:
ncs@dhs.gov 			(Non-Secure)
omncs@dhs.sgov.gov 		(HSDN)
ncs@dhs.ic.gov			(JWICS)

- 703-235-5080 			(Non-Secure)
- 703-235-5097 			(Secure Voice & Fax)
**Fax:**
- 703-235-5078 			(Unclassified)
**Email:**
- _[ncs@dhs.gov](mailto:ncs@dhs.gov)__ __	__	__	__(Non-Secure)_
- _[omncs@dhs.sgov.gov](mailto:omncs@dhs.sgov.gov)__ __	__	__(HSDN)_
- _[ncs@dhs.ic.gov](mailto:ncs@dhs.ic.gov)__	__	__	__(JWICS)_

***NCC Watch Contact Information***